Method and system for secure data transmission

1. A computer-implemented method for establishing a secure communication channel between a client and a server, the method comprising:

generating, by the client, a first service request comprising a first dynamic message, wherein the first dynamic message includes a first hash function and a random number, wherein the first hash function is calculated based on the client's identification (ID) and a client-specific key;

transmitting the first service request to the server, which authenticates the client based on the first dynamic message;

receiving a second dynamic message from the server in response to the first dynamic message, wherein the second dynamic message includes a second hash function of the random number or a concatenation of the server's ID and the random number;

authenticating the server by calculating a third hash function based at least on the random number and by comparing the calculated third hash function with the second hash function included in the second dynamic message;

negotiating, via a quantum-key-distribution process, a secret key shared between the client and the server; and

establishing a secure communication channel between the client and the server based on as least a first portion of the secret key.

2. The computer-implemented method of claim 1 , wherein establishing the secure communication channel comprises using the first portion of the secret key as a symmetric encryption/decryption key for data transmission.

3. The computer-implemented method of claim 1 , wherein the first dynamic message further includes the client's ID, and wherein the client-specific key is previously shared between the client and the server.

4. The computer-implemented method of claim 1 , wherein the random number is encrypted with the client-specific key.

5. The computer-implemented method of claim 1 , further comprising:

extracting a second portion of the secret key; and

updating the client-specific key using a second portion of the secret key.

6. A client device for establishing a secure communication channel between the client device and a server device, the client device comprising:

a service request generator configured to generate a service request that includes a first dynamic message, wherein the first dynamic message includes a first hash function and a random number, wherein the first hash function is calculated based on the client's identification (ID) and a client-specific key;

a service request transmitter configured to transmit the first dynamic message to the server device, which authenticates the client device based on the first dynamic message;

a receiver configured to receive a second dynamic message from the server device in response to the first dynamic message, wherein the second dynamic message includes a second hash function of the random number or a concatenation of the server's ID and the random number;

an authentication module configured to authenticate the server device by calculating a third hash function based at least on the random number and by comparing the calculated third hash function with the second hash function included in the second dynamic message;

a quantum-key-distribution module configured to distribute a secret key between the client and the server; and

a key-management module configured to extract at least a first portion of the secret key to be used as a symmetric encryption/decryption key for the secure communication channel,

wherein implementations of the service request generator, the service request transmitter, the receiver, the authentication module, the quantum-key-distribution module, and the key-management module comprise hardware processors.

7. The client device of claim 6 , wherein the client-specific key is previously shared between the client and the server, and wherein the first dynamic message further includes the client's ID.

8. The client device of claim 6 , wherein the key-management module is further configured to:

extract a second portion of the secret key; and

update the client-specific key using the second portion of the secret key.

9. A computer-implemented method for establishing a secure communication channel between a client and a server, the method comprising:

receiving, by the server, a service request comprising a first dynamic message, wherein the first dynamic message includes a first hash function and a random number, wherein the first hash function is calculated based on the client's identification (ID) and a client-specific key;

authenticating the client based on the first dynamic message;

generating a second dynamic message based on information included in the first dynamic message, wherein the second dynamic message includes a second hash function of the random number or a concatenation of the server's ID and the random number;

sending the second dynamic message to the client, which authenticates the server by calculating a third hash function based at least on the random number and by comparing the calculated third hash function with the second hash function included in the second dynamic message;

negotiating, via a quantum-key-distribution process, a secret key shared between the client and the server; and

establishing a secure communication channel between the client and the server based on at least a first portion of the secret key.

10. The computer-implemented method of claim 9 , wherein establishing the secure communication channel comprises using the first portion of the secret key as a symmetric encryption/decryption key for data transmission.

11. The computer-implemented method of claim 9 , wherein the first dynamic message further includes the client's ID, and wherein the client-specific key is previously shared between the client and the server.

12. The computer-implemented method of claim 9 , wherein authenticating the client involves:

looking up a key database to identify a locally stored client-specific key based on the client's ID included in the first dynamic message;

calculating a hash function based on the locally stored client-specific key; and

comparing the calculated hash function with the first hash function included in the first dynamic message.

13. The computer-implemented method of claim 12 , further comprising:

extracting a second portion of the secret key; and

updating the locally stored client-specific key using the second portion of the secret key.

14. A server device for establishing a secure communication channel between a client device and the server, the server device comprising:

a service request receiver configured to receive a service request comprising a first dynamic message from the client device, wherein the first dynamic message includes a first hash function and a random number, wherein the first hash function is calculated based on the client's identification (ID) and a client-specific key;

an authentication module configured to authenticate the client device based on the first dynamic message;

a message generator configured to generate a second dynamic message based on information included in the first dynamic message, wherein the second dynamic message includes a second hash function of the random number or a concatenation of the server's ID and the random number;

a transmitter configured to transmit the second dynamic message to the client device, which authenticates the server device by calculating a third hash function based at least on the random number and by comparing the calculated third hash function with the second hash function included in the second dynamic message;

a quantum-key-distribution module configured to distribute a secret key between the client device and the server device; and

a key-management module configured to extract at least a first portion of the secret key to be used as a symmetric encryption/decryption key for the secure communication channel;

wherein implementations of the service request receiver, the authentication module, the message generator, the transmitter, the quantum-key-distribution module, and the key-management module comprise hardware processors.

15. The server device of claim 14 , wherein the first dynamic message further includes the client's ID, and wherein the client-specific key is previously shared between the client and the server.

16. The server device of claim 14 , wherein while authenticating the client, the authentication module is configured to:

look up a key database to identify a locally stored client-specific key based on the client ID included in the first dynamic message;

calculate a hash function based on the locally stored client-specific key; and

compare the calculated hash function with the first hash function included in the first dynamic message.

17. The server of claim 16 , wherein the key-management module is further configured to:

extract a second portion of the secret key; and

update the locally stored client-specific key using the second portion of the secret key.