WO2024012529A1

WO2024012529A1 - Key management method and apparatus, and device and storage medium

Info

Publication number: WO2024012529A1
Application number: PCT/CN2023/107243
Authority: WO
Inventors: 田野
Original assignee: 中国移动通信有限公司研究院; 中国移动通信集团有限公司
Priority date: 2022-07-15
Filing date: 2023-07-13
Publication date: 2024-01-18
Also published as: CN117439734A

Abstract

Provided in the present disclosure are a key management method and apparatus, and a device and a storage medium. The method comprises: a first device receiving a first message, which is sent by a second device; executing an operation related to the first message, and obtaining at least one of the following: a first key, a second key, and a third key; and sending at least one of the first key, the second key and the third key to the second device.

Description

Key management method, device, equipment and storage medium

Cross-references to related applications

This disclosure claims priority to Chinese Patent Application No. 202210837670.3 filed in China on July 15, 2022, the entire content of which is incorporated herein by reference.

Technical field

The present disclosure relates to the field of communication technology, and in particular, to a key management method, device, equipment and storage medium.

Background technique

Key technology is a commonly used technical means in the current communication field to protect the security of transmission content, including symmetric keys, asymmetric keys, etc. It is understandable that keys are time-sensitive and require constant updating to ensure the freshness of keys and the security of communications. However, the current key update method is relatively complicated, so how to update the key in a timely, effective and simple manner is an urgent problem that needs to be solved.

Contents of the invention

In order to solve related technical problems, embodiments of the present disclosure provide a key management method, device, equipment and storage medium.

The technical solution of the embodiment of the present disclosure is implemented as follows:

The embodiment of the present disclosure provides a key management method, applied to the first device, including:

receiving the first message sent by the second device;

Perform an operation related to the first message, and obtain at least one of the following: a first key, a second key, and a third key;

At least one of the first key, the second key, and the third key is sent to the second device.

The embodiment of the present disclosure also provides a key management method, applied to the second device, including:

a first message sent to the first device;

Receive at least one of the first key, the second key and the third key sent by the first device.

Embodiments of the present disclosure also provide a key management method, applied to a third device, including:

Receive at least one of the first key, the second key and the third key sent by the first device and/or the second device.

An embodiment of the present disclosure also provides a key management device, including:

A first receiving unit configured to receive the first message sent by the second device;

An execution unit, configured to perform operations related to the first message and obtain at least one of the following: a first key, a second key, and a third key;

The first sending unit is used to send at least one of the first key, the second key and the third key to the second device.

The second sending unit is used to send the first message to the first device;

The second receiving unit is configured to receive at least one of the first key, the second key and the third key sent by the first device and/or the second device.

An embodiment of the present disclosure also provides a first device, including: a first processor and a first communication interface; wherein,

The first communication interface is used to receive the first message sent by the second device;

The first processor is configured to perform operations related to the first message and obtain at least one of the following: a first key, a second key, and a third key;

The first communication interface is also used to send at least one of the first key, the second key and the third key to the second device.

An embodiment of the present disclosure also provides a second device, including: a second processor and a second communication interface mouth; among them,

The second communication interface is used to send a first message to the first device; and to receive at least one of the first key, the second key and the third key sent by the first device.

Embodiments of the present disclosure also provide a third device, including: a third processor and a third communication interface; wherein,

The third communication interface is used to receive at least one of the first key, the second key and the third key sent by the first device and/or the second device.

An embodiment of the present disclosure also provides a first device, including: a first processor and a first memory for storing a computer program capable of running on the processor,

Wherein, the first processor is configured to execute the steps of any method on the first device side when running the computer program.

An embodiment of the present disclosure also provides a second device, including: a second processor and a second memory for storing a computer program capable of running on the processor,

Wherein, the second processor is configured to execute the steps of any method on the second device side when running the computer program.

Embodiments of the present disclosure also provide a third device, including: a third processor and a third memory for storing a computer program capable of running on the processor,

Wherein, the third processor is configured to execute the steps of any method on the third device side when running the computer program.

Embodiments of the present disclosure also provide a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any method on the first device side are implemented, or any method on the second device side is implemented. or implement any of the above methods on the third device side.

In the key management method, device, equipment and storage medium provided by the embodiments of the present disclosure, the first device receives the first message sent by the second device; performs operations related to the first message, and obtains at least one of the following: The first key, the second key and the third key; sending at least one of the first key, the second key and the third key to the second device. Based on the above solution, the first device performs While performing operations related to the first message, a key is generated for the second device. This eliminates the need for the second device to increase the storage space of the secure medium and can promptly replenish new keys, ensuring that the second device secures the security of the second device in a low-cost and efficient manner. Always provision sufficient keys.

Description of drawings

Figure 1 is a schematic flow chart of a key management method according to an embodiment of the present disclosure;

Figure 2 is a schematic flow chart of another key management method according to an embodiment of the present disclosure;

Figure 3 is a schematic flow chart of a third key management method according to an embodiment of the present disclosure;

Figure 4 is a schematic diagram of the interaction flow of a key management method according to an application embodiment of the present disclosure;

Figure 5 is a schematic diagram of the interaction flow of another key management method according to an application embodiment of the present disclosure;

Figure 6 is a schematic structural diagram of a key management device according to an embodiment of the present disclosure;

Figure 7 is a schematic structural diagram of another key management device according to an embodiment of the present disclosure;

Figure 8 is a schematic structural diagram of a third key management device according to an embodiment of the present disclosure;

Figure 9 is a schematic structural diagram of the first equipment according to the embodiment of the present disclosure;

Figure 10 is a schematic structural diagram of the second equipment according to the embodiment of the present disclosure;

Figure 11 is a schematic structural diagram of a third device according to an embodiment of the present disclosure.

Detailed ways

The current key update method is relatively complex: generally speaking, each communication device stores a certain amount of keys for secure communication with the peer or for secure storage of local information. Since keys are time-sensitive and a certain amount of keys pre-stored by the device will be gradually consumed with use, keys need to be updated regularly or irregularly. However, the key update method in the related art requires setting up an additional key update process, and the key update process itself also requires consuming pre-stored keys, thus increasing the cost of device key update and the overhead of information interaction.

For ordinary keys, the cost of key update technology in related technologies is relatively high. For quantum keys, this problem is particularly prominent.

Quantum key refers to: a quantum key generated by a quantum random number generator based on the basic principles of quantum mechanics, or through the Quantum Key Distribution (QKD) network The quantum keys generated by network negotiation are inherently random and non-replicable. Therefore, quantum keys are more secure than keys generated by traditional methods such as physical noise sources and pseudo-randomness, and are difficult to be cracked by attackers. Compared with traditional keys, the use of quantum keys in secure communication systems can ensure the security of the keys and improve the overall security level of the system.

In a quantum secure communication system, multiple devices participating in the communication need to obtain a consistent quantum key through negotiation, which is used to encrypt and protect the data information transmitted between users to prevent attackers from illegally eavesdropping, tampering, and replaying the information content. and other attacks, causing information leakage. Since terminal devices generally do not have the ability to generate quantum keys, quantum key communications are generated by the quantum key management center and then distributed to terminal devices for use. Usually, the quantum key management center uses offline filling to place the quantum symmetric key in the secure medium and/or secure storage space of the terminal device. The terminal can use the preset quantum symmetric key to securely access the quantum key. key management center and achieve secure communication. For example, device identity authentication, message encryption, integrity protection, source authentication, etc. are implemented based on preset quantum symmetric keys.

In order to ensure information security when the terminal communicates with the quantum key management center, the preset quantum symmetric key is one-time and will be destroyed after use. Therefore, each secure communication will consume a preset quantum symmetric key until the preset quantum symmetric key on the terminal side is exhausted. In order to meet users' long-term or frequent quantum secure communication application requirements, terminal equipment needs to be able to store a large number of quantum symmetric keys in advance. However, the storage space of the local security medium of the terminal device is limited, and the number of quantum symmetric keys that can be accommodated in one filling is limited. To expand the storage space of the security medium of the terminal device and achieve large-scale storage of quantum symmetric keys will lead to terminal costs. An order of magnitude increase. If the number of preset quantum symmetric keys on the terminal device is limited, users will be forced to frequently go to the quantum key service site to refill the quantum symmetric key offline for the terminal, which reduces the user's application experience.

Based on this, in various embodiments of the present disclosure, the first device receives the first message sent by the second device; performs operations related to the first message, and obtains at least one of the following: a first key, a second key and a third key; sending at least one of the first key, the second key, and the third key to the second device. Based on the above solution, while performing the first message-related operation, the first device The second device generates the key, thereby eliminating the need for the second device to increase the storage space of the secure medium and simultaneously replenishing new keys in a timely manner. This low-cost and efficient method ensures that the second device is always preset with sufficient keys.

The present disclosure will be described in further detail below with reference to the accompanying drawings and embodiments.

An embodiment of the present disclosure provides a key management method, applied to a first device. Referring to Figure 1, the method includes:

Step 101: Receive the first message sent by the second device.

Here, the first device may be a key management center or a key manager (Key Manager, KM) of the QKD network. In actual application, the first device can be a unified security service platform, key management system or key management center, etc., used to provide unified key management services for a variety of different businesses; it can also be a key management device for a specific business. Key management platform, key management system, key management center or key management server. For example, the first device can be a key management platform for long-term evolution voice bearer (Voice over Long-Term Evolution, VoLTE) encrypted call service. It is specially designed to provide key management services for VoLTE encrypted call services, and can be used as a key management platform for encrypted message services, specifically for short messages, fifth generation mobile communication technology (5th Generation Mobile Communication Technology, 5G) messages, and integrated communications. (Rich Communication Suite, RCS) message, instant messaging and other message communication services provide key management services.

In actual application, the first device may also be called a password security service center, password service center, security service center or security center, etc.

It should be noted that the embodiments of the present disclosure are not only applicable to scenarios where traditional networks and/or systems use ordinary keys, but can also be applied to scenarios where quantum keys are used. It is easy to understand that when the embodiment of the present disclosure is applied to a quantum key scenario, "key" can be further understood as "quantum key", "cryptographic security service center" can be further understood as "quantum cryptographic security service center", " "Cryptographic Service Center" can be further understood as "Quantum Crypto Service Center", "Security Service Center" can be further understood as "Quantum Security Service Center", "Security Center" can be further understood as "Quantum Security Center", and so on, which will not be repeated. .

The second device may be a terminal device or other devices. For example, encryption gateway, encryption Routers, encryption switches, etc. It can be a mobile device or a fixed device, a wired device or a wireless device.

The first message may be a request message during the communication interaction process, such as a query request, an access request, an update request, a deletion request, an access request, an authentication request, an authentication request, a service request, a key request, etc. The first message may also be It is notification, response, response and other messages during communication interaction. The above are only examples, and the embodiment of the present disclosure does not place any limitation on the form of the first message.

Step 102: Perform an operation related to the first message, and obtain at least one of the following: a first key, a second key, and a third key.

Step 103: Send at least one of the first key, the second key and the third key to the second device.

Here, the first device performs an operation related to the first message, which can be understood as: when the first message is a request message, the first device performs an operation corresponding to the corresponding request. For example, if the first message is used to request query information 1, then the first device performs a query operation for information 1; for another example, if the first message is used to request access authentication, then the first device performs authentication of the access end, including the first A device authenticates the access terminal, or requests other devices to authenticate the access terminal; when the first message is a notification message, the first device performs an operation corresponding to the corresponding notification. For example, the first device stores the information content informed by the corresponding notification, or does not perform an operation, or sends a confirmation response about the notification to the peer device, etc. When the first message is a response message or an answer message, the first device performs a corresponding response or an operation corresponding to the response. For example, the first device sends message 1 to the second device, and the second device replies with a response or response about message 1. The first device processes the response or response, such as determining whether the content of the response or response is correct, and for example, storing the response. Or the information content of the response, for example, no processing of the response or response, etc.

In step 102, the execution time sequence between "performing the operation related to the first message" and "obtaining at least one of the following: the first key, the second key, and the third key" is not limited. , but it should be understood that after receiving the first message, the first device needs to perform operations related to the first message and also obtain the corresponding key.

Here, the first key may be generated by the first device, or may be obtained by the first device from other devices, or the first device may obtain an intermediate key or a random number from other devices, and then provide the first key to the first key. A device is processed to obtain the first key.

In practical applications, the first key can be a quantum key provided by the QKD network, or a quantum random number or quantum key generated by a quantum random number generator, or an ordinary key generated by a physical noise source, or It is an ordinary key generated by a pseudo-random number generator, etc. The first key may be a symmetric key or an asymmetric key. When the first key is a symmetric key, in addition to sending the first key to the second device, the first device also needs to store the first key locally to achieve key sharing. When the first key is an asymmetric key, the first key may be a public key and/or a private key.

In one embodiment, the first key is used for secure communication between the first device and the second device, or for secure storage of local information of the second device.

Here, the secure communication between the first device and the second device can be understood as directly using the first key to securely protect the information exchanged between the first device and the second device, or directly using the first key to securely protect the information exchanged between the first device and the second device. The identity authentication between one device and the second device can also be understood as using the first key to further derive other keys, which are used to securely protect the information interacted between the first device and the second device, or for the first device Perform identity authentication with the second device. Among them, security protection includes encryption and/or integrity protection, etc.

The secure storage of the local information of the second device can be understood as the secure storage of the local information of the second device, such as encryption and/or integrity, by directly using the first key or other keys derived from the first key. Protection etc.

In one embodiment, sending the first key to the second device includes:

The first key that is securely protected by the fourth key is sent to the second device.

The fourth key is a shared key between the first device and the second device.

Here, the fourth key can be understood as a shared key between the first device and the second device, such as a key for security protection of the first message.

In one embodiment, obtaining the first key includes:

Obtain the first key and the corresponding first identifier;

Send the first key to the second device, including:

Send the first key and/or the corresponding first identification to the second device.

In one embodiment, the method further includes:

Store the first key and/or the corresponding first identification.

In one embodiment, the second key is used for secure communication between the first device and the third device, or for secure storage of local information of the third device.

Here, the secure communication between the first device and the third device can be understood as directly using the second key to securely protect the information exchanged between the first device and the third device, or directly using the second key to securely protect the third device. The identity authentication between the first device and the third device can also be understood as using the second key to further derive other keys, which are used to securely protect the information interacted between the first device and the third device, or for the first device Perform identity authentication on both sides with the third device. Among them, security protection includes encryption and/or integrity protection, etc.

In actual application, the second key can be a quantum key provided by the QKD network, or a quantum random number or quantum key generated by a quantum random number generator, or an ordinary key generated by a physical noise source, or It is an ordinary key generated by a pseudo-random number generator, etc. The second key may be a symmetric key or an asymmetric key. When the second key is a symmetric key, in addition to sending the second key to the third device, the first device also needs to store the second key locally to achieve key sharing. When the second key is an asymmetric key, the second key may be a public key and/or a private key.

The third device may be a terminal device or other devices. For example, encryption gateway, encryption router, encryption switch, etc. It can be a mobile device or a fixed device, a wired device or a wireless device.

The secure storage of the local information of the third device can be understood as the secure storage of the local information of the third device by directly using the second key or other keys derived from the second key, such as encryption and/or integrity. Protection etc.

In one embodiment, sending the second key to the second device includes:

The second key that is securely protected using the fifth key is sent to the second device.

The fifth key is a shared key between the first device and the third device.

Here, the fifth key can be understood as the key shared by the first device and the third device. Therefore, even if the second device obtains the second key, since the second key is encrypted by the fifth key, The second device cannot learn the fifth key, thus ensuring the security of the transmission of the second key.

In one embodiment, the method further includes:

Send the second key to the third device.

In one embodiment, sending the second key to the third device includes:

The second key that is securely protected using the fifth key is sent to the third device.

The fifth key is a shared key between the first device and the third device.

In one embodiment, obtaining the second key includes:

Obtain the second key and the corresponding second identification;

Send the second key to the second device and/or the third device, including:

Send the second key and/or the corresponding second identification to the second device and/or the third device.

In one embodiment, the method further includes:

Store the second key and/or the corresponding second identification.

In one embodiment, the third key is used for secure communication between the second device and the third device.

Here, the secure communication between the second device and the third device can be understood as directly using the third key to securely protect the information exchanged between the second device and the third device, or directly using the third key to securely protect the information exchanged between the second device and the third device. The identity authentication between the second device and the third device can also be understood as using the third key to further derive other keys, which are used to securely protect the information interacted between the second device and the third device, or for the second device Perform identity authentication on both sides with the third device. Among them, security protection includes encryption and/or integrity protection, etc.

In one embodiment, sending the third key to the second device includes:

The third key that is securely protected by using the fourth key and the fifth key is sent to the second device.

The fourth key is a shared key between the first device and the second device, and the fifth key is a shared key between the first device and the third device.

Here, the fourth key and the fifth key are used to securely protect the third key, that is, the fourth key is used to securely protect the third key to obtain the first information, and the fifth key is used to securely protect the third key. Securely protect the third key to obtain the second information, and send both the first and second information to the second device. After receiving it, the second device can use the shared fourth key to decrypt the first information and obtain the second information. Three keys. At the same time, the second device transmits the second information to the third device. After receiving the second information, the third device can decrypt the second information using the shared fifth key, thereby obtaining the third key.

In one embodiment, the method further includes:

Send the third key to the third device.

In one embodiment, sending the third key to the third device includes:

The third key that is securely protected by the fifth key is sent to the third device.

The fifth key is a shared key between the first device and the third device.

In one embodiment, obtaining the third key includes:

Obtain the third key and the corresponding third identification;

Send the third key to the second device and/or the third device, including:

Send the third key and/or the corresponding third identification to the second device and/or the third device.

In practical applications, the third key can be a quantum key provided by the QKD network, or a quantum random number or quantum key generated by a quantum random number generator, or an ordinary key generated by a physical noise source, or It is an ordinary key generated by a pseudo-random number generator, etc. The third key may be a symmetric key or an asymmetric key.

In one embodiment, the method further includes:

Store the third key and/or the corresponding third identification.

In one embodiment, the message sent by the first device carries a timestamp.

Here, a timestamp is carried in the message sent by the first device, and the timestamp is used to prevent message replay attacks. Furthermore, a timestamp is carried in the quantum key management related message to resist attackers. Replay attacks on quantum keys.

It should be noted that here, the message sent by the first device includes, but is not limited to, the first device is used to send at least one of the first key, the second key and the third key to the second device and/or Messages from the third device. The messages sent by the first device may include: all or part of the messages sent by the first device for interaction between the first device and the second device, the third device and/or other devices.

Correspondingly, the embodiment of the present disclosure also provides a key management method, applied to the second device. Referring to Figure 2, the method includes:

Step 201: Send the first message to the first device.

Step 202: Receive at least one of the first key, the second key and the third key sent by the first device.

In one embodiment, receiving the first key sent by the first device includes:

Receive the first key sent by the first device and protected by the fourth key; wherein the fourth key is the shared key between the first device and the second device;

The fourth key is used to decrypt the securely protected first key.

In one embodiment, receiving the first key sent by the first device includes:

Receive and store the first key and/or the corresponding first identification.

In one embodiment, receiving the second key sent by the first device includes:

Receive the second key sent by the first device and protected by using the fifth key; wherein the fifth key is the shared key between the first device and the third device;

In one embodiment, the method further includes:

Send the second key and/or the corresponding second identification to the third device.

In one embodiment, receiving the third key sent by the first device includes:

Receive the third key sent by the first device and protected by using the fourth key and the fifth key respectively;

Using the fourth key to decrypt the third key protected by the fourth key;

Send the third key protected by the fifth key to the third device; wherein,

In one embodiment, receiving the third key includes:

Receive and store the third key and/or the corresponding third identification.

In one embodiment, the message sent by the second device carries a timestamp.

Here, a timestamp is carried in the message sent by the second device, which is used to prevent message replay attacks. Furthermore, a timestamp is carried in the message related to quantum key management, which can resist the attacker's replay of the quantum key. Let attack.

It should be noted that here, the message sent by the second device includes but is not limited to the first message sent by the second device to the first device and/or the third device. The messages sent by the second device may include: all or part of the messages sent by the second device for interaction between the second device and the first device, the third device and/or other devices.

Correspondingly, embodiments of the present disclosure also provide a key management method, applied to a third device. Referring to Figure 3, the method includes:

Step 301: Receive at least one of the second key and the third key sent by the first device and/or the second device.

Here, the second key and the third key may be received by the third device from the same device, for example, both are received from the first device or both are received from the second device, or they may be received by the third device from different devices. For example, the second key is received from the first device, and the third key is received from the second device.

In one embodiment, receiving the second key sent by the first device and/or the second device includes:

Receive the second key sent by the first device and/or the second device and protected by using the fifth key.

The fifth key is a shared key between the first device and the third device.

In one embodiment, receiving the second key includes:

Receive and store the second key and/or the corresponding second identification.

In one embodiment, receiving the third key sent by the second device includes:

Receive the third key sent by the second device and securely protected by the fifth key;

The third key secured by the fifth key is decrypted using the fifth key.

Wherein, the fifth key is a shared key between the first device and the third device.

In one embodiment, receiving the third key sent by the first device includes:

Receive the third key sent by the first device and securely protected by the fifth key;

The third key secured by the fifth key is decrypted using the fifth key.

In one embodiment, receiving the third key includes:

Receive and store the third key and/or the corresponding third identification.

In one embodiment, the method further includes:

Send a second message to the first device; wherein,

The second message is used to indicate the result of returning the key reception.

In one embodiment, the message sent by the third device carries a timestamp.

Here, a timestamp is carried in the message sent by the third device, which is used to prevent message replay attacks. Furthermore, a timestamp is carried in the message related to quantum key management to resist the attacker's replay of the quantum key. Let attack.

It should be noted that here, the messages sent by the third device include but are not limited to: all messages sent by the third device for interaction between the third device and the first device, the second device and/or other devices. message or part of a message.

In conjunction with the above embodiment, the first device generates a key for the second device while performing operations related to the first message. That is to say, after receiving the first message, the first device considers that the first device is conducting the first communication with the second device. Message-related communication will consume the key, or the first device finds that the second device has not updated the key within a period of time after receiving the first message, and then supplements the new key for the second device while performing the first message-related operation. key, thus ensuring that the second device is always preset with sufficient keys at low cost and efficiently without the need for the second device to increase the storage space of the security medium.

In addition, in any scenario where the terminal uses a locally stored (quantum) symmetric key/(quantum) asymmetric key to interact securely with the (quantum) key management center, the solutions of the disclosed embodiments can be used to implement ordinary or quantum Handy complement of symmetric/asymmetric keys. ((Quantum) here means a scenario where quantum is possible. For example, (quantum) symmetric key can be understood as: ordinary symmetric key or quantum symmetric key. The subsequent brackets have the same meaning and will not be repeated.) . For example, when the terminal accesses the (quantum) key management center and performs identity authentication and establishes a secure channel based on the (quantum) symmetric key, when the terminal accesses the (quantum) key management center, based on the (quantum) symmetric key In the process of number binding, business authentication/authorization, (quantum) key update, (quantum) key destruction, and business status change in the established secure channel, the solutions of the disclosed embodiments can be used to implement (quantum) symmetric encryption. A handy addition to the key. In practical applications, when the (quantum) symmetric key shared with the terminal is used and consumed, for example, when the terminal performs identity authentication when accessing the (quantum) key center, there is a gap between the terminal and the (quantum) key center. In the case of security protection of interactive messages, the (quantum) key center not only processes the relevant messages of the terminal, but also generates new (quantum) symmetric keys and uses the old (quantum) symmetric keys. The new (quantum) symmetric key is securely protected, and then the securely protected new (quantum) symmetric key is provided to the terminal. The terminal uses the old (quantum) symmetric key to decrypt and/or integrity protection check the new (quantum) symmetric key received, and after the decryption and/or integrity protection check is successful, the new ( Quantum) symmetric key Secure storage, thereby promptly replenishing the terminal's local (quantum) symmetric key. Optionally, the terminal can return a message to the (quantum) key center to confirm the result of the new (quantum) symmetric key reception (such as successful reception or reception failure); or it may not return any message to indicate that the (quantum) symmetric key has been successfully received. Key reception failed. In this way, the (quantum) key center can destroy the old (quantum) symmetric key when the terminal receives it successfully, and the new (quantum) symmetric key is stored in the (quantum) key center and the terminal's local key pool in for later use when necessary.

In order to further explain the embodiments of the present disclosure, the following application examples are given. It should be noted that quantum symmetric keys are used for illustration below. It is easy to understand that the following examples are Methods can also be applied to ordinary symmetric keys, ordinary asymmetric keys, or quantum asymmetric keys.

Figure 4 shows a schematic diagram of the interaction process of terminal A initiating the number binding service provided by the application embodiment of the present disclosure. Referring to Figure 4, the interaction process includes:

Step 1: When it is necessary to interact with the quantum key management center and bind the mobile phone number to the password card and/or password resources, terminal A sends a service request message to the quantum key management center.

Among them, in order to ensure the security of message transmission, terminal A selects a valid quantum symmetric key _KA from the local preconfigured quantum symmetric key pool, and uses _KA or _a symmetric key _KA derived based on KA ', encrypt and/or integrity protect all or part of the information content of the service request message.

The service request message carries the identity of terminal A, the service type bound to the mobile phone number, and a Hash-based Message Authentication Code (HMAC) used to protect the integrity of the message. Optionally, It carries _KA 's key identification K _ID _A, timestamp or sequence number and other information to prevent message replay.

Step 2: The quantum key management center queries based on the terminal identification and key identification, obtains the quantum symmetric key _KA shared with terminal A through pre-configuration, and uses _KA or the symmetric key derived based on _KA Key K _A ' is used to perform integrity protection verification and decryption of the service request message. Afterwards, the number binding service requested by terminal A is processed.

At the same time, the quantum key management center generates a new quantum symmetric key K _A _new for the called terminal A, and correspondingly distributes a new key identification K _ID _A_new. Among them, the quantum symmetric key is generated by a quantum random number generator.

Step 3: The quantum key management center returns a service response message to terminal A, which carries business-related information, the newly generated quantum symmetric key K _A _new, and optionally also carries the new key identification K _ID _A_new and a timestamp. or serial number and other information. All or part of the information content of the service response message is encrypted and/or integrity protected using _KA or the symmetric key _KA ' derived based on _KA .

Step 4: Terminal A uses _KA or the symmetric key _KA ' derived based on _KA to verify and decrypt the service response message to complete business-related processing. At the same time, obtain the new quantum symmetric key K _A _new generated by the quantum key management center. Optionally, terminal A also obtains the corresponding key identification K _ID _A_new, and will obtain the new quantum symmetric key K _A _new and/or the corresponding key identification K _ID _A_new are securely stored, allowing the pre-shared quantum symmetric key to be supplemented. In addition, if the service response message does not carry the key identification K _ID _A_new, terminal A needs to generate the corresponding key identification K _ID _A_new according to the method agreed with the quantum key management center in advance.

Optionally, step 5: Terminal A returns a message to the quantum key management center, which carries the key identification K _ID _A_new to confirm that the quantum key K _A _new has been successfully received. Optionally, the message also carries a timestamp. or serial number and other information. The message can be securely protected based on _KA or the symmetric key _KA ' derived from _KA . Afterwards, terminal A and the quantum key management center will destroy the used K _A. In addition, if step 5 is not performed, then the quantum key management center will destroy the used K _A after step 3 and terminal A after step 4.

Figure 5 shows a schematic diagram of the interaction process of terminal A initiating the number binding service provided by the application embodiment of the present disclosure. Referring to Figure 5, the interaction process includes:

Step 1: When the user makes an encrypted phone call, the calling terminal A initiates an encrypted phone call request.

Step 2: The calling terminal A and the called terminal B perform call connection through the application server (Application Server, AS).

Among them, the addition of IP-based voice transmission (Voice over Internet Protocol, VoIP) For encrypted telephone services, AS is the Session Initialization Protocol (SIP) server responsible for implementing telephone service functions; for encrypted telephone services based on VoLTE or New Radio (Voice over New Radio, VoNR) or fixed telephone, AS is The IP Multimedia Subsystem (IMS) system is responsible for the server of telephone services, such as VoLTE AS.

Step 3: During the call connection process, the calling terminal A synchronously sends a key request message to the quantum key management center to apply for the quantum session key for this encrypted phone call, which is used to encrypt and protect the user's voice information. . The request message carries the identities of the calling terminal A and the called terminal B. Optionally, it also carries information such as a session identifier, a timestamp or a sequence number. Among them, timestamp or sequence number information is used to prevent message replay.

In order to ensure the security of the key request message, the calling terminal A obtains an unused preconfigured quantum symmetric key K _A from the local area, and uses K _A or the symmetric key K _A ' derived based on K _A to Request that all or part of the information content of a message be encrypted and/or integrity protected.

Step 4: After receiving the key request message, the quantum key management center queries and obtains the quantum symmetric key K _A shared with the calling terminal A through pre-configuration based on the calling terminal identification and key identification, and uses _KA or the symmetric key _{KA' derived based on KA} _performs integrity protection verification and decryption of the key request message. Afterwards, if the key request message carries a timestamp or sequence number, the freshness of the key request message is verified based on the timestamp or sequence number.

After the integrity and freshness of the key request message are verified, the quantum key management center queries the called terminal ID and obtains a quantum symmetric key K _B and K _B shared with the called terminal B in a pre-configured manner. Corresponding key identification K _ID _B. At the same time, the quantum key management center generates a quantum session key for this call, generates new quantum symmetric keys K _A _new and K _B _new for the calling terminal A and the called terminal B respectively, and distributes new key identifiers accordingly. _{KID_A_new} and _{KID_B_new} . Here the quantum session key as well as the new quantum symmetric key are generated by a quantum random number generator.

Step 5: The quantum key management center forms a key response message, provides the session key Ks used in this call to the calling terminal A and the called terminal B, and generates a new quantum symmetric key K _A _new and K _B _new, optionally, also provide new key identifiers K _ID _A_new and K _ID _B_new and other related information. If the quantum key management center does not transmit K _ID _A_new and K _ID _B_new in the key response message, then the calling terminal A and the called terminal B, after receiving K _A _new and K _B _new, should use the quantum encryption method in advance. A certain method agreed upon by the key management center to allocate new K _ID _A_new and K _ID _B_new for quantum key synchronization, thereby maintaining synchronization with the quantum key management center.

For the calling terminal A, the quantum key management center provides the calling terminal A with: quantum session key Ks, key identification K _{ID_A} , calling terminal identification and new quantum symmetric key K _A _new, optionally , and also provide session identification and/or new key identification K _ID _A_new and/or timestamp or sequence number and other information. In order to prevent the message content from being eavesdropped and tampered with, and ensure the security of the transmission process, the quantum key management center should use _KA or the symmetric key _KA ' derived based on _KA , for Ks, and, optionally, _KA _new, K _ID _A_new and other related information are encrypted and/or integrity protected to obtain integrity protected verification results, such as HMAC _A.

In the same way, for the called terminal B, the quantum key management center provides B with: quantum session key Ks, key identification K _ID _B, calling terminal identification, new quantum symmetric key K _B _new, optionally , and also provide session identification and/or new key identification K _ID _B_new and/or timestamp or sequence number and other information. In order to prevent this part of the message content from being eavesdropped and tampered with, and to ensure the security of the transmission process, the quantum key management center uses K _B or the symmetric key K _B ' derived based on K _B , for Ks, and, optionally, for K _B _new, K _ID _B_new and other related information are encrypted and/or integrity protected to obtain integrity protected verification results, such as HMAC _B.

Afterwards, the quantum key management center sends the newly generated quantum symmetric key, and, optionally, key identification and other information to the calling terminal A through the key response message. Response messages include: Msg_A, HMAC _A , Msg_B, HMAC _B , etc. Here, Msg_A contains relevant information such as K _A _new, K _ID _A_new, Ks, timestamp or serial number after security protection, and Msg_B contains K _B _new, K _ID _B_new, Ks, timestamp or serial number after security protection and other related information.

Step 6: The calling terminal A uses _KA or the symmetric key _KA ' derived based on _KA to decrypt Msg_A, and obtains the new quantum symmetric key _KA _new generated by the quantum key management center, and optionally Ground, obtain relevant information such as key identification K _ID _A_new, Ks, timestamp or serial number, and securely store the relevant quantum key, thereby supplementing the pre-shared quantum symmetric key. If Msg_A contains a timestamp or sequence number, the calling terminal A can verify the freshness of the key response message Msg_A.

Optionally, step 7: The calling terminal A returns a message to the subkey management center, which carries K _ID _A_new. Optionally, it also carries information such as a timestamp or sequence number to confirm that K _A _new has been successfully received. The message can be secured based on _KA or _KA '. Afterwards, the calling terminal A and the quantum key management center destroy the used K _A.

In addition, if step 7 is not performed, then the quantum key management center will destroy the used KA after step 5, and the calling terminal A will destroy the used _KA after step 6.

Step 8: The calling terminal A sends the session key to the called terminal B. The message carries the relevant information provided by the quantum key management center to the called terminal B, including Msg_B, HMAC _B , etc.

Step 9: The called terminal B uses K _B or the symmetric key K _B ' derived based on K _B to decrypt Msg_B, and obtains the new quantum symmetric keys K _B _new and Ks generated by the quantum key management center. Optionally, Relevant information such as key identification K _ID _B_new, timestamp or serial number is also obtained, and the relevant quantum key is securely stored, thereby supplementing the pre-shared quantum symmetric key. If Msg_B contains a timestamp or sequence number, the called terminal B can verify the freshness of the key response message Msg_B.

Optionally, step 10: The called terminal B returns a message to the subkey management center, which carries K _ID _B_new. Optionally, it also carries information such as a timestamp or sequence number to confirm that K _B _new has been successfully received. The message can be secured based on K _B or K _B '. Afterwards, the called terminal B and the quantum key management center destroy the used K _B.

In addition, if step 10 is not performed, then the quantum key management center will destroy the used K B after step 5, and the called terminal B will destroy the used K _B after step 9.

Step 11: The called terminal B returns a session key confirmation message and confirms to the calling terminal A that the quantum session key Ks has been successfully received.

Step 12: The calling terminal A confirms that the called terminal B has successfully obtained the quantum session key Ks.

Step 13: The calling terminal A and the called terminal B use Ks to encrypt and protect the voice information exchanged between the users, and start the encrypted call. After the call ends, the calling and called terminals destroy the quantum session key Ks used this time.

Based on the above embodiments, it needs to be noted that first of all, the disclosed embodiments can be applied to encrypted voice and/or video calls, encrypted short messages, encrypted instant messages, encrypted voice and/or videos, encrypted intercom messages, encrypted emails, etc. Various secure communication services based on quantum keys. The above description only takes the quantum encrypted voice phone service as an example. The quantum key management center described here can refer to a unified quantum key management platform that provides unified key management services for a variety of different businesses, or it can be a key management platform for a specific business, such as quantum VoLTE. A key management platform for encrypted call services, specifically providing key management services for quantum VoLTE encrypted call services.

Secondly, the quantum symmetric key shared between the quantum key management center and the terminal plays a role in the interaction between the terminal and the quantum key management center during the secure communication process (such as session identification, quantum session key Ks, The new quantum symmetric key K _A _new and/or K _B _new, key identification K _ID _A_new/K _ID _B_new, etc.) perform security protection functions such as encryption, integrity protection, source authentication, etc., so the shared symmetric key also It can be called a basic key, a working key, a key protection key, an authentication key or an access key, etc.

Thirdly, in addition to being applicable to secure communication services involving two terminals, the disclosed embodiments are also applicable to secure communication services carried out by multiple terminals, meeting the needs of secure multi-party calls, secure voice and/or video conferencing, and secure group messages. , confidential multi-party intercom and other business applications. At this time, the quantum key management center should newly generate a quantum symmetric key based on the quantum symmetric key currently in use and shared with each terminal, optionally, the newly distributed quantum key identification and related information, Perform encryption protection, and then send the encrypted and protected new quantum symmetric key and related information to each terminal through the terminal that initiated the key request. They can be sent together or separately. Subsequently, each terminal decrypts and obtains the newly generated quantum symmetric key.

The disclosed embodiments can enable devices with a small number of local quantum symmetric key storage to meet the long-term needs of users by supplementing the quantum symmetric key without expanding the storage space of the device's security medium. Or the need for frequent quantum secure communication services, it is suitable for equipment with small security medium storage space, which can reduce equipment costs. Furthermore, the use of time stamp or sequence number mechanisms in quantum key management related messages can resist replay attacks by attackers on quantum keys.

In order to implement the method of the embodiment of the present disclosure, the embodiment of the present disclosure also provides a key management device, which is provided on the first device. As shown in Figure 6, the device includes:

The first receiving unit 601 is used to receive the first message sent by the second device;

Execution unit 602, configured to perform operations related to the first message, and obtain at least one of the following: a first key, a second key, and a third key;

The first sending unit 603 is used to send at least one of the first key, the second key and the third key to the second device.

In an embodiment, the first sending unit 603 sends the first key to the second device, including:

Send the first key that is securely protected using the fourth key to the second device; wherein,

The fourth key is a shared key between the first device and the second device.

In an embodiment, the execution unit 602 obtains the first key, including:

Obtain the first key and the corresponding first identifier;

The first sending unit 603 sends the first key to the second device, including:

In one embodiment, the device further includes:

The first storage unit is used to store the first key and/or the corresponding first identification.

In an embodiment, the first sending unit 603 sends the second key to the second device, including:

Send the second key that is securely protected using the fifth key to the second device; wherein,

The fifth key is a shared key between the first device and the third device.

In one embodiment, the method further includes:

The third sending unit is used to send the second key to the third device.

In an embodiment, the third sending unit sends the second key to the third device, including:

Send the second key protected by the fifth key to the third device; wherein,

The fifth key is a shared key between the first device and the third device.

In an embodiment, the execution unit 602 obtains the second key, including:

Obtain the second key and the corresponding second identification;

The first sending unit 603 sends the second key to the second device and/or the third device, including:

In one embodiment, the device further includes:

The second storage unit is used to store the second key and/or the corresponding second identification.

In an embodiment, the first sending unit 603 sends the third key to the second device, including:

Send the third key that is securely protected using the fourth key and the fifth key to the second device; wherein,

In one embodiment, the device further includes:

The fourth sending unit is used to send the third key to the third device.

In an embodiment, the fourth sending unit sends the third key to the third device, including:

Send the third key that is securely protected using the fifth key to the third device; wherein,

The fifth key is a shared key between the first device and the third device.

In an embodiment, the execution unit 602 obtains the third key, including:

Obtain the third key and the corresponding third identification;

The first sending unit 603 sends the third key to the second device and/or the third device, including:

In one embodiment, the device further includes:

The third storage unit is used to store the third key and/or the corresponding third identification.

In one embodiment, the message sent by the first device carries a timestamp.

In actual application, the first sending unit 601, the first receiving unit 603, the third sending unit and the fourth sending unit can be implemented by the communication interface in the key management device; the execution unit 602, the first storage unit, the third sending unit The second storage unit and the third storage unit may be implemented by a processor in the key management device.

In order to implement the method of the embodiment of the present disclosure, the embodiment of the present disclosure also provides a key management device, which is provided on the second device. As shown in Figure 7, the device includes:

The second sending unit 701 is used to send the first message to the first device;

The second receiving unit 702 is configured to receive at least one of the first key, the second key and the third key sent by the first device.

In an embodiment, the second receiving unit 702 receives the first key sent by the first device, including:

The fourth key is used to decrypt the securely protected first key.

Receive and store the first key and/or the corresponding first identification.

In an embodiment, the second receiving unit 702 receives the second key sent by the first device, including:

In one embodiment, the device further includes:

The fifth sending unit is used to send the second key and/or the corresponding second identification to the third device.

In an embodiment, the second receiving unit 702 receives the third key sent by the first device, including:

Using the fourth key to decrypt the third key protected by the fourth key;

Send the third key protected by the fifth key to the third device; wherein,

In an embodiment, the second receiving unit 702 receives the third key, including:

Receive and store the third key and/or the corresponding third identification.

In one embodiment, the message sent by the second device carries a timestamp.

In actual application, the second sending unit 701, the second receiving unit 702 and the fifth sending unit may be implemented by the communication interface in the key management device.

In order to implement the method of the embodiment of the present disclosure, the embodiment of the present disclosure also provides a key management device, which is provided on the third device. As shown in Figure 8, the device includes:

The third receiving unit 801 is configured to receive at least one of the first key, the second key and the third key sent by the first device and/or the second device.

In one embodiment, the third receiving unit 801 receives the second key sent by the first device and/or the second device, including:

Receive the second key sent by the first device and/or the second device and protected by using the fifth key; wherein,

The fifth key is a shared key between the first device and the third device.

In an embodiment, the third receiving unit 801 receives the second key, including:

In an embodiment, the third receiving unit 801 receives the third key sent by the second device, including:

Use the fifth key to decrypt the third key securely protected by the fifth key; wherein,

The fifth key is a shared key between the first device and the third device.

In an embodiment, the third receiving unit 801 receives the third key sent by the first device, including:

The fifth key is a shared key between the first device and the third device.

In an embodiment, the third receiving unit 801 receives the third key, including:

Receive and store the third key and/or the corresponding third identification.

In one embodiment, the device further includes:

The sixth sending unit is used to send the second message to the first device; wherein,

The second message is used to return the result of key reception.

In one embodiment, the message sent by the third device carries a timestamp.

In actual application, the third receiving unit 803 and the sixth sending unit may be implemented by the communication interface in the key management device.

It should be noted that when the key management device provided in the above embodiment performs key management, only the division of the above program modules is used as an example. In actual application, the above processing can be allocated to different modules as needed. The program module is completed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the key management device and the key management method embodiments provided in the above embodiments belong to the same concept. Please refer to the method embodiments for the specific implementation process, which will not be described again here.

Based on the hardware implementation of the above program module, and in order to implement the first device side of the embodiment of the present disclosure, Method, the embodiment of the present disclosure also provides a first device. As shown in Figure 9, the first device 900 includes:

The first communication interface 901 is capable of information exchange with other network nodes;

The first processor 902 is connected to the first communication interface 901 to implement information interaction with other network nodes, and is used to execute the method provided by one or more technical solutions on the first device side when running a computer program. The computer program is stored on the first memory 903 .

Specifically, the first communication interface 901 is used to receive the first message sent by the second device;

The first processor 902 is configured to perform operations related to the first message and obtain at least one of the following: a first key, a second key, and a third key;

The first communication interface 901 is also used to send at least one of the first key, the second key and the third key to the second device.

In one embodiment, the first communication interface 901 is used to send the first key that is securely protected by using the fourth key to the second device; wherein,

The fourth key is a shared key between the first device and the second device.

In one embodiment, the first processor 902 is used to obtain the first key and the corresponding first identification;

The first communication interface 901 is used to send the first key and/or the corresponding first identification to the second device.

In one embodiment, the first processor 902 is also configured to store the first key and/or the corresponding first identification.

In one embodiment, the first communication interface 901 is used to send the second key that is securely protected by using the fifth key to the second device; wherein,

The fifth key is a shared key between the first device and the third device.

In one embodiment, the first communication interface 901 is also used to send the second key to the third device.

In one embodiment, the first communication interface 901 is used to send the second key that is securely protected by using the fifth key to the third device; wherein,

The fifth key is a shared key between the first device and the third device.

In one embodiment, the first processor 902 is used to obtain the second key and the corresponding second identification;

The first communication interface 901 is used to send the second key and/or the corresponding second identification to the second device and/or the third device.

In one embodiment, the first processor 902 is also configured to store the second key and/or the corresponding second identification.

In one embodiment, the first communication interface 901 is used to send the third key that is securely protected using the fourth key and the fifth key to the second device; wherein,

In one embodiment, the first communication interface 901 is also used to send the third key to the third device.

In one embodiment, the first communication interface 901 is used to send the third key that is securely protected using the fifth key to the third device; wherein,

The fifth key is a shared key between the first device and the third device.

In one embodiment, the first processor 902 is used to obtain the third key and the corresponding third identification;

The first communication interface 901 is used to send the third key and/or the corresponding third identification to the second device and/or the third device.

In one embodiment, the first processor 902 is also configured to store the third key and/or the corresponding third identification.

In one embodiment, the message sent by the first device carries a timestamp.

It should be noted that the specific processing procedures of the first processor 902 and the first communication interface 901 can be understood with reference to the above method.

Of course, in actual application, various components in the first device 900 are coupled together through the bus system 904 . It can be understood that the bus system 904 is used to implement connection communication between these components. In addition to the data bus, the bus system 904 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, various buses are labeled as bus system 904 in FIG. 9 .

The first memory 903 in the embodiment of the present disclosure is used to store various types of data to support the operation of the first device 900 . Examples of such data include any computer program for operating on the first device 900 .

The methods disclosed in the above embodiments of the present disclosure may be applied to the first processor 902 or implemented by the first processor 902 . The first processor 902 may be an integrated circuit chip with signal processing capabilities. During the implementation process, each step of the above method can be completed by instructions in the form of hardware integrated logic circuits or software in the first processor 902 . The above-mentioned first processor 902 may be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The first processor 902 can implement or execute the disclosed methods, steps and logical block diagrams in the embodiments of the present disclosure. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present disclosure can be directly implemented by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the first memory 903. The first processor 902 reads the information in the first memory 903, and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, the first device 900 may be one or more application specific integrated circuits (Application Specific Integrated Circuits, ASICs), DSPs, programmable logic devices (Programmable Logic Device, PLD), Complex Programmable Logic Device (CPLD), Field-Programmable Gate Array (FPGA), general-purpose processor, controller, microcontroller (Micro Controller) Unit (MCU), microprocessor (Microprocessor), or other electronic components for executing the aforementioned method.

Based on the hardware implementation of the above program module, and in order to implement the method on the second device side of the embodiment of the disclosure, the embodiment of the disclosure also provides a second device. As shown in Figure 10, the second device 1000 includes:

The second communication interface 1001 is capable of information exchange with other network nodes;

The second processor 1002 is connected to the second communication interface 1001 to implement information interaction with other network nodes, and is used to execute the method provided by one or more technical solutions on the second device side when running a computer program. The computer program is stored on the second memory 1003 .

Specifically, the second communication interface 1001 is used to send a first message to a first device; and to receive at least one of the first key, the second key and the third key sent by the first device. .

In one embodiment, the second communication interface 1001 is used to receive a first key sent by a first device and protected by a fourth key; wherein the fourth key is a combination of the first device and the second key. The device’s shared secret key;

The second processor 1002 is configured to use the fourth key to decrypt the securely protected first key.

In one embodiment, the second communication interface 1001 is used to receive the first key and/or the corresponding first identification;

The second processor 1002 is used to store the first key and/or the corresponding first identification.

In one embodiment, the second communication interface 1001 is used to receive a second key sent by the first device and protected by using a fifth key; wherein the fifth key is a link between the first device and the third key. The shared key of the three devices; the second key protected by the fifth key is sent to the third device.

In one embodiment, the second communication interface 1001 is also used to send the second key and/or the corresponding second identification to the third device.

In one embodiment, the second communication interface 1001 is used to receive the third key sent by the first device and protected by using the fourth key and the fifth key respectively;

The second processor 1002 is also configured to use the fourth key to decrypt the third key protected by the fourth key;

The second communication interface 1001 is used to send the third key protected by the fifth key to the third device; wherein,

In one embodiment, the second communication interface 1001 is used to receive and store the third key and/or the corresponding third identification.

In one embodiment, the message sent by the second device carries a timestamp.

It should be noted that the specific processing procedures of the second processor 1002 and the second communication interface 1001 can be understood with reference to the above method.

Of course, in actual application, various components in the second device 1000 are coupled together through the bus system 1004. It can be understood that the bus system 1004 is used to implement connection communication between these components. In addition to the data bus, the bus system 1004 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, various buses are labeled as bus system 1004 in FIG. 10 .

The second memory 1003 in the embodiment of the present disclosure is used to store various types of data to support the operation of the second device 1000. Examples of such data include: any data used to operate on the second device 1000 any computer program.

The methods disclosed in the above embodiments of the present disclosure can be applied to the second processor 1002 or implemented by the second processor 1002 . The second processor 1002 may be an integrated circuit chip with signal processing capabilities. During the implementation process, each step of the above method can be completed by instructions in the form of hardware integrated logic circuits or software in the second processor 1002 . The above-mentioned second processor 1002 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The second processor 1002 can implement or execute the disclosed methods, steps and logical block diagrams in the embodiments of the present disclosure. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present disclosure can be directly implemented by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the second memory 1003. The second processor 1002 reads the information in the second memory 1003, and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, the second device 1000 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general processors, controllers, MCUs, Microprocessors, or other electronic components for performing the foregoing method.

Based on the hardware implementation of the above program module, and in order to implement the method on the third device side of the embodiment of the disclosure, the embodiment of the disclosure also provides a third device. As shown in Figure 11, the third device 1100 includes:

The third communication interface 1101 is capable of information exchange with other network nodes;

The third processor 1102 is connected to the third communication interface 1101 to implement information interaction with other network nodes, and is used to execute the method provided by one or more technical solutions on the third device side when running a computer program. The computer program is stored on the third memory 1103 .

Specifically, the third communication interface 1101 is used to receive at least one of the first key, the second key and the third key sent by the first device and/or the second device.

In one embodiment, the second key is used for security between the first device and the third device. communications, or secure storage of local information for third devices.

In one embodiment, the third communication interface 1101 is used to receive the second key sent by the first device and/or the second device and protected by using the fifth key; wherein,

The fifth key is a shared key between the first device and the third device.

In one embodiment, the third communication interface 1101 is used to receive and store the second key and/or the corresponding second identification.

In one embodiment, the third communication interface 1101 is used to receive the third key sent by the second device and protected by the fifth key security;

The third processor 1102 is configured to use the fifth key to decrypt the third key securely protected by the fifth key; wherein,

The fifth key is a shared key between the first device and the third device.

In one embodiment, the third communication interface 1101 is used to receive the third key sent by the first device and protected by the fifth key;

The fifth key is a shared key between the first device and the third device.

In one embodiment, the third communication interface 1101 is used to receive the third key and/or the corresponding third identification;

The third processor 1102 is used to store the third key and/or the corresponding third identification.

In one embodiment, the third communication interface 1101 is also used to send the second message to the first device; wherein,

The second message is used to return the result of key reception.

In one embodiment, the message sent by the third device carries a timestamp.

Of course, in actual application, various components in the third device 1100 are coupled together through the bus system 1104 . It can be understood that the bus system 1104 is used to implement connection communication between these components. bus System 1104 includes a power bus, a control bus, and a status signal bus in addition to a data bus. However, for the sake of clarity, the various buses are labeled bus system 1104 in FIG. 11 .

The third memory 1103 in the embodiment of the present disclosure is used to store various types of data to support the operation of the third device 1100. Examples of such data include: any computer program for operating on the third device 1100 .

The methods disclosed in the above embodiments of the present disclosure can be applied to the third processor 1102 or implemented by the third processor 1102 . The third processor 1102 may be an integrated circuit chip with signal processing capabilities. During the implementation process, each step of the above method can be completed by instructions in the form of hardware integrated logic circuits or software in the third processor 1102 . The above-mentioned third processor 1102 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The third processor 1102 can implement or execute the disclosed methods, steps and logical block diagrams in the embodiments of the present disclosure. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present disclosure can be directly implemented by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the third memory 1103. The third processor 1102 reads the information in the third memory 1103, and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, the third device 1100 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general processors, controllers, MCUs, Microprocessors, or other electronic components for performing the foregoing method.

It can be understood that the memory (first memory 903, second memory 1003, third memory 1103) in the embodiment of the present disclosure can be a volatile memory or a non-volatile memory, and can also include volatile and non-volatile memories. Both. Among them, the non-volatile memory can be read-only memory (Read Only Memory, ROM), programmable read-only memory (Programmable Read-Only Memory, PROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory). , EPROM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory (EEPROM), ferromagnetic random access memory (FRAM), Flash Memory, magnetic surface memory, optical disk, or Compact Disc Read-Only Memory (CD) -ROM); magnetic surface memory can be disk memory or tape memory. The volatile memory may be random access memory (RAM), which is used as an external cache. By way of illustration, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory Memory (Dynamic Random Access Memory, DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), Direct Rambus Random Access Memory (DRRAM) ). Memories described in embodiments of the present disclosure are intended to include, but are not limited to, these and any other suitable types of memory.

In an exemplary embodiment, the embodiment of the present disclosure also provides a storage medium, that is, a computer storage medium, specifically a computer-readable storage medium, such as a first memory 903 that stores a computer program. The computer program can be stored in a first device. The first processor 902 of 900 executes to complete the steps described in the foregoing first device-side method. Another example includes a second memory 1003 that stores a computer program. The computer program can be executed by the second processor 1002 of the second device 1000 to complete the steps described in the second device-side method. Another example includes a third memory 1103 that stores a computer program. The computer program can be executed by the third processor 1102 of the third device 1100 to complete the steps described in the third device-side method. The computer-readable storage medium may be FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM etc. memory.

It should be noted that "first", "second", etc. are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

The term "and/or" in this article is just an association relationship that describes related objects, indicating that three relationships can exist. For example, A and/or B can mean: A exists alone, A and B exist simultaneously, and they exist alone. B these three situations. In addition, the term "at least one" in this article means any one of a plurality or any combination of at least two of a plurality, for example, including at least one of A, B, and C, which can mean including from A, Any one or more elements selected from the set composed of B and C.

In addition, the technical solutions described in the embodiments of the present disclosure may be combined arbitrarily as long as there is no conflict.

The above descriptions are only preferred embodiments of the present disclosure and are not intended to limit the scope of the present disclosure.

Claims

A key management method, applied to a first device, the method includes:

receiving the first message sent by the second device;

Perform an operation related to the first message, and obtain at least one of the following: a first key, a second key, and a third key;

At least one of the first key, the second key, and the third key is sent to the second device.
The method of claim 1, wherein the first key is used for secure communication between the first device and the second device, or for secure storage of local information of the second device.
The method of claim 1, wherein sending the first key to the second device includes:

Send the first key that is securely protected using the fourth key to the second device; wherein,

The fourth key is a shared key between the first device and the second device.
The method of claim 1, wherein obtaining the first key includes:

Obtain the first key and the corresponding first identifier;

Send the first key to the second device, including:

Send the first key and/or the corresponding first identification to the second device.
The method according to claim 1 or 4, further comprising:

Store the first key and/or the corresponding first identification.
The method of claim 1, wherein the second key is used for secure communication between the first device and the third device, or for secure storage of local information of the third device.
The method of claim 6, wherein sending the second key to the second device includes:

Send the second key that is securely protected using the fifth key to the second device; wherein,

The fifth key is a shared key between the first device and the third device.
The method of claim 6, further comprising:

Send the second key to the third device.
The method according to claim 8, wherein sending the second key to the third device includes:

Send the second key protected by the fifth key to the third device; wherein,

The fifth key is a shared key between the first device and the third device.
The method according to any one of claims 6-9, wherein obtaining the second key includes:

Obtain the second key and the corresponding second identification;

Send the second key to the second device and/or the third device, including:

Send the second key and/or the corresponding second identification to the second device and/or the third device.
The method according to claim 6 or 10, further comprising:

Store the second key and/or the corresponding second identification.
The method of claim 1, wherein the third key is used for secure communication between the second device and the third device.
The method of claim 12, wherein sending the third key to the second device includes:

Send the third key that is securely protected using the fourth key and the fifth key to the second device; wherein,

The fourth key is a shared key between the first device and the second device, and the fifth key is a shared key between the first device and the third device.
The method of claim 12, further comprising:

Send the third key to the third device.
The method of claim 14, wherein sending the third key to the third device includes:

Send the third key that is securely protected using the fifth key to the third device; wherein,

The fifth key is a shared key between the first device and the third device.
The method according to any one of claims 12-15, wherein the third key is obtained, including include:

Obtain the third key and the corresponding third identification;

Send the third key to the second device and/or the third device, including:

Send the third key and/or the corresponding third identification to the second device and/or the third device.
The method according to claim 12 or 16, further comprising:

Store the third key and/or the corresponding third identification.
The method according to any one of claims 1 to 17, wherein the message sent by the first device carries a timestamp.
A key management method, applied to a second device, the method includes:

a first message sent to the first device;

Receive at least one of the first key, the second key and the third key sent by the first device.
The method of claim 19, wherein the first key is used for secure communication between the first device and the second device, or for secure storage of local information of the second device.
The method according to claim 19 or 20, wherein receiving the first key sent by the first device includes:

Receive the first key sent by the first device and protected by the fourth key; wherein the fourth key is the shared key between the first device and the second device;

The fourth key is used to decrypt the securely protected first key.
The method of claim 19, wherein receiving the first key sent by the first device includes:

Receive and store the first key and/or the corresponding first identification.
The method of claim 19, wherein the second key is used for secure communication between the first device and the third device, or for secure storage of local information of the third device.
The method of claim 23, wherein receiving the second key sent by the first device includes:

Receive the second key sent by the first device and protected by using the fifth key; wherein the fifth key is the shared key between the first device and the third device;

The second key that is securely protected using the fifth key is sent to the third device.
The method according to claim 23 or 24, further comprising:

Send the second key and/or the corresponding second identification to the third device.
The method of claim 19, wherein the third key is used for secure communication between the second device and the third device.
The method of claim 26, wherein receiving the third key sent by the first device includes:

Receive the third key sent by the first device and protected by using the fourth key and the fifth key respectively;

Using the fourth key to decrypt the third key protected by the fourth key;

Send the third key protected by the fifth key to the third device; wherein,

The fourth key is a shared key between the first device and the second device, and the fifth key is a shared key between the first device and the third device.
The method according to claim 26 or 27, wherein receiving the third key sent by the first device includes:

Receive and store the third key and/or the corresponding third identification.
The method according to any one of claims 19 to 28, wherein the message sent by the second device carries a timestamp.
A key management method, applied to a third device, the method includes:

Receive at least one of the second key and the third key sent by the first device and/or the second device.
The method of claim 30, wherein the second key is used for secure communication between the first device and the third device, or for secure storage of local information of the third device.
The method according to claim 30 or 31, wherein receiving the first device and/or the second The second key sent by the device, including:

Receive the second key sent by the first device and/or the second device and protected by using the fifth key; wherein,

The fifth key is a shared key between the first device and the third device.
The method according to any one of claims 30-32, wherein receiving the second key includes:

Receive and store the second key and/or the corresponding second identification.
The method of claim 30, wherein the third key is used for secure communication between the second device and the third device.
The method of claim 34, wherein receiving the third key sent by the second device includes:

Receive the third key sent by the second device and securely protected by the fifth key;

Use the fifth key to decrypt the third key securely protected by the fifth key; wherein,

The fifth key is a shared key between the first device and the third device.
The method of claim 30, wherein receiving the third key sent by the first device includes:

Receive the third key sent by the first device and securely protected by the fifth key;

Use the fifth key to decrypt the third key securely protected by the fifth key; wherein,

The fifth key is a shared key between the first device and the third device.
The method according to any one of claims 30 to 36, wherein receiving the third key sent by the first device and/or the second device includes:

Receive and store the third key and/or the corresponding third identification.
The method of claim 30, further comprising:

Send a second message to the first device; wherein,

The second message is used to return the result of key reception.
The method according to any one of claims 30-38, wherein the message sent by the third device carries the timestamp.
A key management device, including:

A first receiving unit configured to receive the first message sent by the second device;

An execution unit, configured to perform operations related to the first message and obtain at least one of the following: a first key, a second key, and a third key;

The first sending unit is used to send at least one of the first key, the second key and the third key to the second device.
A key management device, including:

The second sending unit is used to send the first message to the first device;

The second receiving unit is configured to receive at least one of the first key, the second key and the third key sent by the first device.
A key management device, including:

The third receiving unit is configured to receive at least one of the first key, the second key and the third key sent by the first device and/or the second device.
A first device including: a first processor and a first communication interface; wherein,

The first communication interface is used to receive the first message sent by the second device;

The first processor is configured to perform operations related to the first message and obtain at least one of the following: a first key, a second key, and a third key;

The first communication interface is also used to send at least one of the first key, the second key and the third key to the second device.
A second device including: a second processor and a second communication interface; wherein,

The second communication interface is used to send a first message to the first device; and to receive at least one of the first key, the second key and the third key sent by the first device.
A third device including: a third processor and a third communication interface; wherein,

The third communication interface is used to receive at least one of the first key, the second key and the third key sent by the first device and/or the second device.
A first device comprising: a first processor and a first memory for storing a computer program capable of running on the processor,

Wherein, the first processor is configured to perform the steps of the method described in any one of claims 1 to 18 when running the computer program.
a second device comprising: a second processor and a second memory for storing a computer program capable of running on the processor,

Wherein, the second processor is configured to perform the steps of the method described in any one of claims 19 to 29 when running the computer program.
A third device including: a third processor and a third memory for storing a computer program capable of running on the processor,

Wherein, the third processor is configured to perform the steps of the method described in any one of claims 30 to 39 when running the computer program.
A storage medium with a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 18 are implemented, or the steps of any one of claims 19 to 29 are implemented. The steps of the method, or the steps of implementing the method of any one of claims 30 to 39.