WO2021047477A1 - 一种密钥分配方法、系统、移动终端和可穿戴设备 - Google Patents

一种密钥分配方法、系统、移动终端和可穿戴设备 Download PDF

Info

Publication number
WO2021047477A1
WO2021047477A1 PCT/CN2020/113815 CN2020113815W WO2021047477A1 WO 2021047477 A1 WO2021047477 A1 WO 2021047477A1 CN 2020113815 W CN2020113815 W CN 2020113815W WO 2021047477 A1 WO2021047477 A1 WO 2021047477A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
mobile terminal
wearable device
key distribution
communication
Prior art date
Application number
PCT/CN2020/113815
Other languages
English (en)
French (fr)
Inventor
赵勇
刘春华
Original Assignee
科大国盾量子技术股份有限公司
山东量子科学技术研究院有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 科大国盾量子技术股份有限公司, 山东量子科学技术研究院有限公司 filed Critical 科大国盾量子技术股份有限公司
Publication of WO2021047477A1 publication Critical patent/WO2021047477A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0852—Quantum cryptography
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
    • G06K17/00—Methods or arrangements for effecting co-operative working between equipments covered by two or more of main groups G06K1/00 - G06K15/00, e.g. automatic card files incorporating conveying and reading operations
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
    • G06K17/00—Methods or arrangements for effecting co-operative working between equipments covered by two or more of main groups G06K1/00 - G06K15/00, e.g. automatic card files incorporating conveying and reading operations
    • G06K17/0022—Methods or arrangements for effecting co-operative working between equipments covered by two or more of main groups G06K1/00 - G06K15/00, e.g. automatic card files incorporating conveying and reading operations arrangements or provisions for transferring data to distant stations, e.g. from a sensing device
    • G06K17/0025—Methods or arrangements for effecting co-operative working between equipments covered by two or more of main groups G06K1/00 - G06K15/00, e.g. automatic card files incorporating conveying and reading operations arrangements or provisions for transferring data to distant stations, e.g. from a sensing device the arrangement consisting of a wireless interrogation device in combination with a device for optically marking the record carrier
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3231—Biological data, e.g. fingerprint, voice or retina

Definitions

  • This application belongs to the technical field of secure communication, and in particular relates to a key distribution method, system, mobile terminal, and wearable device.
  • the current quantum secure communication network is generally set up for specific customers, and most of them are government agencies, such as accessing the quantum secure communication network on a fixed telephone inside the unit.
  • communication in most occasions in daily life does not need to be strictly confidential, there is also a need for confidential communication.
  • a dedicated quantum encryption mobile phone is specially purchased for the confidentiality needs of a few occasions, the cost is relatively high. . Therefore, it is necessary to discuss how to apply quantum keys to individual users' mobile terminals.
  • the combination of quantum key and one-time encryption algorithm can theoretically guarantee the unconditional security of communication, but in the specific practical stage, it is still affected by the specific communication equipment and the way of use.
  • Mobile terminals have the characteristics of flexibility of use and geographic variability. If the quantum key is sent to the mobile terminal in a wired form before the confidential communication, the mobile terminal loses the advantage of flexibility, and it is no different from a fixed telephone, which will cause inconvenience in use.
  • the quantum key is sent to the mobile terminal in a wireless form before confidential communication, the security during the transmission process cannot be guaranteed, and the key has the risk of being intercepted; even if the two-level key form is used, the required communication services
  • the second-level key is sent after the first-level encryption shared with the mobile terminal, so the first-level key needs to be stored in the mobile terminal in advance.
  • Quantum Wireless Secure Communication System and Mobile Terminal proposes a technical solution for pre-storing the key to the mobile terminal: the service terminal pre-assigns the same mobile terminal that needs to perform secure communication in advance. Quantum key, so that the mobile terminal can perform secure communication in real time; if the at least two mobile terminals that have not previously allocated the same quantum key need to temporarily perform secure communication, the service terminal will encrypt the same quantum key Then, they are allocated to mobile terminals that need to conduct confidential communication in real time. In this way, there is a risk that the phone itself is stolen, or the key is stolen by Trojan horse software.
  • the present application provides a key distribution method, system, mobile terminal and wearable device, by pre-storing the quantum key in the mobile terminal to be established communication, and distributing the service key in In the manner of position marking in the quantum key, in addition, before the key position marking is distributed, identity authentication is also performed based on the biometric information obtained by the wearable device, which ensures the security of confidential communication.
  • a method for key distribution in which mobile terminals to be established for communication all store the same quantum key in advance, and the quantum key is generated and stored by a key distribution network, the method comprising:
  • the initiating mobile terminal or the receiving mobile terminal of the to-be-established communication initiates a key distribution request to the key distribution network via the wearable device bound to it;
  • the key distribution network receives the key distribution request, and distributes the position mark of the service key of this communication in the quantum key to the mobile terminal via the wearable device;
  • the mobile terminal obtains the service key from the quantum key according to the location mark.
  • the initiating key distribution request specifically includes:
  • the initiating mobile terminal or the receiving mobile terminal of the to-be-established communication sends a communication event to the wearable device bound to it.
  • the communication event includes the communication initiator and receiver information, where the initiator/receiver information includes the initiator /Recipient's device information and/or contact information;
  • the wearable device collects the user biometric information of the holder, generates a key distribution request based on the collected user biometric information and the communication event, and sends it to the key distribution network.
  • the key distribution network stores a binding relationship table and a key distribution management table;
  • the binding relationship table records mobile terminal device information and/or contact information of a registered user, and biometric information of the user;
  • the key distribution management table records the distribution status of each part of the quantum key; the distribution status includes:
  • the position mark of the service key allocated for this communication in the quantum key includes:
  • the key distribution network first authenticates the holder according to the user biometric information and the binding relationship table
  • the mobile terminal obtains the location mark from the wearable device.
  • the identity authentication includes: searching from the binding relationship table whether there is a record consistent with the received user biometric information, mobile terminal device information and/or contact information, if it exists, the authentication is passed, and vice versa , The certification is not passed.
  • the key distribution network sends an alarm signal to the wearable device, and after the wearable device receives the alarm signal, it alarms the surroundings or specific institutions by voice or other forms;
  • the key distribution network sends an alarm signal to the wearable device. After the wearable device receives the alarm signal, it collects the current location in real time, and sends it to the key distribution network every set time interval;
  • the key distribution network sends an alarm signal to the wearable device. After the wearable device receives the alarm signal, it deletes the pre-stored shared key with the key distribution network, and deletes other stored sensitive information ;
  • the key distribution network cancels or suspends the use authority of the wearable device.
  • the method for the mobile terminal to obtain a location mark is:
  • the wearable device sends the location mark to the mobile terminal through wireless or wired communication; or, the wearable device displays the received location mark in the form of a code pattern, and the mobile terminal scans the code to obtain The position is marked.
  • the encoding pattern form is a barcode or a two-dimensional code.
  • the quantum key is stored in a continuous binary data mode
  • the service key is composed of a plurality of discontinuous key segments in the quantum key
  • the position mark includes a use order and a pointer interval; wherein, the The use order indicates the order of the plurality of discontinuous key segments in the service key, and the pointer interval indicates the byte interval of each key segment in the quantum key.
  • the quantum key is stored in the form of multiple key segments
  • the service key is composed of several of the multiple key segments
  • the position mark includes a use order and a pointer interval;
  • the use order represents the sequence of the multiple key segments in the service key, and the pointer interval represents the sequence number of each key segment in the quantum key.
  • the communication event also includes a communication type, which is used to determine the length of the key to be distributed.
  • the communication event also includes the key length required for this communication service.
  • the wearable device pre-stores a shared quantum key with the key distribution network for encryption and decryption of communication with the key distribution network.
  • the mobile terminal pre-stores the shared quantum key between the wearable device bound to the mobile terminal for encryption and decryption of the location mark.
  • One or more embodiments provide a key distribution system, including:
  • the initiating mobile terminal and the receiving mobile terminal of the to-be-established communication both store the quantum key in advance;
  • the mobile terminal initiating a key distribution request to the key distribution network includes:
  • the initiating mobile terminal or the receiving mobile terminal of the to-be-established communication sends a communication event to the wearable device bound to it.
  • the communication event includes the communication initiator and receiver information, where the initiator/receiver information includes the initiator /Recipient's device information and/or contact information;
  • the wearable device collects the user biometric information of the holder, generates a key distribution request based on the collected user biometric information and the communication event, and sends it to the key distribution network.
  • the key distribution network stores a binding relationship table and a key distribution management table;
  • the binding relationship table records mobile terminal device information and/or contact information of a registered user, and biometric information of the user;
  • the key distribution management table records the distribution status of each part of the quantum key; the distribution status includes:
  • the position mark of the service key allocated for this communication in the quantum key includes:
  • the key distribution network first authenticates the holder according to the user's biometric information
  • the mobile terminal obtains the location mark from the wearable device.
  • the identity authentication includes: searching from the binding relationship table whether there is a record consistent with the received user biometric information, mobile terminal device information and/or contact information, if it exists, the authentication is passed, and vice versa , The certification is not passed.
  • the key distribution network sends an alarm signal to the wearable device, and after the wearable device receives the alarm signal, it alarms the surroundings or specific institutions by voice or other forms;
  • the key distribution network sends an alarm signal to the wearable device. After the wearable device receives the alarm signal, it collects the current location in real time, and sends it to the key distribution network every set time interval;
  • the key distribution network sends an alarm signal to the wearable device. After the wearable device receives the alarm signal, it deletes the pre-stored shared key with the key distribution network, and deletes other stored sensitive information ;
  • the key distribution network cancels or suspends the use authority of the wearable device.
  • the method for the mobile terminal to obtain a location mark is:
  • the wearable device sends the location mark to the mobile terminal through wireless or wired communication; or, the wearable device displays the received location mark in the form of a code pattern, and the mobile terminal scans the code to obtain The position is marked.
  • the encoding pattern form is a barcode or a two-dimensional code.
  • the quantum key is stored in a continuous binary data mode
  • the service key is composed of a plurality of discontinuous key segments in the quantum key
  • the position mark includes a use order and a pointer interval; wherein, the The use order indicates the order of the plurality of discontinuous key segments in the service key, and the pointer interval indicates the byte interval of each key segment in the quantum key.
  • the quantum key is stored in the form of multiple key segments
  • the service key is composed of several of the multiple key segments
  • the position mark includes a use order and a pointer interval;
  • the use order represents the sequence of the multiple key segments in the service key, and the pointer interval represents the sequence number of each key segment in the quantum key.
  • the communication event also includes a communication type, which is used to determine the length of the key to be distributed.
  • the communication event also includes the key length required for this communication service.
  • the wearable device pre-stores a shared quantum key with the key distribution network for encryption and decryption of communication with the key distribution network.
  • the mobile terminal pre-stores the shared quantum key between the wearable device bound to the mobile terminal for encryption and decryption of the location mark.
  • One or more embodiments provide a key distribution network that generates and stores a quantum key, which is stored in advance in a mobile terminal to establish communication;
  • the key distribution request includes this communication event and user biometric information collected by the wearable device, and the communication event includes communication initiator and receiver information, where the initiator/receiver information includes Initiator/receiver device information and/or contact information.
  • the key distribution network stores a binding relationship table and a key distribution management table;
  • the binding relationship table records mobile terminal device information and/or contact information of a registered user, and biometric information of the user;
  • the key distribution management table records the distribution status of each part of the quantum key; the distribution status includes:
  • the position mark of the service key allocated for this communication in the quantum key includes:
  • the key distribution network first authenticates the holder according to the user's biometric information
  • the location mark in the record is sent to the wearable device, and the allocation situation is marked as fully allocated; the location mark is provided by the wearable device to the mobile terminal.
  • the identity authentication includes: searching from the binding relationship table whether there is a record consistent with the received user biometric information, mobile terminal device information and/or contact information, if it exists, the authentication is passed, and vice versa , The certification is not passed.
  • the quantum key is stored in a continuous binary data mode
  • the service key is composed of a plurality of discontinuous key segments in the quantum key
  • the position mark includes a use order and a pointer interval; wherein, the The use order indicates the order of the plurality of discontinuous key segments in the service key, and the pointer interval indicates the byte interval of each key segment in the quantum key.
  • the quantum key is stored in the form of multiple key segments
  • the service key is composed of several of the multiple key segments
  • the position mark includes a use order and a pointer interval;
  • the use order represents the sequence of the multiple key segments in the service key, and the pointer interval represents the sequence number of each key segment in the quantum key.
  • the communication event also includes a communication type, which is used to determine the size of the service key to be distributed.
  • the communication event also includes the key length required for this communication service.
  • the wearable device pre-stores the shared quantum key with the key distribution network for encryption and decryption of the communication with the key distribution network.
  • One or more embodiments provide a mobile terminal, which stores the same quantum key in advance with another mobile terminal that has pre-established communication, and the quantum key is generated and stored by a key distribution network;
  • the mobile terminal sends a communication event to the wearable device bound to it, and the wearable device further initiates a key distribution request to the key distribution network;
  • the service key is obtained from the quantum key.
  • the mobile terminal initiates a key distribution request to the key distribution network via a wearable device; and obtains the location mark distributed by the key distribution network from the wearable device.
  • the location mark allocated by the key distribution network obtained from the wearable device is:
  • the wearable device sends the location mark to the mobile terminal through wireless or wired communication; or, the wearable device displays the received location mark in the form of a code pattern, and the mobile terminal scans the code to obtain The location is marked.
  • the mobile terminal pre-stores the shared quantum key between the wearable device bound to the mobile terminal, which is used for encryption and decryption of the location mark.
  • the communication event includes communication initiator and receiver information.
  • the communication event also includes the type of communication or the key length required for this communication service.
  • One or more embodiments provide a wearable device that is bound to an initiator mobile terminal or a receiver mobile terminal, and both the initiator mobile terminal and the receiver mobile terminal store the same quantum key in advance;
  • Collect the user biometric information of the holder Collect the user biometric information of the holder, generate a key distribution request based on the collected user biometric information and communication events and send it to the key distribution network;
  • the method for providing a location mark to a mobile terminal includes: the wearable device transmits the location mark to the mobile terminal through wireless or wired communication; or, the wearable device transmits the location mark It is displayed in the form of a coded pattern for the mobile terminal to scan.
  • the encoding pattern form is a barcode or a two-dimensional code.
  • the wearable device pre-stores the shared quantum key between the mobile terminals bound to it, and is used for encryption and decryption of the location mark.
  • One or more embodiments provide a quantum key-based secure communication method. Based on the service key obtained by the above distribution method, the initiator mobile terminal and the receiver mobile terminal perform secure communication
  • This application provides a method for distributing a quantum key to a mobile terminal.
  • the method pre-stores the same quantum key in the mobile terminal before confidential communication.
  • the key distribution network distributes, it is only distributed for this time.
  • the position of the communication service key in the quantum key is marked, and the mobile terminal obtains the service key according to the position mark and the pre-stored quantum key. Therefore, if the data is intercepted during transmission, only the location tag data is intercepted, and the real service key cannot be obtained; if the mobile phone is stolen or the quantum key is stolen, the service key cannot be retrieved because there is no location tag information. Cracking, thus ensuring the security of communication data.
  • This application uses a wearable device with the function of uploading biometric information as an isolator between the key distribution network and the mobile terminal that actually uses the quantum key for communication, which solves the problem of dynamically distributing quantum keys for legal mobile terminals.
  • the problem is that the key distribution network recognizes the biometric information uploaded by the wearable device, which ensures that the mobile terminal that distributes the key is the owner.
  • This application uses the two-dimensional code optical scanning method to solve the "last mile" of quantum key transmission, which can effectively prevent the signal leakage problem of near-field wireless transmission methods such as Bluetooth.
  • Figure 1 is a flow chart of the key distribution method
  • Figure 2 is a schematic diagram of a key distribution process based on a wearable device.
  • the mobile terminals referred to in this application include but are not limited to mobile phones and tablets, and all electronic devices capable of network connection are suitable for the mobile terminals of this application.
  • the wearable devices mentioned in this application include, but are not limited to, smart rings, smart bracelets, smart watches, smart necklaces and other small devices that come in contact with the human body and are carried around.
  • the wearable device has the function of biological information recognition, the function of wireless network transmission of data, the key storage function, and the two-dimensional code display function.
  • Wearable device access to the network that is, the wearable device is registered to the key distribution network in advance, and the shared quantum key with the key distribution network is stored in advance.
  • the registration method is: wearable device holders (which can be individuals, or wearable device manufacturers, sellers, and users) first go to the operating agency of the key distribution network to go through the relevant procedures for registration and access to the network, and the key The operating agency of the distribution network is responsible for reviewing the user’s network access application. If approved, each wearable device that applies for network access will be issued a unique quantum identity number distributed by the key distribution network in the entire network. The quantum identity number is Stored in the permanent storage medium of the wearable device applying for access to the network.
  • the shared key pre-stored on the wearable device during registration with the key distribution network can be used for a long time. If you want to improve security, you can change the shared key stored on the wearable device regularly.
  • One method is that the key distribution network generates a new key, encrypts the new shared key with the old shared key, and sends it to the wearable device.
  • the biometric information can be one or more of heartbeat information, blood pressure information, fingerprint information, retina information, iris information, voiceprint information, vein information, facial information, and handwriting signature information, which are collected and submitted through a wearable device To the key distribution network.
  • This embodiment discloses a key distribution method, as shown in FIG. 1, in which the mobile terminals to be established for communication all pre-store the same quantum key, and the quantum key is generated and stored by the key distribution network.
  • Quantum key distribution (QKD) technology can be used or generated by a quantum random number generator. The method specifically includes:
  • Step 1 The initiating mobile terminal or the receiving mobile terminal of the to-be-established communication initiates a key distribution request to the key distribution network via the wearable device bound to it;
  • Step 2 The key distribution network receives the key distribution request, and distributes the position mark of the service key of this communication in the quantum key to the mobile terminal;
  • Step 3 The mobile terminal obtains the service key from the quantum key according to the location mark.
  • the key distribution request includes this communication event
  • the communication event may include communication initiator and receiver information
  • the initiator/receiver information includes but is not limited to initiator/receiver device information ( For example, mobile terminal device ID), it also includes initiator/receiver contact information, such as mobile phone number, social media account, and all other information that can be used to identify the identity of the initiator/receiver.
  • the key distribution network manages the distribution of each part of the quantum key; the distribution includes: it has been distributed to the initiator and the receiver, recorded as fully distributed; only distributed to one of the initiator and the receiver, It is recorded as not fully allocated; if it is not allocated to any party, it is recorded as unallocated.
  • the key distribution network manages the distribution of each part of the quantum key through a key distribution management table.
  • the key distribution management table includes fields such as initiator, receiver, quantum key location mark, and distribution status, where the distribution status includes: has been distributed to the initiator and the receiver, recorded as fully distributed; only distributed To one of the initiator and receiver, it is recorded as incomplete allocation; if it is not allocated to any party, it is recorded as unallocated, that is, the initial value of the originator and recipient fields corresponding to the record with the allocation as unallocated is empty.
  • the step 2 specifically includes:
  • the key distribution network first searches the records that are not fully distributed to see if there is a record in which the initiator and receiver information is consistent with the communication event:
  • the location mark corresponding to the partial key is sent to the mobile terminal, and the partial key is marked as completely distributed.
  • a wearable device-based key distribution method in order to improve security and ensure that it is the device owner who initiates confidential communication, a wearable device-based key distribution method is provided.
  • the initiator mobile terminal and the recipient mobile The terminal respectively initiates a key distribution request to the key distribution network via the wearable device bound to it.
  • the step 1 includes:
  • the initiating mobile terminal initiates a confidential communication request to the receiving mobile terminal
  • the receiver's mobile terminal performs an access operation and sends this communication event to the receiver's wearable device; the receiver's wearable device collects the biometric information of the receiver user, and generates a key based on the biometric information and the communication event
  • the distribution request is sent to the key distribution network;
  • the initiator mobile terminal After the initiator mobile terminal receives the message that the receiver mobile terminal has accessed, it sends this communication event to the initiator wearable device; the initiator wearable device collects the biometric information of the initiator user based on the biological The identification information and the communication event generate a key distribution request and send it to the key distribution network.
  • the key distribution network stores the binding relationship table and the key distribution management table.
  • the binding relationship table records the mobile terminal device information and/or contact information of the registered user, as well as the biometric information of the user.
  • the key distribution management table is used to manage the distribution of each part of the quantum key.
  • the key distribution management table includes fields such as initiator, receiver, quantum key location tag, and distribution status, where the distribution status includes: already assigned to the initiator and receiver, It is recorded as fully allocated; it is only allocated to one of the initiator and the recipient, and it is recorded as incomplete allocation; if it is not allocated to any party, it is recorded as unallocated, that is, the allocation status is the originator and recipient fields corresponding to the unallocated record The initial value is empty.
  • the key distribution network receives user biometric information and communication events sent by the wearable device, and distributes the location mark to the wearable device.
  • the step 2 includes:
  • Step 2.1 The key distribution network first authenticates the holder according to the user biometric information and the binding relationship table; if the identity authentication is passed, execute step 2.2; if the identity authentication fails, execute step 2.3;
  • Step 2.2 Search from the incompletely allocated records in the key distribution management table whether there is a record in which the initiator and receiver information is consistent with the communication event:
  • the location mark in the record is sent to the wearable device, and the allocation situation is marked as fully allocated.
  • Step 2.3 Perform one or more of the following operations:
  • the key distribution network sends an alarm signal to the wearable device, and after the wearable device receives the alarm signal, it alarms the surroundings or specific institutions by voice or other forms;
  • the key distribution network sends an alarm signal to the wearable device. After the wearable device receives the alarm signal, it collects the current location in real time, and sends it to the key distribution network every set time interval;
  • the key distribution network sends an alarm signal to the wearable device. After the wearable device receives the alarm signal, it deletes the pre-stored shared key with the key distribution network, and deletes other stored sensitive information ;
  • the key distribution network cancels or suspends the use authority of the wearable device.
  • the identity authentication refers to finding from the binding relationship table whether there is a record consistent with the received user biometric information, mobile terminal device information, and/or contact information. , The certification is passed, otherwise, the certification is not passed.
  • the communication event also includes a communication type (video, voice, or graphic). Determine the size of the obtained key according to the communication type. Of course, you can also directly specify the required key length instead of the communication type here.
  • the quantum key is a segment of continuous binary data
  • the service key is composed of multiple discrete key segments in the quantum key.
  • the position mark includes a use order and a pointer interval, wherein the use order indicates the order of the plurality of discontinuous key segments in the service key, and the pointer interval indicates that each key segment is in The byte interval in the quantum key.
  • the location mark is as follows:
  • 1, 2, 3, and 4 before the colon are the "order of use", and "600-1000" is the "pointer interval”.
  • Use K to represent the entire quantum key composed of continuous binary data uses the 600th byte to the 1000th byte of K as the first segment, and the 344th word of K Section to the 576th byte as the second paragraph, use the 2504th byte to the 2720th byte of K as the third paragraph, and use the 1032th byte to the 2008th byte of K as the fourth paragraph, which will be spliced in order. It is the service key for this communication.
  • the quantum key is stored in the form of multiple key segments, and the service key is composed of several of the multiple key segments.
  • the position mark includes a use order and a pointer interval, wherein the use order indicates the order of the multiple key segments in the service key, and the pointer interval indicates that each key segment is in the The sequence number in the quantum key.
  • the location mark is as follows:
  • the numbers in the pointer interval represent the small key blocks numbered 96, 107, 5, 34...128.
  • the wearable device After the wearable device receives the key position mark, it generates a QR code and provides it to the mobile terminal; the mobile terminal uses the pre-stored quantum key according to the key position mark The service key used for this communication is obtained from the key, and the service key is used for the communication between the initiating mobile terminal and the receiving mobile terminal.
  • the wearable devices bound to the initiator mobile terminal and the recipient mobile terminal are registered to the key distribution network in advance, and the first shared quantum with the key distribution network is stored in advance.
  • the secret key and the second shared quantum key are respectively used for encryption and decryption between the wearable device bound to the initiator mobile terminal and the receiver mobile terminal and the key distribution network information communication.
  • the mobile terminal and the wearable device are connected in a wireless or wired manner; for stricter security considerations, in order to avoid clear text transmission between the mobile terminal and the wearable device, the mobile terminal can also be Both the corresponding wearable device and the corresponding wearable device are registered in the key distribution network, and the mobile terminal and the corresponding wearable device both pre-store the shared quantum key between the two.
  • the wearable device encrypts the location mark based on the shared quantum key, and displays the encrypted location mark in the form of a two-dimensional code; the mobile terminal scans the two-dimensional code and decrypts to obtain the location mark. In this way, even if the two-dimensional code graphic on the wearable device is captured by other camera equipment or camera equipment, the attacker cannot obtain the location mark through illegal scanning.
  • the mobile terminal T1 initiates a confidential communication request to the mobile terminal T2. After receiving the request, if T2 agrees to the communication, it returns an agreement signal.
  • the mobile terminal T1 After the mobile terminal T1 receives the consent signal, it informs the wearable device bound to it of the identity of the mobile terminal T2 of the communication, its own calling identity, and the type of this communication or the required key length. W1.
  • the wearable device W1 collects the biometric information of the calling party user, together with the identity of T1 and T2, as well as the communication type or key length information required for this communication, and uses it to share with the key distribution network Q The key is encrypted and sent to the key distribution network Q.
  • the key distribution network Q decrypts the information sent by W1 after receiving it, searches the biometric information sent by W1 in its own stored biometric information database, performs comparison verification, and enters the next step if it finds it.
  • the key distribution network Q maintains a database or table for managing the quantum key K, in which the usage status of the quantum key K is stored. Including which parts have been used (including the keys that have been allocated to the caller and the called party, called “fully allocated”, but also include the keys that are temporarily allocated to only one of the calling party and the called party, called “unused Fully allocated”), which parts are not used (called “unallocated”). If the previous step of verification is passed, the key distribution network will search for "T1 caller's identity and T2 callee's identity" in all currently stored "incompletely allocated” key application records.
  • the required key length is inferred according to the type of this communication (or directly according to the required key length received), and several segments of keys are drawn for use in this communication.
  • the position mark of the key in the entire K (for example, the key pointer) is encrypted with the shared key between Q and W1, and then sent to W1.
  • the key distribution network Q After the key distribution network Q sends the key pointer to W1, it records the key application (identity of the caller of T1 and the identity of the callee of T2) and marks it as "not fully allocated" because it has only received For the application of the calling end, the key distribution network must match the application of the called end according to this application record.
  • the wearable device W1 After the wearable device W1 receives the key pointer and decrypts it, it converts the information contained in it into a two-dimensional code and displays it on the screen of the wearable device W1.
  • the mobile terminal T1 scans the two-dimensional code to obtain the key pointer required for this communication.
  • the mobile terminal T2 After the mobile terminal T2 responds with consent, it also informs the W2 that it is bound to, the type of communication or the required key length, its own called identity, and the identity of the opposite mobile terminal T1.
  • the wearable device W2 collects the biometric information of the called party user, and uses the shared secret with the key distribution network Q together with the identity of T2 and the identity of T1, the communication type of this communication or the required key length information.
  • the key is encrypted and sent to the key distribution network Q.
  • the key distribution network Q decrypts the information sent by W2 after receiving it, searches the biometric information sent by W2 in its own stored biometric information database, performs comparison verification, and if found, proceeds to the next step.
  • the key distribution network Q searches for the "identity of the caller of T1 and the identity of the called party of T2" in all the current "incomplete distribution” key application records, and after finding it, uses the key pointer previously sent to W1 with W2's After the shared key is encrypted, it is sent to W2. After the transmission is completed, the key application record of the "identity of the caller of T1 and the identity of the callee of T2" is marked as "fully allocated".
  • the wearable device W2 After the wearable device W2 receives the key pointer and decrypts it, it converts the information contained in it into a QR code and displays it on the screen of the wearable device W2.
  • the mobile terminal T2 scans the two-dimensional code to obtain the key pointer required for this communication.
  • the mobile terminals T1 and T2 splice the service key required for this communication from the quantum key K stored in each of them, and use the service key to perform confidential communication.
  • the key distribution network may first receive the key distribution application from the calling end, or it may first receive the key distribution application from the called end.
  • the key distribution network gives priority to the party that receives it first, that is, when receiving the calling party's key distribution application first, first perform steps 3-4, and then perform steps 7-8; when receiving the called party's key first When assigning an application, first perform steps 7-8, and then perform steps 3-4.
  • the key distribution method can be extended to a scenario where two or more mobile terminals conduct secure communication.
  • This embodiment also provides a quantum key-based secure communication method. Based on the service key obtained by the foregoing distribution method, the initiating mobile terminal and the receiving mobile terminal perform secure communication.
  • this embodiment provides a key distribution system, including:
  • the initiating mobile terminal and the receiving mobile terminal of the to-be-established communication both store the quantum key in advance;
  • the key distribution request includes this communication event, the communication event includes communication initiator and receiver information; the initiator/receiver information includes but is not limited to initiator/receiver device information (such as mobile terminal device ID ), it may also include initiator/receiver contact information (for example, mobile phone number, social media account, etc.), which is used to identify the identity of the initiator/receiver.
  • the communication event includes communication initiator and receiver information; the initiator/receiver information includes but is not limited to initiator/receiver device information (such as mobile terminal device ID ), it may also include initiator/receiver contact information (for example, mobile phone number, social media account, etc.), which is used to identify the identity of the initiator/receiver.
  • the key distribution network manages the distribution of each part of the quantum key; the distribution includes:
  • the key distribution network manages the distribution of each part of the quantum key through a key distribution management table.
  • the key distribution management table includes fields such as initiator, receiver, quantum key location mark, and distribution status, where the distribution status includes: has been distributed to the initiator and the receiver, recorded as fully distributed; only distributed To one of the initiator and receiver, it is recorded as incomplete allocation; if it is not allocated to any party, it is recorded as unallocated, that is, the initial value of the originator and recipient fields corresponding to the record with the allocation as unallocated is empty.
  • the position mark of the service key allocated for this communication in the quantum key includes:
  • the key distribution network first searches the records that are not fully distributed to see if there is a record in which the initiator and receiver information is consistent with the communication event:
  • the location mark corresponding to the partial key is sent to the mobile terminal, and the partial key is marked as completely distributed.
  • the initiating mobile terminal and the receiving mobile terminal respectively initiate a key distribution request to the key distribution network via a wearable device bound to each.
  • the initiating mobile terminal or the receiving mobile terminal of the to-be-established communication sends a communication event to the wearable device bound to it, and the communication event includes the communication initiator and receiver information;
  • the wearable device collects the user biometric information of the holder, generates a key distribution request based on the collected user biometric information and the communication event, and sends it to the key distribution network.
  • the key distribution network stores the binding relationship table and the key distribution management table.
  • the binding relationship table records the mobile terminal device information and/or contact information of the registered user, as well as the biometric information of the user.
  • the key distribution management table is used to manage the distribution of each part of the quantum key.
  • the key distribution management table includes fields such as initiator, receiver, quantum key location tag, and distribution status, where the distribution status includes: already assigned to the initiator and receiver, It is recorded as fully allocated; it is only allocated to one of the initiator and the recipient, and it is recorded as incomplete allocation; if it is not allocated to any party, it is recorded as unallocated, that is, the allocation status is the originator and recipient fields corresponding to the unallocated record The initial value is empty.
  • the position mark of the service key allocated for this communication in the quantum key includes:
  • the key distribution network first authenticates the holder according to the user biometric information and the binding relationship table
  • the mobile terminal obtains the location mark from the wearable device.
  • the method for the mobile terminal to obtain the location mark is:
  • the wearable device displays the received position mark in the form of a code pattern, and the mobile terminal scans the code to obtain the position mark.
  • the key distribution network sends an alarm signal to the wearable device, and after the wearable device receives the alarm signal, it alarms the surroundings or specific institutions by voice or other forms;
  • the key distribution network sends an alarm signal to the wearable device. After the wearable device receives the alarm signal, it collects the current location in real time, and sends it to the key distribution network every set time interval;
  • the key distribution network sends an alarm signal to the wearable device. After the wearable device receives the alarm signal, it deletes the pre-stored shared key with the key distribution network, and deletes other stored sensitive information ;
  • the key distribution network cancels or suspends the use authority of the wearable device.
  • the identity authentication refers to finding from the binding relationship table whether there is a record consistent with the received user biometric information, mobile terminal device information, and/or contact information. , The certification is passed, otherwise, the certification is not passed.
  • the quantum key is stored as continuous binary data
  • the service key is composed of multiple discrete key segments in the quantum key.
  • the position mark includes a use order and a pointer interval; wherein the use order indicates the order of the plurality of discontinuous key segments in the service key, and the pointer interval indicates that each key segment is in the quantum The range of bytes in the key.
  • the quantum key is stored in the form of multiple key segments, and the service key is composed of several of the multiple key segments.
  • the position mark includes an order of use and a pointer interval; the order of use indicates the order of the multiple key segments in the service key, and the pointer interval indicates the position of each key segment in the quantum key. Serial number.
  • the communication event further includes a communication type, which is used to determine the length of the key to be distributed. You can also directly specify the required key length in the communication event.
  • the wearable device pre-stores a shared quantum key with the key distribution network for encryption and decryption of communication with the key distribution network.
  • the mobile terminal pre-stores the shared quantum key between the wearable device bound to the mobile terminal for encryption and decryption of the location mark.
  • This embodiment provides a key distribution network
  • the key distribution request includes this communication event, and the communication event includes communication initiator and receiver information.
  • the key distribution network manages the distribution of each part of the quantum key; the distribution includes: it has been distributed to the initiator and the receiver, recorded as fully distributed; only distributed to one of the initiator and the receiver, It is recorded as not fully allocated; if it is not allocated to any party, it is recorded as unallocated.
  • the position mark of the service key allocated for this communication in the quantum key includes:
  • the key distribution network For the key distribution request initiated by the mobile terminal, the key distribution network first searches the records of incomplete distribution whether there is a record with the initiator and receiver information consistent with the communication event:
  • the location mark corresponding to the partial key is sent to the mobile terminal, and the partial key is marked as completely distributed.
  • the key distribution request further includes user biometric information.
  • the initiating mobile terminal or the receiving mobile terminal of the to-be-established communication sends a communication event to the wearable device bound to it.
  • the communication event includes the communication initiator and receiver information; the wearable device collects the holder’s user
  • the biometric information based on the collected user biometric information and communication events, generates a key distribution request and sends it to the key distribution network.
  • the key distribution network manages the mobile terminal device information and/or contact information of registered users, as well as the binding relationship of the user's biometric information, and the key distribution situation.
  • the allocation situation includes: it has been allocated to the initiator and the recipient, recorded as fully allocated; only allocated to one of the initiator and recipient, recorded as incomplete allocation; not allocated to any party, recorded as unallocated.
  • the position mark of the service key allocated for this communication in the quantum key includes:
  • the key distribution network first authenticates the holder according to the user's biometric information
  • the mobile terminal obtains the location mark from the wearable device.
  • the identity authentication refers to finding from the binding relationship table whether there is a record consistent with the received user biometric information, mobile terminal device information, and/or contact information. , The certification is passed, otherwise, the certification is not passed.
  • the quantum key is stored as continuous binary data
  • the service key is composed of multiple discrete key segments in the quantum key.
  • the position mark includes a use order and a pointer interval; wherein the use order indicates the order of the plurality of discontinuous key segments in the service key, and the pointer interval indicates that each key segment is in the quantum The range of bytes in the key.
  • the quantum key is stored in the form of multiple key segments, and the service key is composed of several of the multiple key segments.
  • the position mark includes an order of use and a pointer interval; the order of use indicates the order of the multiple key segments in the service key, and the pointer interval indicates the position of each key segment in the quantum key. Serial number.
  • the communication event further includes a communication type
  • the key distribution network determines the length of the service key to be distributed according to the communication type. It is also possible to directly specify the required service key length in the communication event.
  • the wearable device pre-stores a shared quantum key with the key distribution network for encryption and decryption of communication with the key distribution network.
  • This embodiment provides a mobile terminal.
  • the same quantum key is stored in advance with another mobile terminal that has pre-established communication, and the quantum key is generated and stored by a key distribution network.
  • the mobile terminal sends a communication event to the wearable device bound to it, and the wearable device further initiates a key distribution request to the key distribution network;
  • the service key is obtained from the quantum key.
  • the mobile terminal initiates a key distribution request to a key distribution network via a wearable device; and obtains the location mark distributed by the key distribution network from the wearable device.
  • the mobile terminal sends a communication event to a wearable device bound to it, and the communication event includes communication initiator and receiver information; the wearable device collects the holder’s user biometric information based on the collection The user biometric information and the communication event generation key distribution request are sent to the key distribution network; and
  • the location mark is obtained from the wearable device, and the location mark is distributed to the wearable device by a key distribution network.
  • the communication event also includes the type of communication (video, voice, or graphic), or the key length required for this communication service.
  • the mobile terminal and the wearable device are connected in a wireless or wired manner.
  • the method for the mobile terminal to obtain a location mark from the wearable device is: the wearable The device sends the location mark to the mobile terminal through wireless or wired communication.
  • the wearable device can also generate codes (two-dimensional codes, barcodes, etc.) based on the location markers and display them for the mobile terminal to scan and obtain.
  • codes two-dimensional codes, barcodes, etc.
  • the mobile terminal and the corresponding wearable device can also be registered in the key distribution network, and the mobile terminal and the corresponding wearable device
  • the shared quantum key between the two is stored in advance for the encryption and decryption of the position mark, that is, the wearable device uses the shared quantum key to encrypt the position mark for transmission or encrypts it with a QR code.
  • the method is provided to the mobile terminal, and the mobile terminal obtains and uses the shared quantum key to decrypt to obtain the location mark.
  • This embodiment provides a wearable device that is bound to an initiating mobile terminal or a receiving mobile terminal. Both the initiating mobile terminal and the receiving mobile terminal store the same quantum key in advance, and the quantum key is encrypted Key distribution network generates and stores;
  • the communication event including communication initiator and receiver information
  • Collect the user biometric information of the holder Collect the user biometric information of the holder, generate a key distribution request based on the collected user biometric information and communication events, and send it to the key distribution network;
  • the wearable device displays the position mark in the form of a coded pattern (two-dimensional code, barcode, etc.), and provides it to the mobile terminal.
  • the mobile terminal can obtain the position mark through optical scanning.
  • the mobile terminal and the wearable device are connected in a wireless or wired manner.
  • the method for the mobile terminal to obtain a location mark from the wearable device is: the wearable The device sends the location mark to the mobile terminal through wireless or wired communication.
  • the mobile terminal and the corresponding wearable device can also be registered in the key distribution network, and the mobile terminal and the corresponding wearable device
  • the shared quantum key between the two is stored in advance for the encryption and decryption of the position mark, that is, the wearable device uses the shared quantum key to encrypt the position mark for transmission or encrypts it with a QR code.
  • the method is provided to the mobile terminal, and the mobile terminal obtains and uses the shared quantum key to decrypt to obtain the location mark.
  • This application provides a method for distributing a quantum key to a mobile terminal.
  • the method pre-stores the same quantum key in the mobile terminal before confidential communication.
  • the key distribution network distributes, it is only distributed for this time.
  • the position of the communication service key in the quantum key is marked, and the mobile terminal obtains the service key according to the position mark and the pre-stored quantum key. Therefore, if the data is intercepted during transmission, only the location tag data is intercepted, and the real service key cannot be obtained; if the mobile phone is stolen or the quantum key is stolen, the service key cannot be retrieved because there is no location tag information. Cracking, thus ensuring the security of communication data.
  • This application uses a wearable device with the function of uploading biometric information as an isolator between the key distribution network and the mobile terminal that actually uses the quantum key for communication, which solves the problem of dynamically distributing quantum keys for legal mobile terminals.
  • the problem is that the key distribution network recognizes the biometric information uploaded by the wearable device, which ensures that the mobile terminal that distributes the key is the owner.
  • This application uses the two-dimensional code optical scanning method to solve the "last mile" of quantum key transmission, which can effectively prevent the signal leakage problem of near-field wireless transmission methods such as Bluetooth.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Biodiversity & Conservation Biology (AREA)
  • Biomedical Technology (AREA)
  • General Health & Medical Sciences (AREA)
  • General Engineering & Computer Science (AREA)
  • Electromagnetism (AREA)
  • Telephonic Communication Services (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了一种密钥分配方法、系统、移动终端和可穿戴设备，待建立通信的移动终端均预先存储同一量子密钥，所述量子密钥由密钥分配网络生成并存储，所述方法包括：待建立通信的发起方移动终端或接收方移动终端向密钥分配网络发起密钥分配请求；密钥分配网络接收所述密钥分配请求，向所述移动终端分配本次通信的业务密钥在所述量子密钥中的位置标记；所述移动终端根据所述位置标记，从所述量子密钥中获取所述业务密钥。本申请通过在待建立通信的移动终端中预先存储量子密钥，以及分配业务密钥在所述量子密钥中位置标记的方式，保证了保密通信的安全性。

Description

一种密钥分配方法、系统、移动终端和可穿戴设备
本申请要求于2019年09月09日提交中国专利局、申请号为201910865926.X、发明名称为“一种密钥分配方法、系统、移动终端和可穿戴设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请属于保密通信的技术领域，尤其涉及一种密钥分配方法、系统、移动终端和可穿戴设备。
背景技术
目前的量子保密通信网络一般都是为特定的客户搭建，且大多都是机关企业，比如在单位内部的某台固定电话上接入量子保密通信网络。尽管日常生活中大多数场合的通信并不需要严格保密，但也有保密通信的需求，但是对于个人用户而言，如果仅仅为了少数场合的保密需求特意购置一台专用的量子加密手机，成本较高。因而有必要探讨如何将量子密钥应用到个人用户的移动终端上。
量子密钥结合一次一密算法在理论上可以保证通信的无条件安全，但是在具体实践阶段，仍然要受到具体通信器材及使用方式的影响。移动终端存在使用灵活性和地理变动性的特点。若进行保密通信前，以有线形式将量子密钥发送给移动终端，则移动终端失去了灵活性的优势，与固定电话无异，使用上会带来不便。若进行保密通信前，以无线形式将量子密钥发送给移动终端，则传输过程中的安全性无法保证，密钥具有被截获的风险；就算采用两级密钥形式，把通信业务所需的二级密钥用和移动终端共享的一级加密后再发送，那么就需要将一级密钥事先保存在移动终端中。
《量子无线保密通信系统及移动终端》(申请号：201710245497.7)中提出了一种将密钥预存至移动终端的技术方案：服务终端为预先设定的需要进行保密通信的移动终端预先分配相同的量子密钥，以便于所述移动终端实时进行保密通信；若没有预先分配过相同的量子密钥的所述至少两个移动终端需要临时进行保密通信，服务终端会把相同的量子密钥经过加密后，分别实时分配给需要进行保密通信的移动终端。这种方式存在手机本身被盗用，或者密钥被木马软件窃取的风险。
发明内容
为克服上述现有技术的不足，本申请提供了一种密钥分配方法、系统、移动终端和可穿戴设备，通过在待建立通信的移动终端中预先存储量子密钥，以及分配业务密钥在所述量子密钥中位置标记的方式，此外，在分配密钥位置标记前，还基于可穿戴设备获取的生物识别信息进行身份认证，保证了保密通信的安全性。
为实现上述目的，本申请的一个或多个实施例提供了如下技术方案：
一种密钥分配方法，待建立通信的移动终端均预先存储同一量子密钥，所述量子密钥由密钥分配网络生成并存储，所述方法包括：
待建立通信的发起方移动终端或接收方移动终端经由与其绑定的可穿戴设备向密钥分配网络发起密钥分配请求；
密钥分配网络接收所述密钥分配请求，经由所述可穿戴设备向所述移动终端分配本次通信的业务密钥在所述量子密钥中的位置标记；
所述移动终端根据所述位置标记，从所述量子密钥中获取所述业务密钥。
进一步地，所述发起密钥分配请求具体包括：
待建立通信的发起方移动终端或接收方移动终端将通信事件发送至与其绑定的可穿戴设备，所述通信事件包括通信发起方和接收方信息，其中，发起方/接收方信息包括发起方/接收方设备信息和/或联系方式信息；
所述可穿戴设备采集持有者的用户生物识别信息，基于采集的用户生物识别信息与通信事件生 成密钥分配请求发送至密钥分配网络。
进一步地，所述密钥分配网络存储绑定关系表和密钥分配管理表；所述绑定关系表记录注册用户的移动终端设备信息和/或联系方式信息，以及该用户的生物识别信息；所述密钥分配管理表记录所述量子密钥各部分的分配情况；所述分配情况包括：
已经分配给发起方和接收方，记为已完全分配；
仅分配给发起方和接收方其中一方，记为未完全分配；
未分配给任何一方，记为未分配。
进一步地，所述分配本次通信的业务密钥在所述量子密钥中的位置标记包括：
密钥分配网络首先根据所述用户生物识别信息和绑定关系表对持有者进行身份认证；
若身份认证通过，从密钥分配管理表中未完全分配的记录中查找是否存在发起方和接收方信息与所述通信事件一致的记录：
若不存在，从所述量子密钥未分配的部分中获取业务密钥，获取所述业务密钥在所述量子密钥中的位置标记发送至所述可穿戴设备，同时在密钥分配管理表中生成新记录，写入所述通信事件相应的发起方、接收方和获取的位置标记信息，并将分配情况标记为未完全分配；
若存在，则将该记录中的位置标记发送至所述可穿戴设备，同时将分配情况标记为已完全分配；
所述移动终端自所述可穿戴设备获取所述位置标记。
进一步地，所述身份认证包括：从绑定关系表中查找是否存在与接收到的用户生物识别信息、移动终端设备信息和/或联系方式信息相一致的记录，若存在，则认证通过，反之，认证不通过。
进一步地，若身份认证未通过，执行以下一种或多种操作：
(1)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，以语音或者其他形式向周围或特定机构报警；
(2)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，实时采集当前所在位置，每隔设定时间间隔发送到密钥分配网络；
(3)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，删除预存的与密钥分配网络之间的共享密钥，以及删除存储的其他敏感信息；
(4)密钥分配网络对所述可穿戴设备注销或暂停其使用权限。
进一步地，所述移动终端获取位置标记的方法为：
所述可穿戴设备通过无线或有线通信的方式将所述位置标记发送至所述移动终端；或，所述可穿戴设备将接收到的位置标记以编码图案形式显示，移动终端扫描所述编码获取所述位置标记。
进一步地，所述编码图案形式为条形码或者二维码。
进一步地，所述量子密钥以连续二进制数据方式存储，所述业务密钥由量子密钥中的多个不连续密钥段组成，所述位置标记包括使用顺序和指针区间；其中，所述使用顺序表示所述业务密钥中所述多个不连续密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的字节区间。
进一步地，所述量子密钥以多个密钥段的形式存储，所述业务密钥由所述多个密钥段中的若干个组成，所述位置标记包括使用顺序和指针区间；所述使用顺序表示所述业务密钥中所述多个密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的序号。
进一步地，所述通信事件还包括通信类型，用于确定待分配的密钥长度。
进一步地，所述通信事件还包括此次通信业务所需的密钥长度。
进一步地，所述可穿戴设备预先存储与密钥分配网络之间的共享量子密钥，用于与密钥分配网络之间通信的加密和解密。
进一步地，所述移动终端预先存储与其绑定的可穿戴设备之间的共享量子密钥，用于位置标记的加密和解密。
一个或多个实施例提供了一种密钥分配系统，包括：
密钥分配网络，生成并存储量子密钥；以及
接收发起方移动终端或接收方移动终端发起的经由与其绑定的可穿戴设备处理的密钥分配请求，经由所述可穿戴设备向所述移动终端分配本次通信的业务密钥在所述量子密钥中的位置标记；
待建立通信的发起方移动终端和接收方移动终端，均预先存储所述量子密钥；以及
分别向密钥分配网络发起密钥分配请求；接收密钥分配网络分配的位置标记，根据所述位置标记从所述量子密钥中获取所述业务密钥。
进一步地，所述移动终端向密钥分配网络发起密钥分配请求包括：
待建立通信的发起方移动终端或接收方移动终端将通信事件发送至与其绑定的可穿戴设备，所述通信事件包括通信发起方和接收方信息，其中，发起方/接收方信息包括发起方/接收方设备信息和/或联系方式信息；
所述可穿戴设备采集持有者的用户生物识别信息，基于采集的用户生物识别信息与通信事件生成密钥分配请求发送至密钥分配网络。
进一步地，所述密钥分配网络存储绑定关系表和密钥分配管理表；所述绑定关系表记录注册用户的移动终端设备信息和/或联系方式信息，以及该用户的生物识别信息；所述密钥分配管理表记录所述量子密钥各部分的分配情况；所述分配情况包括：
已经分配给发起方和接收方，记为已完全分配；
仅分配给发起方和接收方其中一方，记为未完全分配；
未分配给任何一方，记为未分配。
进一步地，所述分配本次通信的业务密钥在所述量子密钥中的位置标记包括：
密钥分配网络首先根据所述用户生物识别信息对持有者进行身份认证；
若身份认证通过，从密钥分配管理表中未完全分配的记录中查找是否存在发起方和接收方信息与所述通信事件一致的记录：
若不存在，从所述量子密钥未分配的部分中获取业务密钥，获取所述业务密钥在所述量子密钥中的位置标记发送至所述可穿戴设备，同时在密钥分配管理表中生成新记录，写入所述通信事件相应的发起方、接收方和获取的位置标记信息，并将分配情况标记为未完全分配；
若存在，则将该记录中的位置标记发送至所述可穿戴设备，同时将分配情况标记为已完全分配；
所述移动终端自所述可穿戴设备获取所述位置标记。
进一步地，所述身份认证包括：从绑定关系表中查找是否存在与接收到的用户生物识别信息、移动终端设备信息和/或联系方式信息相一致的记录，若存在，则认证通过，反之，认证不通过。
进一步地，若身份认证未通过，执行以下一种或多种操作：
(1)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，以语音或者其他形式向周围或特定机构报警；
(2)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，实时采集当前所在位置，每隔设定时间间隔发送到密钥分配网络；
(3)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，删除预存的与密钥分配网络之间的共享密钥，以及删除存储的其他敏感信息；
(4)密钥分配网络对所述可穿戴设备注销或暂停其使用权限。
进一步地，所述移动终端获取位置标记的方法为：
所述可穿戴设备通过无线或有线通信的方式将所述位置标记发送至所述移动终端；或，所述可穿戴设备将接收到的位置标记以编码图案形式显示，移动终端扫描所述编码获取所述位置标记。
进一步地，所述编码图案形式为条形码或者二维码。
进一步地，所述量子密钥以连续二进制数据方式存储，所述业务密钥由量子密钥中的多个不连续密钥段组成，所述位置标记包括使用顺序和指针区间；其中，所述使用顺序表示所述业务密钥中 所述多个不连续密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的字节区间。
进一步地，所述量子密钥以多个密钥段的形式存储，所述业务密钥由所述多个密钥段中的若干个组成，所述位置标记包括使用顺序和指针区间；所述使用顺序表示所述业务密钥中所述多个密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的序号。
进一步地，所述通信事件还包括通信类型，用于确定待分配的密钥长度。
进一步地，所述通信事件还包括此次通信业务所需的密钥长度。
进一步地，所述可穿戴设备预先存储与密钥分配网络之间的共享量子密钥，用于与密钥分配网络之间通信的加密和解密。
进一步地，所述移动终端预先存储与其绑定的可穿戴设备之间的共享量子密钥，用于位置标记的加密和解密。
一个或多个实施例提供了一种密钥分配网络，生成并存储量子密钥，所述量子密钥预先存储在待建立通信的移动终端中；
接收发起方移动终端或接收方移动终端经由与其绑定的可穿戴设备发起的密钥分配请求，经由所述可穿戴设备向所述移动终端分配本次通信的业务密钥在所述量子密钥中的位置标记。
进一步地，所述密钥分配请求包括本次通信事件和由所述可穿戴设备采集的用户生物识别信息，所述通信事件包括通信发起方和接收方信息，其中，发起方/接收方信息包括发起方/接收方设备信息和/或联系方式信息。
进一步地，所述密钥分配网络存储绑定关系表和密钥分配管理表；所述绑定关系表记录注册用户的移动终端设备信息和/或联系方式信息，以及该用户的生物识别信息；所述密钥分配管理表记录所述量子密钥各部分的分配情况；所述分配情况包括：
已经分配给发起方和接收方，记为已完全分配；
仅分配给发起方和接收方其中一方，记为未完全分配；
未分配给任何一方，记为未分配。
进一步地，所述分配本次通信的业务密钥在所述量子密钥中的位置标记包括：
密钥分配网络首先根据所述用户生物识别信息对持有者进行身份认证；
若身份认证通过，从密钥分配管理表中未完全分配的记录中查找是否存在发起方和接收方信息与所述通信事件一致的记录：
若不存在，从所述量子密钥未分配的部分中获取业务密钥，获取所述业务密钥在所述量子密钥中的位置标记发送至所述可穿戴设备，同时在密钥分配管理表中生成新记录，写入所述通信事件相应的发起方、接收方和获取的位置标记信息，并将分配情况标记为未完全分配；
若存在，则将该记录中的位置标记发送至所述可穿戴设备，同时将分配情况标记为已完全分配；所述位置标记由所述可穿戴设备提供给所述移动终端。
进一步地，所述身份认证包括：从绑定关系表中查找是否存在与接收到的用户生物识别信息、移动终端设备信息和/或联系方式信息相一致的记录，若存在，则认证通过，反之，认证不通过。
进一步地，所述量子密钥以连续二进制数据方式存储，所述业务密钥由量子密钥中的多个不连续密钥段组成，所述位置标记包括使用顺序和指针区间；其中，所述使用顺序表示所述业务密钥中所述多个不连续密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的字节区间。
进一步地，所述量子密钥以多个密钥段的形式存储，所述业务密钥由所述多个密钥段中的若干个组成，所述位置标记包括使用顺序和指针区间；所述使用顺序表示所述业务密钥中所述多个密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的序号。
进一步地，所述通信事件还包括通信类型，用于确定待分配的业务密钥大小。
进一步地，所述通信事件还包括此次通信业务所需的密钥长度。
进一步地，所述可穿戴设备预先存储与密钥分配网络之间的共享量子密钥，用于与密钥分配网 络之间通信的加密和解密。
一个或多个实施例提供了一种移动终端，与预建立通信的另一移动终端均预先存储同一量子密钥，所述量子密钥由密钥分配网络生成并存储；
所述移动终端向与其绑定的可穿戴设备发出通信事件，并由所述可穿戴设备进一步向密钥分配网络发起密钥分配请求；
获取密钥分配网络分配的本次通信的业务密钥在所述量子密钥中的位置标记；
根据所述位置标记，从所述量子密钥中获取所述业务密钥。
进一步地，所述移动终端经由可穿戴设备向密钥分配网络发起密钥分配请求；并且从所述可穿戴设备获取密钥分配网络分配的所述位置标记。
进一步地，所述从所述可穿戴设备获取密钥分配网络分配的所述位置标记为：
所述可穿戴设备通过无线或有线通信的方式将所述位置标记发送至所述移动终端；或，所述可穿戴设备将接收到的位置标记以编码图案形式显示，移动终端扫描所述编码获取所述位置标记。
进一步地，所述移动终端预先存储与其绑定的可穿戴设备之间的共享量子密钥，用于位置标记的加密和解密。
进一步地，所述通信事件包括通信发起方和接收方信息。
进一步地，所述通信事件还包括通信类型或此次通信业务所需的密钥长度。
一个或多个实施例提供了一种可穿戴设备，与发起方移动终端或接收方移动终端绑定，所述发起方移动终端和接收方移动终端均预先存储同一量子密钥；
所述可穿戴设备接收所述移动终端发送的通信事件；
采集持有者的用户生物识别信息，基于采集的用户生物识别信息与通信事件生成密钥分配请求发送至密钥分配网络；
接收所述密钥分配网络分配的业务密钥在所述量子密钥中的位置标记，并提供给所述移动终端。
进一步地，将位置标记提供给移动终端的方法包括：所述可穿戴设备通过无线或有线通信的方式将所述位置标记发送至所述移动终端；或，所述可穿戴设备将所述位置标记以编码图案形式显示，供所述移动终端扫描。
进一步地，所述编码图案形式为条形码或者二维码。
进一步地，所述可穿戴设备预先存储与其绑定的移动终端之间的共享量子密钥，用于位置标记的加密和解密。
一个或多个实施例提供了一种基于量子密钥的保密通信方法，基于上述分配方法得到的业务密钥，发起方移动终端和接收方移动终端进行保密通信
本申请的有益效果
1、本申请提供了一种向移动终端分配量子密钥的方法，该方法在保密通信之前将同一量子密钥预先存储到移动终端中，密钥分配网络进行分配时，仅分配用于本次通信的业务密钥在该量子密钥中的位置标记，移动终端根据位置标记和预存的量子密钥得到业务密钥。因此，如果传输过程中数据被截获，那么截获的也仅仅是位置标记数据，不能获取真正的业务密钥；如果手机被盗用或者量子密钥被窃取，由于没有位置标记信息，业务密钥无法被破解，因此保证了通信数据的安全。
2、本申请使用具有上传生物识别信息功能的可穿戴设备作为密钥分配网络和实际使用量子密钥进行通信的移动终端之间的隔离器，解决了为合法的移动终端动态分配量子密钥的问题，密钥分配网络认可的是可穿戴设备上传的生物识别信息，保证了分配密钥的移动终端是其持有者本人。
3、本申请使用二维码光学扫描方式来解决量子密钥传输的“最后一公里”，能够有效防范蓝牙等近场无线传输方式的信号泄漏问题。
附图说明
构成本申请的一部分的说明书附图用来提供对本申请的进一步理解，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。
图1为密钥分配的方法流程图；
图2为基于可穿戴设备的密钥分配的流程示意图。
具体实施方式
应该指出，以下详细说明都是示例性的，旨在对本申请提供进一步的说明。除非另有指明，本文使用的所有技术和科学术语具有与本申请所属技术领域的普通技术人员通常理解的相同含义。
需要注意的是，这里所使用的术语仅是为了描述具体实施方式，而非意图限制根据本申请的示例性实施方式。如在这里所使用的，除非上下文另外明确指出，否则单数形式也意图包括复数形式，此外，还应当理解的是，当在本说明书中使用术语“包含”和/或“包括”时，其指明存在特征、步骤、操作、器件、组件和/或它们的组合。
在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
本申请中所称的移动终端包括但不限于手机、平板，能够进行网络连接的电子设备均适用于本申请的移动终端。
本申请中所述的可穿戴设备包括但不限于智能戒指、智能手环、智能手表、智能项链等与人体接触及随身携带的小型设备。可穿戴设备具有生物信息识别功能、无线联网传输数据的功能、密钥存储功能、二维码显示功能。
可穿戴设备入网：即可穿戴设备事先注册到密钥分配网络，并预先存储与密钥分配网络之间的共享量子密钥。其中，注册方式是：可穿戴设备持有者(可以是个人，或可穿戴设备的生产设备商、销售商、使用机构)首先去密钥分配网络的运营机构办理注册入网的相关手续，密钥分配网络的运营机构负责审核用户的入网申请，如审核通过，则为每一台申请入网的可穿戴设备颁发一个由密钥分配网络分配的全网内独一无二的量子身份号，该量子身份号被存储在申请入网的可穿戴设备的永久存储介质中。由于每次传输的密钥或生物信息字节数不多，因此即使采用一次一密，可穿戴设备上在注册时预存的与密钥分配网络间的共享密钥也可以使用很长时间。如果出于提高安全性的考虑，可以定期更换存储在可穿戴设备上的共享密钥。一种方法是密钥分配网络生成新密钥，并用旧的共享密钥加密新的共享密钥，下发到可穿戴设备上。
正式使用可穿戴设备前，使用者要将自己的生物识别信息提供给密钥分配网络，供后者识别验证。所述生物识别信息可以是心跳信息、血压信息、指纹信息、视网膜信息、虹膜信息、声纹信息、静脉信息、面部信息、笔迹签名信息中的一种或几种，通过可穿戴设备采集并提交到密钥分配网络。
实施例一
本实施例公开了一种密钥分配方法，如图1所示，其中，待建立通信的移动终端均预先存储同一量子密钥，所述量子密钥由密钥分配网络生成并存储，生成方式可以采用量子密钥分发(QKD)技术，或由量子随机数发生器生成，所述方法具体包括：
步骤1：待建立通信的发起方移动终端或接收方移动终端经由与其绑定的可穿戴设备向密钥分配网络发起密钥分配请求；
步骤2：密钥分配网络接收所述密钥分配请求，向所述移动终端分配本次通信的业务密钥在所述量子密钥中的位置标记；
步骤3：所述移动终端根据所述位置标记，从所述量子密钥中获取所述业务密钥。
所述步骤1中，密钥分配请求包括本次通信事件，所述通信事件可以包括通信发起方和接收方信息，所述发起方/接收方信息包括但不限于发起方/接收方设备信息(例如移动终端设备ID)，还包括发起方/接收方联系方式信息，例如手机号、社交媒体账号等所有可以用来标识发起方/接收方身份的信息。
所述密钥分配网络管理所述量子密钥各部分的分配情况；所述分配情况包括：已经分配给发起方和接收方，记为已完全分配；仅分配给发起方和接收方其中一方，记为未完全分配；未分配给任何一方，记为未分配。
一个或多个实施例中，所述密钥分配网络通过密钥分配管理表管理量子密钥各部分的分配情况。所述密钥分配管理表包括发起方、接收方、量子密钥位置标记和分配情况等字段，其中，所述分配情况包括：已经分配给发起方和接收方，记为已完全分配；仅分配给发起方和接收方其中一方，记为未完全分配；未分配给任何一方，记为未分配，即分配情况为未分配的记录对应的发起方和接收方字段初始值为空。
所述步骤2具体包括：
密钥分配网络首先从未完全分配的记录中查找是否存在发起方和接收方信息与所述通信事件一致的记录：
若不存在，从所述量子密钥未分配的部分中获取业务密钥，获取所述业务密钥在所述量子密钥中的位置标记分配给所述移动终端，同时将这部分密钥标记为未完全分配；
若存在，则将该部分密钥对应的位置标记发送至所述移动终端，同时将这部分密钥标记为已完全分配。
在一个或多个实施例中，为了提高安全性，确保发起保密通信的是设备持有者本人，提供了一种基于可穿戴设备的密钥分配方法，所述发起方移动终端和接收方移动终端分别经由各自绑定的可穿戴设备向密钥分配网络发起密钥分配请求。具体地，
所述步骤1包括：
发起方移动终端向接收方移动终端发起保密通信请求；
接收方移动终端执行接入操作，将本次通信事件发送至接收方可穿戴设备；所述接收方可穿戴设备采集接收方用户的生物识别信息，基于所述生物识别信息与通信事件生成密钥分配请求发送至密钥分配网络；
发起方移动终端接收到接收方移动终端已接入的消息后，将本次通信事件发送至发起方可穿戴设备；所述发起方可穿戴设备采集发起方用户的生物识别信息，基于所述生物识别信息与通信事件生成密钥分配请求发送至密钥分配网络。
密钥分配网络存储绑定关系表和密钥分配管理表。所述绑定关系表记录注册用户的移动终端设备信息和/或联系方式信息，以及该用户的生物识别信息。所述密钥分配管理表，用于管理所述量子密钥各部分的分配情况。
一个或多个实施例中，所述密钥分配管理表包括发起方、接收方、量子密钥位置标记和分配情况等字段，其中，所述分配情况包括：已经分配给发起方和接收方，记为已完全分配；仅分配给发起方和接收方其中一方，记为未完全分配；未分配给任何一方，记为未分配，即分配情况为未分配的记录对应的发起方和接收方字段初始值为空。
所述密钥分配网络接收所述可穿戴设备发送的用户生物识别信息和通信事件，向所述可穿戴设备分配所述位置标记。所述步骤2包括：
步骤2.1：密钥分配网络首先根据所述用户生物识别信息和所述绑定关系表对持有者进行身份认证；若身份认证通过，执行步骤2.2；若身份认证没通过，执行步骤2.3；
步骤2.2：从密钥分配管理表中未完全分配的记录中查找是否存在发起方和接收方信息与所述通信事件一致的记录：
若不存在，从所述量子密钥未分配的部分中获取业务密钥，获取所述业务密钥在所述量子密钥中的位置标记发送至所述可穿戴设备，同时在密钥分配管理表中生成新记录，写入所述通信事件相应的发起方、接收方和获取的位置标记信息，并将分配情况标记为未完全分配；
若存在，则将该记录中的位置标记发送至所述可穿戴设备，同时将分配情况标记为已完全分配。
步骤2.3：执行以下一种或多种操作：
(1)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，以语音或者其他形式向周围或特定机构报警；
(2)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，实时采集当前所在位置，每隔设定时间间隔发送到密钥分配网络；
(3)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，删除预存的与密钥分配网络之间的共享密钥，以及删除存储的其他敏感信息；
(4)密钥分配网络对所述可穿戴设备注销或暂停其使用权限。
在一个或多个实施例中，所述身份认证是指从绑定关系表中查找是否存在与接收到的用户生物识别信息、移动终端设备信息和/或联系方式信息相一致的记录，若存在，则认证通过，反之，认证不通过。
在一个或多个实施例中，所述通信事件中还包括通信类型(视频、语音或图文)。根据通信类型确定获取的密钥大小。当然，也可以直接指定所需的密钥长度，来代替这里的通信类型。
在一个或多个实施例中，所述量子密钥是一段连续的二进制数据，所述业务密钥由量子密钥中的多个不连续密钥段组成。此时，所述位置标记包括使用顺序和指针区间，其中，所述使用顺序表示所述业务密钥中所述多个不连续密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的字节区间。
作为一个示例，所述位置标记如下：
1：600-1000
2：344-576
3：2504-2720
4：1032-2008
其中，冒号前的1、2、3、4为“使用顺序”，“600-1000”则为“指针区间”。
用K表示由连续的二进制数据构成的整块量子密钥，所述位置标记所指代的业务密钥使用K的第600字节到第1000字节作为第一段，使用K的第344字节到第576字节作为第二段，使用K的第2504字节到第2720字节作为第三段，使用K的第1032字节到第2008字节作为第四段，按照顺序拼接后即为本次通信的业务密钥。
在一个或多个实施例中，所述量子密钥以多个密钥段的形式存储，所述业务密钥由所述多个密钥段中的若干个组成。此时，所述位置标记包括使用顺序和指针区间，其中，所述使用顺序表示所述业务密钥中所述多个密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的序号。
作为一个示例，所述位置标记如下：
1:96
2:107
3:5
4:34
……
n:128
指针区间的数字表示编号为96、107、5、34……128的密钥小块。本次通信使用密钥时，按照“第96块+第107块+第5块+第34块+……+第128块”的顺序来用。
或者可以直接把“使用顺序”和“指针区间”合二为一，格式变为：
96、107、5、34……128，使用时按照排列顺序依次提取相应的密钥小块使用即可得到本次通信的业务密钥。
所述步骤3中，所述可穿戴设备接收到密钥位置标记后，生成二维码，提供给所述移动终端； 所述移动终端根据所述密钥的位置标记，从预先存储的量子密钥中得到用于本次通信的业务密钥，所述业务密钥用于发起方移动终端和接收方移动终端之间的通信。
在一个或多个实施例中，所述发起方移动终端和接收方移动终端绑定的可穿戴设备均事先注册到密钥分配网络，并预先存储与密钥分配网络之间的第一共享量子密钥和第二共享量子密钥。第一和第二共享量子密钥分别用于发起方移动终端和接收方移动终端绑定的可穿戴设备与密钥分配网络信息通信之间的加密和解密。
在一个或多个实施例中，移动终端和可穿戴设备之间采用无线或有线方式连接；处于更严格的安全考虑，为了避免移动终端和可穿戴设备之间的明文传输，还可以将移动终端和对应的可穿戴设备都注册到密钥分配网络中，移动终端和对应的可穿戴设备均预先存储二者之间的共享量子密钥。可穿戴设备将位置标记基于所述共享量子密钥进行加密，将加密后的位置标记以二维码的形式显示；移动终端扫描所述二维码，解密得到位置标记。这样，即使可穿戴设备上的二维码图形被其他摄像设备、拍照设备拍下，攻击者也无法通过非法扫描来获取位置标记。
为了更清楚地阐述本申请，下面通过一实例描述本实施例，如图2所示：
①移动终端T1向移动终端T2发起保密通信请求，T2收到请求后，如果同意通信，则返回同意信号。
②移动终端T1收到同意信号后，将此次通信的对端移动终端T2的身份，以及自己的主叫身份，以及此次通信的类型或所需密钥长度告知自己绑定的可穿戴设备W1。
③可穿戴设备W1采集主叫方用户的生物识别信息，与T1的身份和T2的身份，以及此次通信的通信类型或所需密钥长度信息一起，使用与密钥分配网络Q间的共享密钥加密，发送到密钥分配网络Q。
④密钥分配网络Q收到W1发送的信息后将其解密，在自身存储的生物识别信息库中查找W1发送的生物识别信息，做比较验证，如果找到则进入下一步。
密钥分配网络Q维护着一个对量子密钥K进行管理的数据库或表，其中存储有量子密钥K的使用情况。包括哪些部分是已经使用过的(包括已经分配给主被叫双方的密钥，称为“已完全分配”，还包括暂时只分配给了主被叫双方中一方的密钥，称为“未完全分配”)，哪些部分是没有使用过的(称为“未分配”)。如果上一步验证通过，密钥分配网络则在当前存储的所有“未完全分配”密钥申请记录中查找“T1主叫的身份，T2被叫的身份”，如果找不到，则在尚未使用过的密钥部分中，根据此次通信的类型推断出所需的密钥长度(或直接根据收到的所需密钥长度)，划出若干段密钥供此次通信使用，将这些密钥在整个K中的位置标记(例如，密钥指针)用Q与W1之间的共享密钥加密之后，发送给W1。
密钥分配网络Q向W1下发密钥指针后，将此次密钥申请(T1主叫的身份，T2被叫的身份)记录在案并标记为“未完全分配”，因为目前只收到了主叫端的申请，密钥分配网络要根据这个申请记录去匹配被叫端的申请。
⑤可穿戴设备W1收到密钥指针并解密后，将其中包含的信息转换为二维码，显示在可穿戴设备W1的屏幕上。移动终端T1扫描所述二维码，获得此次通信所需的密钥指针。
⑥移动终端T2在回复同意之后，也向自己所绑定的W2告知此次通信类型或所需密钥长度、自己的被叫身份、以及对端移动终端T1的身份。
⑦可穿戴设备W2采集被叫方用户的生物识别信息，与T2的身份和T1的身份、此次通信的通信类型或所需密钥长度信息一起，使用与密钥分配网络Q间的共享密钥加密，发送到密钥分配网络Q。
⑧密钥分配网络Q收到W2发送的信息后将其解密，在自身存储的生物识别信息库中查找W2发送的生物识别信息，做比较验证，如果找到则进入下一步。
密钥分配网络Q在当前所有的“未完全分配”密钥申请记录中查找“T1主叫的身份，T2被叫 的身份”，找到之后，将之前发送给W1的密钥指针使用与W2的共享密钥加密后，发送给W2。发送完成后，将此次“T1主叫的身份，T2被叫的身份”的密钥申请记录标记为“已完全分配”。
⑨可穿戴设备W2收到密钥指针并解密后，将其中包含的信息转换为二维码，显示在可穿戴设备W2的屏幕上。移动终端T2扫描所述二维码，获得此次通信所需的密钥指针。
移动终端T1和T2根据收到的密钥指针，去各自存储的量子密钥K中拼接出此次通信所需的业务密钥，使用该业务密钥进行保密通信。
由于网络情况的不同，密钥分配网络可能先接到主叫端的密钥分配申请，也可能先接到被叫端的密钥分配申请。密钥分配网络对先接到的一方进行优先分配，即，当先接到主叫端密钥分配申请时，先执行步骤③-④，再执行步骤⑦-⑧；当先接到被叫方密钥分配申请时，先执行步骤⑦-⑧，再执行步骤③-④。
在一个或多个实施例中，所述密钥分配方法能够扩展到两个以上移动终端进行保密通信的情景中。
本实施例还提供了一种基于量子密钥的保密通信方法，基于上述分配方法得到的业务密钥，发起方移动终端和接收方移动终端进行保密通信。
这样，即使是移动终端被盗，存储在移动终端中的密钥被窃取，但是由于不知道之前密钥究竟是如何使用的，因此被盗之前通信数据仍然是安全的。同理，如果只是密钥指针被别人窃听，由于传输的不是密钥本身而只是一堆位置指针，通信数据仍然无法被破解。
实施例二
基于实施例一的密钥分配方法，本实施例提供了一种密钥分配系统，包括：
密钥分配网络，生成并存储量子密钥；以及
接收发起方移动终端或接收方移动终端发起的经由与其绑定的可穿戴设备处理的密钥分配请求，向所述移动终端分配本次通信的业务密钥在所述量子密钥中的位置标记；
待建立通信的发起方移动终端和接收方移动终端，均预先存储所述量子密钥；以及
分别向密钥分配网络发起密钥分配请求；接收密钥分配网络发送的位置标记，根据所述位置标记从所述量子密钥中获取所述业务密钥。
所述密钥分配请求包括本次通信事件，所述通信事件包括通信发起方和接收方信息；所述发起方/接收方信息包括但不限于发起方/接收方设备信息(例如移动终端设备ID)，还可以包括发起方/接收方联系方式信息(例如手机号、社交媒体账号等)，用来标识发起方/接收方身份的信息。
在一个或多个实施例中，所述密钥分配网络管理所述量子密钥各部分的分配情况；所述分配情况包括：
已经分配给发起方和接收方，记为已完全分配；
仅分配给发起方和接收方其中一方，记为未完全分配；
未分配给任何一方，记为未分配。
一个或多个实施例中，所述密钥分配网络通过密钥分配管理表管理量子密钥各部分的分配情况。所述密钥分配管理表包括发起方、接收方、量子密钥位置标记和分配情况等字段，其中，所述分配情况包括：已经分配给发起方和接收方，记为已完全分配；仅分配给发起方和接收方其中一方，记为未完全分配；未分配给任何一方，记为未分配，即分配情况为未分配的记录对应的发起方和接收方字段初始值为空。
所述分配本次通信的业务密钥在所述量子密钥中的位置标记包括：
密钥分配网络首先从未完全分配的记录中查找是否存在发起方和接收方信息与所述通信事件一致的记录：
若不存在，从所述量子密钥未分配的部分中获取业务密钥，获取所述业务密钥在所述量子密钥中的位置标记分配给所述移动终端，同时将这部分密钥标记为未完全分配；
若存在，则将该部分密钥对应的位置标记发送至所述移动终端，同时将这部分密钥标记为已完全分配。
在一个或多个实施例中，所述发起方移动终端和接收方移动终端分别经由各自绑定的可穿戴设备向密钥分配网络发起密钥分配请求。具体地，
待建立通信的发起方移动终端或接收方移动终端将通信事件发送至与其绑定的可穿戴设备，所述通信事件包括通信发起方和接收方信息；
所述可穿戴设备采集持有者的用户生物识别信息，基于采集的用户生物识别信息与通信事件生成密钥分配请求发送至密钥分配网络。
密钥分配网络存储绑定关系表和密钥分配管理表。所述绑定关系表记录注册用户的移动终端设备信息和/或联系方式信息，以及该用户的生物识别信息。所述密钥分配管理表，用于管理所述量子密钥各部分的分配情况。
一个或多个实施例中，所述密钥分配管理表包括发起方、接收方、量子密钥位置标记和分配情况等字段，其中，所述分配情况包括：已经分配给发起方和接收方，记为已完全分配；仅分配给发起方和接收方其中一方，记为未完全分配；未分配给任何一方，记为未分配，即分配情况为未分配的记录对应的发起方和接收方字段初始值为空。
所述分配本次通信的业务密钥在所述量子密钥中的位置标记包括：
密钥分配网络首先根据所述用户生物识别信息和所述绑定关系表对持有者进行身份认证；
若身份认证通过，从密钥分配管理表中未完全分配的记录中查找是否存在发起方和接收方信息与所述通信事件一致的记录：
若不存在，从所述量子密钥未分配的部分中获取业务密钥，获取所述业务密钥在所述量子密钥中的位置标记发送至所述可穿戴设备，在密钥分配管理表中生成新记录，写入所述通信事件相应的发起方、接收方和获取的位置标记信息，并将分配情况标记为未完全分配；
若存在，则将该记录中的位置标记发送至所述可穿戴设备，同时将分配情况标记为已完全分配；
所述移动终端自所述可穿戴设备获取所述位置标记。
所述移动终端获取位置标记的方法为：
所述可穿戴设备将接收到的位置标记以编码图案形式显示，移动终端扫描所述编码获取所述位置标记。
若身份认证未通过，执行以下一种或多种操作：
(1)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，以语音或者其他形式向周围或特定机构报警；
(2)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，实时采集当前所在位置，每隔设定时间间隔发送到密钥分配网络；
(3)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，删除预存的与密钥分配网络之间的共享密钥，以及删除存储的其他敏感信息；
(4)密钥分配网络对所述可穿戴设备注销或暂停其使用权限。
在一个或多个实施例中，所述身份认证是指从绑定关系表中查找是否存在与接收到的用户生物识别信息、移动终端设备信息和/或联系方式信息相一致的记录，若存在，则认证通过，反之，认证不通过。
在一个或多个实施例中，所述量子密钥以连续二进制数据方式存储，所述业务密钥由量子密钥中的多个不连续密钥段组成。所述位置标记包括使用顺序和指针区间；其中，所述使用顺序表示所述业务密钥中所述多个不连续密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的字节区间。
在一个或多个实施例中，所述量子密钥以多个密钥段的形式存储，所述业务密钥由所述多个密 钥段中的若干个组成。所述位置标记包括使用顺序和指针区间；所述使用顺序表示所述业务密钥中所述多个密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的序号。
在一个或多个实施例中，所述通信事件还包括通信类型，用于确定待分配的密钥长度。也可以在通信事件中直接指定所需的密钥长度。
在一个或多个实施例中，所述可穿戴设备预先存储与密钥分配网络之间的共享量子密钥，用于与密钥分配网络之间通信的加密和解密。
在一个或多个实施例中，所述移动终端预先存储与其绑定的可穿戴设备之间的共享量子密钥，用于位置标记的加密和解密。
实施例三
本实施例提供了一种密钥分配网络，
生成并存储量子密钥，所述量子密钥预先存储在待建立通信的移动终端中；
接收发起方移动终端或接收方移动终端发起的密钥分配请求，向所述移动终端分配本次通信的业务密钥在所述量子密钥中的位置标记。
在一个或多个实施例中，所述密钥分配请求包括本次通信事件，所述通信事件包括通信发起方和接收方信息。
所述密钥分配网络管理所述量子密钥各部分的分配情况；所述分配情况包括：已经分配给发起方和接收方，记为已完全分配；仅分配给发起方和接收方其中一方，记为未完全分配；未分配给任何一方，记为未分配。
所述分配本次通信的业务密钥在所述量子密钥中的位置标记包括：
对于所述移动终端发起的密钥分配请求，密钥分配网络首先从未完全分配的记录中查找是否存在发起方和接收方信息与所述通信事件一致的记录：
若不存在，从所述量子密钥未分配的部分中获取业务密钥，获取所述业务密钥在所述量子密钥中的位置标记分配给所述移动终端，同时将这部分密钥标记为未完全分配；
若存在，则将该部分密钥对应的位置标记发送至所述移动终端，同时将这部分密钥标记为已完全分配。
在一个或多个实施例中，所述密钥分配请求还包括用户生物识别信息。待建立通信的发起方移动终端或接收方移动终端将通信事件发送至与其绑定的可穿戴设备，所述通信事件包括通信发起方和接收方信息；所述可穿戴设备采集持有者的用户生物识别信息，基于采集的用户生物识别信息与通信事件生成密钥分配请求发送至密钥分配网络。
密钥分配网络管理注册用户的移动终端设备信息和/或联系方式信息，以及用户生物识别信息的绑定关系，以及密钥分配情况。所述分配情况包括：已经分配给发起方和接收方，记为已完全分配；仅分配给发起方和接收方其中一方，记为未完全分配；未分配给任何一方，记为未分配。
所述分配本次通信的业务密钥在所述量子密钥中的位置标记包括：
密钥分配网络首先根据所述用户生物识别信息对持有者进行身份认证；
若身份认证通过，从未完全分配的记录中查找是否存在发起方和接收方信息与所述通信事件一致的记录：
若不存在，从所述量子密钥未分配的部分中获取业务密钥，获取所述业务密钥在所述量子密钥中的位置标记发送至所述可穿戴设备，同时将这部分密钥标记为未完全分配；
若存在，则将该部分密钥对应的位置标记发送至所述可穿戴设备，同时将这部分密钥标记为已完全分配；
所述移动终端自所述可穿戴设备获取所述位置标记。
在一个或多个实施例中，所述身份认证是指从绑定关系表中查找是否存在与接收到的用户生物识别信息、移动终端设备信息和/或联系方式信息相一致的记录，若存在，则认证通过，反之，认 证不通过。
在一个或多个实施例中，所述量子密钥以连续二进制数据方式存储，所述业务密钥由量子密钥中的多个不连续密钥段组成。所述位置标记包括使用顺序和指针区间；其中，所述使用顺序表示所述业务密钥中所述多个不连续密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的字节区间。
在一个或多个实施例中，所述量子密钥以多个密钥段的形式存储，所述业务密钥由所述多个密钥段中的若干个组成。所述位置标记包括使用顺序和指针区间；所述使用顺序表示所述业务密钥中所述多个密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的序号。
在一个或多个实施例中，所述通信事件还包括通信类型，密钥分配网络根据所述通信类型确定待分配的业务密钥长度。也可以在通信事件中直接指定所需的业务密钥长度。
在一个或多个实施例中，所述可穿戴设备预先存储与密钥分配网络之间的共享量子密钥，用于与密钥分配网络之间通信的加密和解密。
实施例四
本实施例提供了一种移动终端，与预建立通信的另一移动终端均预先存储同一量子密钥，所述量子密钥由密钥分配网络生成并存储。
所述移动终端向与其绑定的可穿戴设备发出通信事件，并由所述可穿戴设备进一步向密钥分配网络发起密钥分配请求；
接收密钥分配网络分配的本次通信的业务密钥在所述量子密钥中的位置标记；
根据所述位置标记，从所述量子密钥中获取所述业务密钥。
在一个或多个实施例中，所述移动终端经由可穿戴设备向密钥分配网络发起密钥分配请求；并且从所述可穿戴设备获取密钥分配网络分配的所述位置标记。
具体地，所述移动终端将通信事件发送至与其绑定的可穿戴设备，所述通信事件包括通信发起方和接收方信息；所述可穿戴设备采集持有者的用户生物识别信息，基于采集的用户生物识别信息与通信事件生成密钥分配请求发送至密钥分配网络；以及
自所述可穿戴设备获取所述位置标记，所述位置标记是密钥分配网络向所述可穿戴设备分配的。
一个或多个实施例中，所述通信事件中还包括通信类型(视频、语音或图文)，或者此次通信业务所需的密钥长度。
一个或多个实施例中，所述移动终端和可穿戴设备之间采用无线或有线方式连接，在该连接方式下，所述移动终端从可穿戴设备获取位置标记的方法为：所述可穿戴设备通过无线或有线通信的方式将所述位置标记发送至所述移动终端。
此外，所述可穿戴设备还可基于位置标记生成编码(二维码、条码等)并显示，供移动终端扫描和获取。
出于更严格的安全考虑，为了避免移动终端和可穿戴设备之间的明文传输，还可以将移动终端和对应的可穿戴设备都注册到密钥分配网络中，移动终端和对应的可穿戴设备均预先存储二者之间的共享量子密钥，用于位置标记的加密和解密，即，可穿戴设备将所述位置标记采用该共享量子密钥进行加密后传输或者加密后以二维码的方式提供给所述移动终端，移动终端获取并采用该共享量子密钥解密得到该位置标记。
实施例五
本实施例提供了一种可穿戴设备，与发起方移动终端或接收方移动终端绑定，所述发起方移动终端和接收方移动终端均预先存储同一量子密钥，所述量子密钥由密钥分配网络生成并存储；
接收所述移动终端发送的通信事件，所述通信事件包括通信发起方和接收方信息；
采集持有者的用户生物识别信息，基于采集的用户生物识别信息与通信事件生成密钥分配请求 发送至密钥分配网络；
接收所述密钥分配网络分配的业务密钥在所述量子密钥中的位置标记，并提供给所述移动终端；
其中，所述可穿戴设备将所述位置标记以编码图案形式(二维码、条码等)显示，提供给移动终端。所述移动终端通过光学扫描即可获得所述位置标记。
一个或多个实施例中，所述移动终端和可穿戴设备之间采用无线或有线方式连接，在该连接方式下，所述移动终端从可穿戴设备获取位置标记的方法为：所述可穿戴设备通过无线或有线通信的方式将所述位置标记发送至所述移动终端。
出于更严格的安全考虑，为了避免移动终端和可穿戴设备之间的明文传输，还可以将移动终端和对应的可穿戴设备都注册到密钥分配网络中，移动终端和对应的可穿戴设备均预先存储二者之间的共享量子密钥，用于位置标记的加密和解密，即，可穿戴设备将所述位置标记采用该共享量子密钥进行加密后传输或者加密后以二维码的方式提供给所述移动终端，移动终端获取并采用该共享量子密钥解密得到该位置标记。
本申请的有益效果
1、本申请提供了一种向移动终端分配量子密钥的方法，该方法在保密通信之前将同一量子密钥预先存储到移动终端中，密钥分配网络进行分配时，仅分配用于本次通信的业务密钥在该量子密钥中的位置标记，移动终端根据位置标记和预存的量子密钥得到业务密钥。因此，如果传输过程中数据被截获，那么截获的也仅仅是位置标记数据，不能获取真正的业务密钥；如果手机被盗用或者量子密钥被窃取，由于没有位置标记信息，业务密钥无法被破解，因此保证了通信数据的安全。
2、本申请使用具有上传生物识别信息功能的可穿戴设备作为密钥分配网络和实际使用量子密钥进行通信的移动终端之间的隔离器，解决了为合法的移动终端动态分配量子密钥的问题，密钥分配网络认可的是可穿戴设备上传的生物识别信息，保证了分配密钥的移动终端是其持有者本人。
3、本申请使用二维码光学扫描方式来解决量子密钥传输的“最后一公里”，能够有效防范蓝牙等近场无线传输方式的信号泄漏问题。
以上所述仅为本申请的优选实施例而已，并不用于限制本申请，对于本领域的技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。例如，本申请虽然针对的是量子密钥的密钥分配问题，但通过某些常规手段的等效变换，使其适用于其他类型密钥的密钥分配，也应包含在本申请的保护范围之内。
上述虽然结合附图对本申请的具体实施方式进行了描述，但并非对本申请保护范围的限制，所属领域技术人员应该明白，在本申请的技术方案的基础上，本领域技术人员不需要付出创造性劳动即可做出的各种修改或变形仍在本申请的保护范围之内。

Claims (49)

  1. 一种密钥分配方法，其特征在于，待建立通信的移动终端均预先存储同一量子密钥，所述量子密钥由密钥分配网络生成并存储，所述方法包括：
    待建立通信的发起方移动终端或接收方移动终端经由与其绑定的可穿戴设备向密钥分配网络发起密钥分配请求；
    密钥分配网络接收所述密钥分配请求，经由所述可穿戴设备向所述移动终端分配本次通信的业务密钥在所述量子密钥中的位置标记；
    所述移动终端根据所述位置标记，从所述量子密钥中获取所述业务密钥。
  2. 如权利要求1所述的密钥分配方法，其特征在于，所述发起密钥分配请求具体包括：
    待建立通信的发起方移动终端或接收方移动终端将通信事件发送至与其绑定的可穿戴设备，所述通信事件包括通信发起方和接收方信息，其中，发起方/接收方信息包括发起方/接收方设备信息和/或联系方式信息；
    所述可穿戴设备采集持有者的用户生物识别信息，基于采集的用户生物识别信息与通信事件生成密钥分配请求发送至密钥分配网络。
  3. 如权利要求2所述的密钥分配方法，其特征在于，所述密钥分配网络存储绑定关系表和密钥分配管理表；所述绑定关系表记录注册用户的移动终端设备信息和/或联系方式信息，以及该用户的生物识别信息；所述密钥分配管理表记录所述量子密钥各部分的分配情况；所述分配情况包括：
    已经分配给发起方和接收方，记为已完全分配；
    仅分配给发起方和接收方其中一方，记为未完全分配；
    未分配给任何一方，记为未分配。
  4. 如权利要求3所述的密钥分配方法，其特征在于，所述分配本次通信的业务密钥在所述量子密钥中的位置标记包括：
    密钥分配网络首先根据所述用户生物识别信息和绑定关系表对持有者进行身份认证；
    若身份认证通过，从密钥分配管理表中未完全分配的记录中查找是否存在发起方和接收方信息与所述通信事件一致的记录：
    若不存在，从所述量子密钥未分配的部分中获取业务密钥，获取所述业务密钥在所述量子密钥中的位置标记发送至所述可穿戴设备，同时在密钥分配管理表中生成新记录，写入所述通信事件相应的发起方、接收方和获取的位置标记信息，并将分配情况标记为未完全分配；
    若存在，则将该记录中的位置标记发送至所述可穿戴设备，同时将分配情况标记为已完全分配；
    所述移动终端自所述可穿戴设备获取所述位置标记。
  5. 如权利要求4所述的密钥分配方法，其特征在于，所述身份认证包括：从绑定关系表中查找是否存在与接收到的用户生物识别信息、移动终端设备信息和/或联系方式信息相一致的记录，若存在，则认证通过，反之，认证不通过。
  6. 如权利要求4或5所述的密钥分配方法，其特征在于，若身份认证未通过，执行以下一种或多种操作：
    (1)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，以语音或者其他形式向周围或特定机构报警；
    (2)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后， 实时采集当前所在位置，每隔设定时间间隔发送到密钥分配网络；
    (3)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，删除预存的与密钥分配网络之间的共享密钥，以及删除存储的其他敏感信息；
    (4)密钥分配网络对所述可穿戴设备注销或暂停其使用权限。
  7. 如权利要求4所述的密钥分配方法，其特征在于，所述移动终端获取位置标记的方法为：
    所述可穿戴设备通过无线或有线通信的方式将所述位置标记发送至所述移动终端；或，所述可穿戴设备将接收到的位置标记以编码图案形式显示，移动终端扫描所述编码获取所述位置标记。
  8. 如权利要求7所述的密钥分配方法，其特征在于，所述编码图案形式为条形码或者二维码。
  9. 如权利要求1所述的密钥分配方法，其特征在于，所述量子密钥以连续二进制数据方式存储，所述业务密钥由量子密钥中的多个不连续密钥段组成，所述位置标记包括使用顺序和指针区间；其中，所述使用顺序表示所述业务密钥中所述多个不连续密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的字节区间。
  10. 如权利要求1所述的密钥分配方法，其特征在于，所述量子密钥以多个密钥段的形式存储，所述业务密钥由所述多个密钥段中的若干个组成，所述位置标记包括使用顺序和指针区间；所述使用顺序表示所述业务密钥中所述多个密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的序号。
  11. 如权利要求2所述的密钥分配方法，其特征在于，所述通信事件还包括通信类型，用于确定待分配的密钥长度。
  12. 如权利要求2所述的密钥分配方法，其特征在于，所述通信事件还包括此次通信业务所需的密钥长度。
  13. 如权利要求1所述的密钥分配方法，其特征在于，所述可穿戴设备预先存储与密钥分配网络之间的共享量子密钥，用于与密钥分配网络之间通信的加密和解密。
  14. 如权利要求1所述的基于可穿戴设备的密钥分配方法，其特征在于，所述移动终端预先存储与其绑定的可穿戴设备之间的共享量子密钥，用于位置标记的加密和解密。
  15. 一种密钥分配系统，其特征在于，包括：
    密钥分配网络，生成并存储量子密钥；以及
    接收发起方移动终端或接收方移动终端发起的经由与其绑定的可穿戴设备处理的密钥分配请求，经由所述可穿戴设备向所述移动终端分配本次通信的业务密钥在所述量子密钥中的位置标记；
    待建立通信的发起方移动终端和接收方移动终端，均预先存储所述量子密钥；以及
    分别向密钥分配网络发起密钥分配请求；接收密钥分配网络分配的位置标记，根据所述位置标记从所述量子密钥中获取所述业务密钥。
  16. 如权利要求15所述的密钥分配系统，其特征在于，所述移动终端向密钥分配网络发起密钥分配请求包括：
    待建立通信的发起方移动终端或接收方移动终端将通信事件发送至与其绑定的可穿戴设备，所述通信事件包括通信发起方和接收方信息，其中，发起方/接收方信息包括发起方/接收方设备信息和/或联系方式信息；
    所述可穿戴设备采集持有者的用户生物识别信息，基于采集的用户生物识别信息与通信事件生成密钥分配请求发送至密钥分配网络。
  17. 如权利要求16所述的密钥分配系统，其特征在于，所述密钥分配网络存储绑定关系表和密钥分配管理表；所述绑定关系表记录注册用户的移动终端设备信息和/或联系方式信息，以及该用户的生物识别信息；所述密钥分配管理表记录所述量子密钥各部分的分配情况；所述分配情况包括：
    已经分配给发起方和接收方，记为已完全分配；
    仅分配给发起方和接收方其中一方，记为未完全分配；
    未分配给任何一方，记为未分配。
  18. 如权利要求17所述的密钥分配系统，其特征在于，所述分配本次通信的业务密钥在所述量子密钥中的位置标记包括：
    密钥分配网络首先根据所述用户生物识别信息对持有者进行身份认证；
    若身份认证通过，从密钥分配管理表中未完全分配的记录中查找是否存在发起方和接收方信息与所述通信事件一致的记录：
    若不存在，从所述量子密钥未分配的部分中获取业务密钥，获取所述业务密钥在所述量子密钥中的位置标记发送至所述可穿戴设备，同时在密钥分配管理表中生成新记录，写入所述通信事件相应的发起方、接收方和获取的位置标记信息，并将分配情况标记为未完全分配；
    若存在，则将该记录中的位置标记发送至所述可穿戴设备，同时将分配情况标记为已完全分配；
    所述移动终端自所述可穿戴设备获取所述位置标记。
  19. 如权利要求18所述的密钥分配系统，其特征在于，所述身份认证包括：从绑定关系表中查找是否存在与接收到的用户生物识别信息、移动终端设备信息和/或联系方式信息相一致的记录，若存在，则认证通过，反之，认证不通过。
  20. 如权利要求18或19所述的密钥分配系统，其特征在于，若身份认证未通过，执行以下一种或多种操作：
    (1)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，以语音或者其他形式向周围或特定机构报警；
    (2)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，实时采集当前所在位置，每隔设定时间间隔发送到密钥分配网络；
    (3)密钥分配网络向所述可穿戴设备发送报警信号，所述可穿戴设备接收到报警信号后，删除预存的与密钥分配网络之间的共享密钥，以及删除存储的其他敏感信息；
    (4)密钥分配网络对所述可穿戴设备注销或暂停其使用权限。
  21. 如权利要求18所述的密钥分配系统，其特征在于，所述移动终端获取位置标记的方法为：
    所述可穿戴设备通过无线或有线通信的方式将所述位置标记发送至所述移动终端；或，所述可穿戴设备将接收到的位置标记以编码图案形式显示，移动终端扫描所述编码获取所述位置标记。
  22. 如权利要求21所述的密钥分配系统，其特征在于，所述编码图案形式为条形码或者二维码。
  23. 如权利要求15所述的密钥分配系统，其特征在于，所述量子密钥以连续二进制数据方式存储，所述业务密钥由量子密钥中的多个不连续密钥段组成，所述位置标记包括使用顺序和指针区间；其中，所述使用顺序表示所述业务密钥中所述多个不连续密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的字节区间。
  24. 如权利要求15所述的密钥分配系统，其特征在于，所述量子密钥以多个密钥段的形式存储，所述业务密钥由所述多个密钥段中的若干个组成，所述位置标记包括使用顺序和指针区间；所述使用顺序表示所述业务密钥中所述多个密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的序号。
  25. 如权利要求16所述的密钥分配系统，其特征在于，所述通信事件还包括通信类型，用于确定待分配的密钥长度。
  26. 如权利要求16所述的密钥分配系统，其特征在于，所述通信事件还包括此次通信业务所需的密钥长度。
  27. 如权利要求15所述的密钥分配系统，其特征在于，所述可穿戴设备预先存储与密钥分配网络之间的共享量子密钥，用于与密钥分配网络之间通信的加密和解密。
  28. 如权利要求15所述的密钥分配系统，其特征在于，所述移动终端预先存储与其绑定的可穿戴设备之间的共享量子密钥，用于位置标记的加密和解密。
  29. 一种密钥分配网络，其特征在于，生成并存储量子密钥，所述量子密钥预先存储在待建立通信的移动终端中；
    接收发起方移动终端或接收方移动终端经由与其绑定的可穿戴设备发起的密钥分配请求，经由所述可穿戴设备向所述移动终端分配本次通信的业务密钥在所述量子密钥中的位置标记。
  30. 如权利要求29所述的一种密钥分配网络，其特征在于，所述密钥分配请求包括本次通信事件和由所述可穿戴设备采集的用户生物识别信息，所述通信事件包括通信发起方和接收方信息，其中，发起方/接收方信息包括发起方/接收方设备信息和/或联系方式信息。
  31. 如权利要求30所述的一种密钥分配网络，其特征在于，
    所述密钥分配网络存储绑定关系表和密钥分配管理表；所述绑定关系表记录注册用户的移动终端设备信息和/或联系方式信息，以及该用户的生物识别信息；所述密钥分配管理表记录所述量子密钥各部分的分配情况；所述分配情况包括：
    已经分配给发起方和接收方，记为已完全分配；
    仅分配给发起方和接收方其中一方，记为未完全分配；
    未分配给任何一方，记为未分配。
  32. 如权利要求31所述的一种密钥分配网络，其特征在于，所述分配本次通信的业务密钥在所述量子密钥中的位置标记包括：
    密钥分配网络首先根据所述用户生物识别信息对持有者进行身份认证；
    若身份认证通过，从密钥分配管理表中未完全分配的记录中查找是否存在发起方和接收方信息与所述通信事件一致的记录：
    若不存在，从所述量子密钥未分配的部分中获取业务密钥，获取所述业务密钥在所述量子密钥中的位置标记发送至所述可穿戴设备，同时在密钥分配管理表中生成新记录，写入所述通信事件相应的发起方、接收方和获取的位置标记信息，并将分配情况标记为未完全分配；
    若存在，则将该记录中的位置标记发送至所述可穿戴设备，同时将分配情况标记为已完全 分配；所述位置标记由所述可穿戴设备提供给所述移动终端。
  33. 如权利要求32所述的一种密钥分配网络，其特征在于，所述身份认证包括：从绑定关系表中查找是否存在与接收到的用户生物识别信息、移动终端设备信息和/或联系方式信息相一致的记录，若存在，则认证通过，反之，认证不通过。
  34. 如权利要求29所述的一种密钥分配网络，其特征在于，所述量子密钥以连续二进制数据方式存储，所述业务密钥由量子密钥中的多个不连续密钥段组成，所述位置标记包括使用顺序和指针区间；其中，所述使用顺序表示所述业务密钥中所述多个不连续密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的字节区间。
  35. 如权利要求29所述的一种密钥分配网络，其特征在于，所述量子密钥以多个密钥段的形式存储，所述业务密钥由所述多个密钥段中的若干个组成，所述位置标记包括使用顺序和指针区间；所述使用顺序表示所述业务密钥中所述多个密钥段的顺序，所述指针区间表示每个密钥段在所述量子密钥中的序号。
  36. 如权利要求30所述的一种密钥分配网络，其特征在于，所述通信事件还包括通信类型，用于确定待分配的业务密钥大小。
  37. 如权利要求30所述的一种密钥分配网络，其特征在于，所述通信事件还包括此次通信业务所需的密钥长度。
  38. 如权利要求29所述的一种密钥分配网络，其特征在于，所述可穿戴设备预先存储与密钥分配网络之间的共享量子密钥，用于与密钥分配网络之间通信的加密和解密。
  39. 一种移动终端，其特征在于，与预建立通信的另一移动终端均预先存储同一量子密钥，所述量子密钥由密钥分配网络生成并存储；
    所述移动终端向与其绑定的可穿戴设备发出通信事件，并由所述可穿戴设备进一步向密钥分配网络发起密钥分配请求；
    获取密钥分配网络分配的本次通信的业务密钥在所述量子密钥中的位置标记；
    根据所述位置标记，从所述量子密钥中获取所述业务密钥。
  40. 如权利要求39所述的一种移动终端，其特征在于，所述移动终端经由可穿戴设备向密钥分配网络发起密钥分配请求；并且从所述可穿戴设备获取密钥分配网络分配的所述位置标记。
  41. 如权利要求40所述的一种移动终端，其特征在于，所述从所述可穿戴设备获取密钥分配网络分配的所述位置标记为：
    所述可穿戴设备通过无线或有线通信的方式将所述位置标记发送至所述移动终端；或，所述可穿戴设备将接收到的位置标记以编码图案形式显示，移动终端扫描所述编码获取所述位置标记。
  42. 如权利要求40或41所述的一种移动终端，其特征在于，所述移动终端预先存储与其绑定的可穿戴设备之间的共享量子密钥，用于位置标记的加密和解密。
  43. 如权利要求39所述的一种移动终端，其特征在于，所述通信事件包括通信发起方和接收方信息。
  44. 如权利要求39所述的一种移动终端，其特征在于，所述通信事件还包括通信类型或此次通信业务所需的密钥长度。
  45. 一种可穿戴设备，其特征在于，与发起方移动终端或接收方移动终端绑定，所述发起方移动终端和接收方移动终端均预先存储同一量子密钥；
    所述可穿戴设备接收所述移动终端发送的通信事件；
    采集持有者的用户生物识别信息，基于采集的用户生物识别信息与通信事件生成密钥分配请求发送至密钥分配网络；
    接收所述密钥分配网络分配的业务密钥在所述量子密钥中的位置标记，并提供给所述移动终端。
  46. 如权利要求45所述的一种可穿戴设备，其特征在于，将位置标记提供给移动终端的方法包括：所述可穿戴设备通过无线或有线通信的方式将所述位置标记发送至所述移动终端；或，所述可穿戴设备将所述位置标记以编码图案形式显示，供所述移动终端扫描。
  47. 如权利要求46所述的一种可穿戴设备，其特征在于，所述编码图案形式为条形码或者二维码。
  48. 如权利要求45所述的一种可穿戴设备，其特征在于，所述可穿戴设备预先存储与其绑定的移动终端之间的共享量子密钥，用于位置标记的加密和解密。
  49. 一种基于量子密钥的保密通信方法，其特征在于，基于如权利要求1-14任一项分配方法得到的业务密钥，发起方移动终端和接收方移动终端进行保密通信。
PCT/CN2020/113815 2019-09-09 2020-09-07 一种密钥分配方法、系统、移动终端和可穿戴设备 WO2021047477A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910865926.XA CN112468287B (zh) 2019-09-09 2019-09-09 一种密钥分配方法、系统、移动终端和可穿戴设备
CN201910865926.X 2019-09-09

Publications (1)

Publication Number Publication Date
WO2021047477A1 true WO2021047477A1 (zh) 2021-03-18

Family

ID=74807576

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/113815 WO2021047477A1 (zh) 2019-09-09 2020-09-07 一种密钥分配方法、系统、移动终端和可穿戴设备

Country Status (2)

Country Link
CN (1) CN112468287B (zh)
WO (1) WO2021047477A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113315694A (zh) * 2021-05-27 2021-08-27 维沃移动通信有限公司 即时通讯方法、装置和电子设备
CN113904949A (zh) * 2021-11-11 2022-01-07 宁波奥克斯电气股份有限公司 配网绑定方法及装置、智能设备及存储介质
CN115358748A (zh) * 2022-08-26 2022-11-18 中国银行股份有限公司 基于量子加密的支付保护方法、装置、设备和存储介质
CN116112276A (zh) * 2023-02-01 2023-05-12 中国工商银行股份有限公司 业务信息传输方法、请求端、业务端和系统

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117792795B (zh) * 2024-02-23 2024-06-21 河北赛克普泰计算机咨询服务有限公司 一种数据加密方法及实时网络安全监控系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104243144A (zh) * 2013-06-08 2014-12-24 安徽量子通信技术有限公司 一种基于Android智能移动终端的通信密钥分配方法
CN106878015A (zh) * 2017-04-14 2017-06-20 江苏亨通问天量子信息研究院有限公司 加密卫星通信系统及方法
CN107959566A (zh) * 2016-10-14 2018-04-24 阿里巴巴集团控股有限公司 量子数据密钥协商系统及量子数据密钥协商方法
CN109561056A (zh) * 2017-09-27 2019-04-02 山东量子科学技术研究院有限公司 一种保密通信方法、系统、移动终端和可穿戴设备
US20190103962A1 (en) * 2017-10-04 2019-04-04 The Boeing Company Recipient-driven data encryption

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4124194B2 (ja) * 2004-11-01 2008-07-23 日本電気株式会社 共有情報生成方法およびシステム
KR101314210B1 (ko) * 2009-11-24 2013-10-02 한국전자통신연구원 사용자 인증 양자 키 분배 방법
CN106972922B (zh) * 2013-06-08 2019-06-14 科大国盾量子技术股份有限公司 一种基于量子密钥分配网络的移动保密通信方法
JP6115387B2 (ja) * 2013-07-31 2017-04-19 沖電気工業株式会社 量子鍵配送用受信器及び単一光子検出器の使用方法
CN107086908B (zh) * 2016-02-15 2021-07-06 阿里巴巴集团控股有限公司 一种量子密钥分发方法及装置
CN106817694A (zh) * 2017-04-14 2017-06-09 江苏亨通问天量子信息研究院有限公司 量子无线保密通信系统及移动终端
CN107040378A (zh) * 2017-06-01 2017-08-11 浙江九州量子信息技术股份有限公司 一种基于多用户远程通信的密钥分配系统与方法
WO2018224138A1 (en) * 2017-06-07 2018-12-13 Huawei Technologies Co., Ltd. Quantum key distribution transmitter, system and method
CN109842486A (zh) * 2017-11-27 2019-06-04 全球能源互联网研究院有限公司 一种四态调制连续变量量子密钥分发数据协调方法及系统
CN109525390B (zh) * 2018-11-20 2021-08-24 江苏亨通问天量子信息研究院有限公司 用于终端设备保密通信的量子密钥无线分发方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104243144A (zh) * 2013-06-08 2014-12-24 安徽量子通信技术有限公司 一种基于Android智能移动终端的通信密钥分配方法
CN107959566A (zh) * 2016-10-14 2018-04-24 阿里巴巴集团控股有限公司 量子数据密钥协商系统及量子数据密钥协商方法
CN106878015A (zh) * 2017-04-14 2017-06-20 江苏亨通问天量子信息研究院有限公司 加密卫星通信系统及方法
CN109561056A (zh) * 2017-09-27 2019-04-02 山东量子科学技术研究院有限公司 一种保密通信方法、系统、移动终端和可穿戴设备
US20190103962A1 (en) * 2017-10-04 2019-04-04 The Boeing Company Recipient-driven data encryption

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113315694A (zh) * 2021-05-27 2021-08-27 维沃移动通信有限公司 即时通讯方法、装置和电子设备
CN113315694B (zh) * 2021-05-27 2023-11-10 维沃移动通信有限公司 即时通讯方法、装置和电子设备
CN113904949A (zh) * 2021-11-11 2022-01-07 宁波奥克斯电气股份有限公司 配网绑定方法及装置、智能设备及存储介质
CN113904949B (zh) * 2021-11-11 2024-02-09 宁波奥克斯电气股份有限公司 配网绑定方法及装置、智能设备及存储介质
CN115358748A (zh) * 2022-08-26 2022-11-18 中国银行股份有限公司 基于量子加密的支付保护方法、装置、设备和存储介质
CN116112276A (zh) * 2023-02-01 2023-05-12 中国工商银行股份有限公司 业务信息传输方法、请求端、业务端和系统

Also Published As

Publication number Publication date
CN112468287A (zh) 2021-03-09
CN112468287B (zh) 2022-02-22

Similar Documents

Publication Publication Date Title
WO2021047477A1 (zh) 一种密钥分配方法、系统、移动终端和可穿戴设备
CN104967511B (zh) 加密数据的处理方法及装置
RU2415470C2 (ru) Способ создания безопасного кода, способы его использования и программируемое устройство для осуществления способа
US9165149B2 (en) Use of a mobile telecommunication device as an electronic health insurance card
US20070288752A1 (en) Secure removable memory element for mobile electronic device
JP2009510644A (ja) 安全な認証のための方法及び構成
US20150304321A1 (en) An image management system and an image management method based on fingerprint authentication
JP2006209697A (ja) 個人認証システム、この個人認証システムに使用される認証装置、および個人認証方法
CN112673600A (zh) 基于区块链的手机终端以及IoT设备之间的多重安全认证系统以及方法
CN104468937A (zh) 移动终端的数据加、解密方法、装置及保护系统
CN107333263B (zh) 一种改进型的sim卡以及移动通信身份识别方法和系统
CN108959883B (zh) 一种基于快速响应矩阵码的网络身份实名认证方法
JP6397046B2 (ja) アドレス帳保護方法、装置及び通信システム
WO2021047476A1 (zh) 一种密钥分配方法、系统和可穿戴设备
KR101305901B1 (ko) 인증 방법 및 시스템
JP2002297551A (ja) 認証システム
CN108989331B (zh) 数据存储设备的使用鉴权方法及其设备和存储介质
TW200421811A (en) Multiple pairing control method
CN113779534A (zh) 一种基于数字身份的个人信息提供方法和业务平台
JP5485452B1 (ja) 鍵管理システム、鍵管理方法、ユーザ端末、鍵生成管理装置、及びプログラム
CN110474766B (zh) 随机密码生成方法、装置以及身份验证方法
US20150156173A1 (en) Communication system utilizing fingerprint information and use thereof
WO2017008423A1 (zh) 一种通信方法及设备、存储介质
WO2019216847A2 (en) A sim-based data security system
CN108337385A (zh) 一种利用安全设备建立通话连接的系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20862377

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20862377

Country of ref document: EP

Kind code of ref document: A1