Deployment method and device of quantum key management system based on confidential computing

Abstract

The present invention discloses a deployment method and device of a quantum key management system based on confidential computing, including: a cryptographic business management module sends a cryptographic management request to a trusted cryptographic operation module through a communication module to generate a target password. The trusted cryptographic operation module encrypts the target password to be stored using a trusted encryption password, and returns the processing result to the cryptographic business management module. The present invention generates a request password through a quantum random number, thereby reducing the probability of the request password being cracked; placing the operation of the request password in a secure space to prevent the request password from being monitored and tampered with by malware or a third party during the operation; protecting the target password based on a trusted encryption password that can only be read in a secure space to prevent the stored password from being stolen and cracked. It can be seen that the implementation of the present invention can reduce the probability of password leakage during generation, distribution, storage, and reading, thereby improving the security of information protected by the password.

Description

Technical Field

[0001] The present invention relates to the technical field of information security technology, and in particular to a deployment method and device for a quantum key management system based on confidential computing. Background Art

[0002] Password management refers to the process of using methods and / or tools to create, store, and update passwords. In the digital age, a strong password is the first line of defense for user information security. The core function of password management is to generate complex and unpredictable passwords to resist guessing and automated attacks. After the password is generated, it is also necessary to ensure the security of the password during distribution, storage, and reading. Password management not only reduces the tendency of individuals to reuse the same password on multiple platforms, but also greatly reduces the account security risks caused by password leaks, thus playing a vital role in maintaining personal privacy and network security.

[0003] The main direction of existing password management is to use software to generate and manage passwords. Software-based password management uses high-entropy seeds as input to a cryptographically secure pseudo-random number generator (CSPRNG) to generate a series of unpredictable outputs as passwords. In the distribution, storage, and reading stages of passwords, encryption technology is used to ensure password security. However, with the strengthening of the field of quantum computing, powerful computing power can crack most algorithms used to generate passwords and encryption algorithms used in the distribution, storage, and reading of passwords, resulting in password leaks and reducing the security of the information protected by the passwords. Summary of the invention

[0004] The present invention provides a deployment method and device for a quantum key management system based on confidential computing, which can reduce the probability of password leakage during generation, distribution, storage, and reading, thereby improving the security of information protected by the password.

[0005] In order to solve the above technical problems, the first aspect of the present invention discloses a deployment method of a quantum key management system based on confidential computing, the method comprising:

[0006] The password service management module sends a password management request to the communication module, the password service management module and the communication module are deployed in a non-secure space, the password management request includes a password request and a password operation type performed on the password request, the password operation type includes one or more of password generation, password update, password reading, password storage, and password deletion;

[0007] The communication module sends the password management request to the trusted password operation module;

[0008] The trusted cryptographic operation module processes the password management request to obtain a target password. For the target password that needs to be stored, the target password is encrypted based on a predefined trusted encryption password and then updated in the memory, and the processing result of the password management request is sent to the cryptographic service management module through the communication module. The requested password is a password generated by the trusted cryptographic operation module based on a quantum random number. The trusted cryptographic operation module is deployed in a secure space, and the trusted encryption password is a password that can only be read in the secure space.

[0009] As an optional implementation, in the first aspect of the present invention, before the trusted cryptographic operation module processes the password management request to obtain the target password, the deployment method of the quantum key management system based on confidential computing further includes:

[0010] The trusted password operation module confirms whether the communication module has passed the identity authentication. If the identity authentication has been passed, the trusted password operation module is triggered to execute the step of processing the password management request to obtain the target password.

[0011] As an optional implementation, in the first aspect of the present invention, the trusted cryptographic operation module confirms whether the communication module passes the identity authentication, including:

[0012] The communication module sends a communication module signature to the trusted cryptographic operation module;

[0013] The trusted cryptographic operation module sends communication module verification information to the verification module, and receives the identity authentication result returned by the verification module. When the identity authentication result is passed, the trusted cryptographic operation module confirms that the communication module has passed the identity authentication; when the identity authentication result is failed, the trusted cryptographic operation module confirms that the communication module has failed the identity authentication; the communication module verification information includes the communication module signature, and the verification module is deployed in a secure space.

[0014] As an optional implementation, in the first aspect of the present invention, the communication module signature includes identity authentication information, and the identity authentication information is a signature verification private key TSK. pri An encrypted communication module hash value, wherein the communication module hash value is a value calculated by an executable file compiled by the communication module according to a predetermined signature hash function;

[0015] The communication module verification information also includes communication module identification information, and the communication module identification information is used to identify a communication module process in the network;

[0016] And, the method for determining the identity authentication result returned by the verification module includes:

[0017] The verification module verifies the public key TSK by signing pub Decrypt the identity verification information to obtain the communication module hash value and the signature verification public key TSK. pub and the signature verification private key TSK pri is a pair of pre-generated asymmetric keys;

[0018] The verification module obtains the executable file of the communication module as the executable file to be verified through the communication module identification information, and operates the executable file to be verified based on the predetermined signature hash function to obtain a hash value of the communication module to be verified;

[0019] The verification module compares the hash value of the communication module with the hash value of the communication module to be verified to see if they are equal. When the judgment result is equal, the identity authentication result is verified; when the judgment result is unequal, the identity authentication result is verified unsuccessfully.

[0020] As an optional implementation, in the first aspect of the present invention, the trusted encryption password is obtained in the following manner:

[0021] The secure space root key and / or the secure boot key are read as an input key of a key derivation algorithm, and a trusted encryption password is generated using the key derivation algorithm based on the quantum random number as another input key of the key derivation algorithm.

[0022] As an optional implementation, in the first aspect of the present invention, the communication module can support all communication methods between secure spaces and non-secure spaces before compilation, and after compilation, the communication module only supports the communication methods between secure spaces and non-secure spaces corresponding to the compilation environment.

[0023] As an optional implementation, in the first aspect of the present invention, the specific implementation manner in which the communication module can support all communication modes between the secure space and the non-secure space before compilation includes:

[0024] When the communication between the secure space and the non-secure space is implemented by a built-in interface of the operating system, the communication module implements the communication between the secure space and the non-secure space in accordance with the interface requirements of the built-in interface, and the operating system refers to an operating system that provides the secure space and the non-secure space;

[0025] When communication between the secure space and the non-secure space needs to cross the address space boundary, the communication module implements communication between the secure space and the non-secure space through remote procedure calls;

[0026] When the communication between the secure space and the non-secure space is network-based communication, the communication module implements the communication between the secure space and the non-secure space through remote procedure calls.

[0027] The second aspect of the present invention discloses a deployment device for a quantum key management system based on confidential computing, the device comprising: a cryptographic service management module, a communication module, and a trusted cryptographic operation module, the cryptographic service management module and the communication module are deployed in a non-secure space, and the trusted cryptographic operation module is deployed in a secure space;

[0028] The password service management module is used to send a password management request to the communication module, wherein the password management request includes a password request and a password operation type to be performed for the password request, wherein the password operation type includes one or more of password generation, password update, password reading, password storage, and password deletion;

[0029] The communication module is used to send the password management request to the trusted password operation module;

[0030] The trusted password operation module is used to process the password management request to obtain a target password, encrypt the target password to be stored based on a predefined trusted encryption password and then update it in the memory, and send the processing result of the password management request to the communication module, the request password is a password generated by the trusted password operation module based on a quantum number random generator, and the trusted encryption password is a password that can only be read in a secure space;

[0031] The communication module is also used to send the processing result to the cryptographic service management module.

[0032] The third aspect of the present invention discloses another deployment device of a quantum key management system based on confidential computing, the device comprising:

[0033] A memory storing executable program code;

[0034] a processor coupled to the memory;

[0035] The processor calls the executable program code stored in the memory to execute the deployment method of the quantum key management system based on confidential computing disclosed in the first aspect of the present invention.

[0036] The fourth aspect of the present invention discloses a computer storage medium, which stores computer instructions. When the computer instructions are called, they are used to execute the deployment method of the quantum key management system based on confidential computing disclosed in the first aspect of the present invention.

[0037] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0038] In an embodiment of the present invention, the password business management module sends a password management request to the communication module, the password business management module and the communication module are deployed in a non-secure space, the password management request includes a request password and a password operation type performed for the request password, and the password operation type includes one or more of password generation, password update, password reading, password storage, and password deletion; the communication module sends a password management request to the trusted password operation module; the trusted password operation module processes the password management request to obtain a target password, and for the target password to be stored, the target password is encrypted based on a predefined trusted encryption password and updated in the memory, and the processing result of the password management request is sent to the password business management module through the communication module, the request password is a password generated by the trusted password operation module based on a quantum random number, the trusted password operation module is deployed in a secure space, and the trusted encryption password is a password that can only be read in a secure space. The present invention generates a request password through a quantum random number, which reduces the probability of the request password being cracked; the operation of the request password is placed in a secure space to prevent the request password from being monitored and tampered with by malware or a third party during the operation; the target password is protected based on a trusted encryption password that can only be read in a secure space to prevent the stored password from being stolen and cracked. It can be seen that the implementation of the present invention can reduce the probability of password leakage during generation, distribution, storage, and reading, thereby improving the security of information protected by the password. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0040] Figure 1 It is a flow chart of a deployment method of a quantum key management system based on confidential computing disclosed in an embodiment of the present invention;

[0041] Figure 2 It is a flow chart of an implementation method in which a communication module in a deployment method of a quantum key management system based on confidential computing disclosed in an embodiment of the present invention supports all secure space and non-secure space communication modes before compilation, and only supports secure space and non-secure space communication modes matching the compilation environment after compilation;

[0042] Figure 3 It is a structural schematic diagram of a deployment device of a quantum key management system based on confidential computing disclosed in an embodiment of the present invention;

[0043] Figure 4 It is a structural schematic diagram of another deployment device of a quantum key management system based on confidential computing disclosed in an embodiment of the present invention;

[0044] Figure 5 It is a structural schematic diagram of another deployment device of a quantum key management system based on confidential computing disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] The terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish different objects rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, device, product or end including a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units inherent to these processes, methods, products or ends.

[0047] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0048] The present invention discloses a deployment method and device of a quantum key management system based on confidential computing, which is arranged in an operating system supporting confidential computing. Confidential computing is a technology that protects the security of data in use, which ensures that data is not exposed to an untrusted environment when it is processed. The core feature of confidential computing is to provide a secure environment, i.e., a secure space, in which calculations can be performed on sensitive data without worrying about the data being stolen or modified by an unauthorized third party when in use.

[0049] A secure space is a hardware or software implementation that provides an isolated execution space to protect the confidentiality and integrity of code and data, even in a host operating system that contains untrusted code. In contrast, a non-secure space is a normal, non-isolated computing environment, usually a standard operating system environment, which does not provide special security protections.

[0050] Currently, mainstream confidential computing technologies include Intel's Software Guard Extensions (SGX), AMD's Secure Encrypted Virtualization (SEV), and ARM's TrustZone.

[0051] SGX implements secure space by creating secure areas called enclaves. When communicating with non-secure space, SGX uses ECALL (call from non-secure space to enclave) and OCALL (call from enclave to non-secure space) functions. Data is encrypted before entering the enclave and decrypted when leaving the enclave to protect its confidentiality during communication.

[0052] SEV implements secure space by providing encrypted memory for each virtual machine (VM). The virtual machine monitor (VMM) or operating system acts as a non-secure space, which communicates with the encrypted VM (secure space) to ensure that the communication data will not be leaked even if the VMM is attacked. The communication mainly relies on secure inter-VM communication mechanism and encryption key management.

[0053] TrustZone divides the system into two worlds in hardware: secure space and non-secure space. The communication between them is carried out through secure monitor calls, which is a special processor mode used to perform context switching between secure space and non-secure space.

[0054] These confidential computing frameworks usually implement secure communication between the secure space and the non-secure space by designing dedicated communication protocols or APIs. In secure communication, data is encrypted and / or signed to ensure that sensitive information is not leaked even when data is transmitted in an insecure non-secure space. In this way, even if the non-secure space is compromised, confidential computing activities and data in the secure space are still protected.

[0055] The deployment method and device of the quantum key management system based on confidential computing provided by the present invention are applicable to all confidential computing environments and are not limited to the confidential computing types listed above.

[0056] The following are detailed descriptions of each.

[0057] Embodiment 1

[0058] See also Figure 1 , Figure 1 : is a flow chart of a method for deploying a quantum key management system based on confidential computing disclosed in an embodiment of the present invention. Figure 1 The deployment method of the quantum key management system based on confidential computing described above can be applied in an Intel SGX environment, an AMD SEV environment, or an ARM TrustZone environment, and the embodiments of the present invention do not limit this. Figure 1 As shown, the deployment method of the quantum key management system based on confidential computing may include the following operations:

[0059] 101. The password service management module sends a password management request to the communication module. The password service management module and the communication module are deployed in a non-secure space. The password management request includes a password request and a password operation type to be performed on the password request. The password operation type includes one or more of password generation, password update, password reading, password storage, and password deletion.

[0060] In an embodiment of the present invention, the requested password and the password operation type together constitute a password management request. When the password operation type is password generation, the requested password is empty; when the password operation type is password update, the requested password is the password to be updated; when the password operation type is password reading, the requested password is the password to be read; when the password operation type is password storage, the requested password is the password to be stored; when the password operation type is password deletion, the requested password is the password to be deleted.

[0061] In a password management request, one request password may correspond to multiple password request types, for example, one request password corresponds to a password update request and a password storage request; or one password management request may carry multiple request passwords, each request password corresponds to a respective password operation type, for example, one password management request carries a password deletion request with multiple request passwords. The present invention does not limit the data mode in the password management request.

[0062] 102. The communication module sends a password management request to the trusted password operation module;

[0063] 103. The trusted cryptographic operation module processes the password management request to obtain the target password. For the target password that needs to be stored, the target password is encrypted based on the predefined trusted encryption password and then updated in the memory, and the processing result of the password management request is sent to the cryptographic business management module through the communication module. The requested password is a password generated by the trusted cryptographic operation module based on the quantum random number. The trusted cryptographic operation module is deployed in a secure space, and the trusted encryption password is a password that can only be read in the secure space.

[0064] In an embodiment of the present invention, the target password refers to the password obtained by the trusted password operation module after processing the requested password based on the password operation type. For example, for a password deletion request, the target password is empty; for a password generation request, the target password is the password generated by the trusted password operation module.

[0065] In an embodiment of the present invention, quantum random numbers may be generated by a quantum random number generator deployed in a secure space, and the present invention does not impose any limitation thereto.

[0066] It can be seen that the present invention generates a request password through a quantum random number, which reduces the probability of the request password being cracked; places the operation of the request password in a secure space to prevent the request password from being monitored and tampered with by malware or a third party during the operation; and protects the target password based on a trusted encryption password that can only be read in a secure space to prevent the saved password from being stolen and cracked. The implementation of the present invention can reduce the probability of password leakage during generation, distribution, storage, and reading, thereby improving the security of the information protected by the password.

[0067] In an optional embodiment, before the trusted cryptographic operation module processes the cryptographic management request to obtain the target cryptographic key, the deployment method of the quantum key management system based on confidential computing further includes:

[0068] The trusted password operation module confirms whether the communication module has passed the identity authentication. If the identity authentication has been passed, the trusted password operation module is triggered to process the password management request to obtain the target password.

[0069] It can be seen that in this optional embodiment, the communication module is authenticated, and only the communication module that has passed the authentication can establish a trusted connection with the trusted cryptographic operation module, thereby reducing the possibility of unauthorized entities establishing a connection and accessing the password management function, and increasing the chance of password leakage during generation, distribution, storage, and reading, thereby improving the security of information protected by the password.

[0070] In another optional embodiment, the trusted cryptographic operation module confirms whether the communication module has passed the identity authentication, including:

[0071] The communication module sends the communication module signature to the trusted cryptographic operation module;

[0072] The trusted cryptographic operation module sends communication module verification information to the verification module and receives the identity authentication result returned by the verification module. When the identity authentication result is passed, the trusted cryptographic operation module confirms that the communication module has passed the identity authentication; when the identity authentication result is failed, the trusted cryptographic operation module confirms that the communication module has failed the identity authentication; the communication module verification information includes the communication module signature, and the verification module is deployed in a secure space.

[0073] It can be seen that in this optional embodiment, by introducing an independent verification module to verify the signature of the communication module, and performing verification and result transmission in a secure space, the security of the password management method is enhanced, ensuring that only the communication module that passes the signature verification can trigger the processing of the password management request, thereby improving the protection of the password, reducing the risk of illegal access, theft or tampering of the password, and further improving the security of the information protected by the password.

[0074] In another optional embodiment, the communication module signature includes identity verification information, and the identity verification information is a signature verification private key TSK. pri The encrypted communication module hash value is a value calculated by an executable file compiled by the communication module according to a predetermined signature hash function;

[0075] The communication module verification information also includes communication module identification information, and the communication module identification information is used to identify a communication module process in the network;

[0076] And, the way to determine the identity authentication result returned by the verification module, including:

[0077] The verification module verifies the public key TSK through the signature pub Decrypt the authentication information to obtain the communication module hash value and signature verification public key TSK pub and signature verification private key TSK pri is a pair of pre-generated asymmetric keys;

[0078] The verification module obtains the executable file of the communication module as the executable file to be verified through the communication module identification information, and operates the executable file to be verified based on a predetermined signature hash function to obtain a hash value of the communication module to be verified;

[0079] The verification module compares the hash value of the communication module with the hash value of the communication module to be verified to see if they are equal. When the judgment result is equal, the identity authentication result is verified; when the judgment result is unequal, the identity authentication result is failed to be verified.

[0080] It can be seen that in this optional embodiment, by introducing a signature verification method based on the hash value of the executable file to verify the integrity of the communication module, the probability of identity authentication information being tampered with or forged is reduced, and key verification operations are performed in a secure space, which further enhances the reliability of the identity authentication of the communication module and reduces the risk of illegal access, theft or tampering of the password, thereby improving the security of the information protected by the password.

[0081] In another optional embodiment, the trusted encryption password is obtained as follows:

[0082] A secure space root key and / or a secure boot key is read as an input key of a key derivation algorithm, a quantum random number is used as another input key of the key derivation algorithm, and a trusted encryption password is generated using the key derivation algorithm.

[0083] It can be seen that this optional embodiment utilizes the security properties of the root key and / or the secure boot key, the true randomness of the quantum random number, and the security of the key derivation algorithm, and performs the key derivation process in a secure space, thereby ensuring the confidentiality and integrity of the generated trusted encryption password, further enhancing the security of the password management method, reducing the risk of the password being guessed, predicted or stolen, and thereby improving the security of the information protected by the password.

[0084] In another optional embodiment, the communication module can support all communication methods between the secure space and the non-secure space before compilation, and after compilation, the communication module only supports the communication method between the secure space and the non-secure space corresponding to the compilation environment.

[0085] In this embodiment, the communication module supports all types of communications between secure spaces and non-secure spaces before compilation. After compilation, based on the secure space and non-secure space communication mode corresponding to the compilation environment, it only supports the secure space and non-secure space communication mode that matches the compilation environment.

[0086] The following combination Figure 2 The implementation of this optional embodiment is described by way of example:

[0087] Establish corresponding code templates and compilation file templates for all types of secure space and non-secure space communication methods. Figure 2 The trusted application code refers to the code corresponding to the trusted cryptographic operation module, the client proxy code refers to the code corresponding to the cryptographic business management module, the program integrity verification code refers to the code corresponding to the verification module, and the quantum key management business module corresponds to the control code corresponding to the quantum random number generator;

[0088] The compiler / script reads the secure boot key (SBK) of the processor chip in the compilation environment, obtains a quantum random number, generates a trusted encryption key (PSK) through a key derivation algorithm, and encrypts and saves the trusted encryption key with the SBK;

[0089] Compile the program / script to generate an asymmetric key: signature verification public key TSK pub and signature verification private key TSK pri , the signature verification private key TSK pri Symmetrically encrypted and saved with a trusted encryption password, signature verification public key TSK pub public;

[0090] Compile the program / script to generate remote procedure call (RPC) code, including RPC client stub, RPC server stub, and RPC Server code, which are used for process services between the trusted cryptographic operation module and the communication module. The RPC functions corresponding to various secure space and non-secure space communication types are as follows:

[0091] 1) For the communication between secure space and non-secure space of ARM TrustZone platform, the RPC code is empty;

[0092] 2) For the communication between the secure space and non-secure space of the Intel SGX platform, write secure space compilation flags and compilation files for the RPC client stub, RPC server stub, and RPC Server code, and introduce LibOS in the trusted execution environment so that the system functions it calls can run in the processor secure space;

[0093] 3) For the trusted execution environment and non-secure space communication mode of AMD SEV-SNP and Intel TDX platforms, fill the Socket server code and client code in RPC Server Stub and RPC Client Stub respectively;

[0094] The compiler / script generates new RPC code for the communication module, which is used for the communication module to communicate with the cryptographic business management module process;

[0095] The compiler reads the corresponding RPC code template according to the trusted execution environment and the non-secure space communication method corresponding to the compilation environment, generates the corresponding RPC code content, and compiles it into a code library;

[0096] The compiler / script compiles the source code of the trusted cryptographic operation module, the communication module and the verification module, and generates executable files TA, CAP and PIV accordingly. The executable file CAP of the communication module is compiled in a static linking manner to generate an independent executable file. The compiler can also call UPX to further compress the size of the executable file CAP of the communication module.

[0097] The compiler / script generates and fills JNI scripts for the RPC client code of the cryptographic business management module, which are used for Java calls of the cryptographic business system;

[0098] The compile program / script clears the source code of all modules.

[0099] It can be seen that this optional embodiment improves the security of the communication module, reduces the attack surface, improves the confidentiality of the password, and thereby improves the security of the information protected by the password by limiting the compiled communication module to only support the communication method between the secure space and the non-secure space corresponding to the compilation environment; and the same set of compilation mechanisms can cope with different types of trusted execution environments and non-secure space communication mechanisms, reducing maintenance costs and improving development efficiency.

[0100] In yet another optional embodiment, the specific implementation manner in which the communication module can support all communication modes between the secure space and the non-secure space before compilation includes:

[0101] When the communication between the secure space and the non-secure space is implemented by a built-in interface of the operating system, the communication module follows the interface requirements of the built-in interface to implement the communication between the secure space and the non-secure space, and the operating system refers to the operating system that provides the secure space and the non-secure space;

[0102] When the communication between the secure space and the non-secure space needs to cross the address space boundary, the communication module implements the communication between the secure space and the non-secure space through remote procedure calls;

[0103] When the communication between the secure space and the non-secure space is network-based communication, the communication module implements the communication between the secure space and the non-secure space through remote procedure calls.

[0104] It can be seen that in this optional embodiment, the communication module can support communication between all trusted execution environments and non-secure spaces in a variety of ways before compilation, including complying with built-in interface requirements, using remote procedure calls to cross address space boundaries, and network-based communication. By placing cryptographic operations in a secure executable environment, the security of the password is improved; and the communication methods between various trusted execution environments and non-secure spaces are isolated in the communication module, which limits security risks to a small range, facilitates security review and repair, and further improves the security protection capabilities of the password.

[0105] Embodiment 2

[0106] See also Figure 3 , Figure 3 : is a schematic diagram of a deployment device of a quantum key management system based on confidential computing disclosed in an embodiment of the present invention. Figure 3 The device shown needs to be deployed in an environment that supports confidential computing, and can be deployed in an Intel SGX environment, an AMD SEV environment, or an ARM TrustZone environment, which is not limited in the embodiments of the present invention. Figure 3 The device shown includes:

[0107] A cryptographic service management module 301, a communication module 302, and a trusted cryptographic operation module 303. The cryptographic service management module 301 and the communication module 302 are deployed in a non-secure space, and the trusted cryptographic operation module 303 is deployed in a secure space.

[0108] The password service management module 301 is used to send a password management request to the communication module 302, where the password management request includes a password request and a password operation type to be performed on the password request, where the password operation type includes one or more of password generation, password update, password reading, password storage, and password deletion;

[0109] The communication module 302 is used to send a password management request to the trusted password operation module 303;

[0110] The trusted password operation module 303 is used to process the password management request to obtain the target password. For the target password to be stored, the target password is encrypted based on the predefined trusted encryption password and then updated in the memory, and the processing result of the password management request is sent to the communication module 302. The request password is a password generated by the trusted password operation module based on the quantum number random generator, and the trusted encryption password is a password that can only be read in the secure space;

[0111] The communication module 302 is also used to send the processing results to the cryptographic service management module 301.

[0112] visible, Figure 3 The described device generates a request password through a quantum random number, thereby reducing the probability of the request password being cracked; places the operation of the request password in a secure space, thereby preventing the request password from being monitored and tampered with by malware or a third party during the operation; and protects the target password based on a trusted encryption password that can only be read in the secure space, thereby preventing the saved password from being stolen and cracked. The implementation of the present invention can reduce the probability of password leakage during generation, distribution, storage, and reading, thereby improving the security of information protected by the password.

[0113] In an optional embodiment, before processing the password management request to obtain the target password, the trusted password operation module 303 is also used to confirm whether the communication module 302 has passed the identity authentication. If the identity authentication is passed, the step of executing the trusted password operation module 303 to process the password management request to obtain the target password is triggered.

[0114] It can be seen that in this optional embodiment, the communication module 302 is authenticated, and only the communication module 302 that has passed the authentication can establish a trusted connection with the trusted password operation module 303, thereby reducing the possibility of unauthorized entities establishing a connection and accessing the password management function, and increasing the probability of password leakage during generation, distribution, storage, and reading, thereby improving the security of information protected by the password.

[0115] In another optional embodiment, Figure 4 As shown, the deployment device of the quantum key management system based on confidential computing also includes a verification module 304, and the specific method in which the trusted cryptographic operation module 303 confirms whether the communication module 302 passes the identity authentication includes:

[0116] The communication module 302 sends the communication module signature to the trusted cryptographic operation module 303;

[0117] The trusted cryptographic operation module 303 sends communication module verification information to the verification module 304, and receives the identity authentication result returned by the verification module 304. When the identity authentication result is passed, the trusted cryptographic operation module 303 confirms that the communication module 302 has passed the identity authentication; when the identity authentication result is failed, the trusted cryptographic operation module 303 confirms that the communication module 302 has failed the identity authentication; the communication module verification information includes the communication module signature, and the verification module 304 is deployed in a secure space.

[0118] It can be seen that in this optional embodiment, by introducing an independent verification module 304 to verify the signature of the communication module 302, and performing verification and result transmission in a secure space, the security of the password management method is enhanced, ensuring that only the communication module 302 that has passed the signature verification can trigger the processing of the password management request, thereby improving the protection of the password, reducing the risk of illegal access, theft or tampering of the password, and further improving the security of the information protected by the password.

[0119] In another optional embodiment, the communication module signature includes identity verification information, and the identity verification information is a signature verification private key TSK. pri The encrypted communication module hash value is a value calculated by an executable file compiled by the communication module according to a predetermined signature hash function;

[0120] The communication module verification information also includes communication module identification information, and the communication module identification information is used to identify a communication module process in the network;

[0121] And, the method for determining the identity authentication result returned by the verification module 304 includes:

[0122] Verification module 304 verifies public key TSK through signature pub Decrypt the authentication information to obtain the communication module hash value and signature verification public key TSK pub and signature verification private key TSK pri is a pair of pre-generated asymmetric keys;

[0123] The verification module 304 obtains the executable file of the communication module 302 as the executable file to be verified through the communication module identification information, and operates the executable file to be verified based on a predetermined signature hash function to obtain a hash value of the communication module to be verified;

[0124] The verification module 304 compares the communication module hash value with the communication module hash value to be verified to see if they are equal. If the judgment result is equal, the identity authentication result is verified; if the judgment result is not equal, the identity authentication result is not verified.

[0125] It can be seen that in this optional embodiment, by introducing a signature verification method based on the hash value of the executable file to verify the integrity of the communication module, the probability of identity authentication information being tampered with or forged is reduced, and key verification operations are performed in a secure space, which further enhances the reliability of the identity authentication of the communication module and reduces the risk of illegal access, theft or tampering of the password, thereby improving the security of the information protected by the password.

[0126] In another optional embodiment, the trusted encryption password is obtained as follows:

[0127] A secure space root key and / or a secure boot key is read as an input key of a key derivation algorithm, a quantum random number is used as another input key of the key derivation algorithm, and a trusted encryption password is generated using the key derivation algorithm.

[0128] It can be seen that this optional embodiment utilizes the security properties of the root key and / or the secure boot key, the true randomness of the quantum random number, and the security of the key derivation algorithm, and performs the key derivation process in a secure space, thereby ensuring the confidentiality and integrity of the generated trusted encryption password, further enhancing the security of the password management method, reducing the risk of the password being guessed, predicted or stolen, and thereby improving the security of the information protected by the password.

[0129] In another optional embodiment, the communication module 302 can support all communication methods between secure spaces and non-secure spaces before compilation, and the communication module 302 only supports the communication methods between secure spaces and non-secure spaces corresponding to the compilation environment after compilation.

[0130] It can be seen that this optional embodiment improves the security of the communication module, reduces the attack surface, improves the confidentiality of the password, and thereby improves the security of the information protected by the password by limiting the compiled communication module to only support the communication method between the secure space and the non-secure space corresponding to the compilation environment; and the same set of compilation mechanisms can cope with different types of trusted execution environments and non-secure space communication mechanisms, reducing maintenance costs and improving development efficiency.

[0131] In yet another optional embodiment, the specific implementation manner in which the communication module 302 can support all communication modes between the secure space and the non-secure space before compilation includes:

[0132] When the communication between the secure space and the non-secure space is implemented by a built-in interface of the operating system, the communication module follows the interface requirements of the built-in interface to implement the communication between the secure space and the non-secure space, and the operating system refers to the operating system that provides the secure space and the non-secure space;

[0133] When the communication between the secure space and the non-secure space needs to cross the address space boundary, the communication module implements the communication between the secure space and the non-secure space through remote procedure calls;

[0134] When the communication between the secure space and the non-secure space is network-based communication, the communication module implements the communication between the secure space and the non-secure space through remote procedure calls.

[0135] It can be seen that in this optional embodiment, the communication module can support communication between all trusted execution environments and non-secure spaces in a variety of ways before compilation, including complying with built-in interface requirements, using remote procedure calls to cross address space boundaries, and network-based communication. By placing cryptographic operations in a secure executable environment, the security of the password is improved; and the communication methods between various trusted execution environments and non-secure spaces are isolated in the communication module, which limits security risks to a small range, facilitates security review and repair, and further improves the security protection capabilities of the password.

[0136] Embodiment 3

[0137] See also Figure 5 , Figure 5 FIG. 1 is a schematic diagram of a structure of another deployment device of a quantum key management system based on confidential computing disclosed in an embodiment of the present invention. Figure 5 As shown, the deployment device of the quantum key management system based on confidential computing may include:

[0138] A memory 501 storing executable program codes;

[0139] a processor 502 coupled to the memory 501;

[0140] Furthermore, it may also include an input interface 503 and an output interface 504 coupled to the processor 502;

[0141] The processor 502 calls the executable program code stored in the memory 501 to execute the steps in the deployment method of the quantum key management system based on confidential computing described in the first embodiment of the present invention.

[0142] Embodiment 4

[0143] An embodiment of the present invention discloses a computer storage medium, which stores computer instructions. When the computer instructions are called, they are used to execute the steps in the deployment method of the quantum key management system based on confidential computing described in Embodiment 1 or Embodiment 2 of the present invention.

[0144] Embodiment 5

[0145] An embodiment of the present invention discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to enable a computer to execute the steps in the deployment method of a quantum key management system based on confidential computing described in Embodiment 1.

[0146] The device embodiments described above are only illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, i.e., they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

[0147] Through the specific description of the above embodiments, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the above technical solution can be essentially or partly contributed to the prior art in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable rewritable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, a magnetic disk storage, a magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0148] Finally, it should be noted that the deployment method and device of a quantum key management system based on confidential computing disclosed in the embodiment of the present invention discloses only a preferred embodiment of the present invention, which is only used to illustrate the technical solution of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, it should be understood by those skilled in the art that the technical solutions described in the aforementioned embodiments can still be modified, or some of the technical features therein can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A deployment method for a quantum key management system based on confidential computing, characterized in that: The method comprises: The password service management module sends a password management request to the communication module, the password service management module and the communication module are deployed in a non-secure space, the password management request includes a password request and a password operation type performed on the password request, the password operation type includes one or more of password generation, password update, password reading, password storage, and password deletion; The communication module sends the password management request to the trusted password operation module; The trusted cryptographic operation module processes the requested password according to the cryptographic operation type in the password management request to obtain a target password, wherein the requested password is a password generated by the trusted cryptographic operation module based on a quantum random number; For the target password that needs to be stored, the target password is encrypted based on a predefined trusted encryption password and then updated in the memory, and the processing result of the password management request is sent to the password business management module through the communication module. The trusted password operation module is deployed in a secure space, and the trusted encryption password is a password that can only be read in a secure space.

2. The method for deploying a quantum key management system based on confidential computing according to claim 1, characterized in that: Before the trusted password operation module processes the password management request to obtain the target password, the method further includes: The trusted password operation module confirms whether the communication module has passed the identity authentication. If the identity authentication has been passed, the trusted password operation module is triggered to execute the step of processing the password management request to obtain the target password.

3. The method for deploying a quantum key management system based on confidential computing according to claim 2, characterized in that: The trusted password operation module confirms whether the communication module passes the identity authentication, including: The communication module sends a communication module signature to the trusted cryptographic operation module; The trusted cryptographic operation module sends communication module verification information to the verification module, and receives the identity authentication result returned by the verification module. When the identity authentication result is passed, the trusted cryptographic operation module confirms that the communication module has passed the identity authentication; when the identity authentication result is failed, the trusted cryptographic operation module confirms that the communication module has failed the identity authentication; the communication module verification information includes the communication module signature, and the verification module is deployed in a secure space.

4. The method for deploying a quantum key management system based on confidential computing according to claim 3, characterized in that: The communication module signature includes identity verification information, and the identity verification information is a signature verification private key. An encrypted communication module hash value, wherein the communication module hash value is a value calculated by an executable file compiled by the communication module according to a predetermined signature hash function; The communication module verification information also includes communication module identification information, and the communication module identification information is used to identify a communication module process in the network; And, the method for determining the identity authentication result returned by the verification module includes: The verification module verifies the public key by signing Decrypt the identity verification information to obtain the communication module hash value and the signature verification public key and the signature verification private key is a pair of pre-generated asymmetric keys; The verification module obtains the executable file of the communication module as the executable file to be verified through the communication module identification information, and operates the executable file to be verified based on the predetermined signature hash function to obtain a hash value of the communication module to be verified; The verification module compares the hash value of the communication module with the hash value of the communication module to be verified to see if they are equal. When the judgment result is equal, the identity authentication result is verified; when the judgment result is unequal, the identity authentication result is verified unsuccessfully.

5. The method for deploying a quantum key management system based on confidential computing according to any one of claims 1 to 4, characterized in that: The method for obtaining the trusted encryption password is: The secure space root key and / or the secure boot key are read as an input key of a key derivation algorithm, and a trusted encryption password is generated using the key derivation algorithm based on the quantum random number as another input key of the key derivation algorithm.

6. The method for deploying a quantum key management system based on confidential computing according to claim 5, characterized in that: The communication module can support all communication modes between the secure space and the non-secure space before compilation, and the communication module only supports the communication mode between the secure space and the non-secure space corresponding to the compilation environment after compilation.

7. The method for deploying a quantum key management system based on confidential computing according to claim 6, characterized in that: The specific implementation method of the communication module being able to support all communication modes between the secure space and the non-secure space before compilation includes: When the communication between the secure space and the non-secure space is implemented by a built-in interface of the operating system, the communication module implements the communication between the secure space and the non-secure space in accordance with the interface requirements of the built-in interface, and the operating system refers to an operating system that provides the secure space and the non-secure space; When communication between the secure space and the non-secure space needs to cross the address space boundary, the communication module implements communication between the secure space and the non-secure space through remote procedure calls; When the communication between the secure space and the non-secure space is network-based communication, the communication module implements the communication between the secure space and the non-secure space through remote procedure calls.

8. A deployment device for a quantum key management system based on confidential computing, characterized in that: The device comprises: a cryptographic service management module, a communication module, and a trusted cryptographic operation module, wherein the cryptographic service management module and the communication module are deployed in a non-secure space, and the trusted cryptographic operation module is deployed in a secure space; The password service management module is used to send a password management request to the communication module, wherein the password management request includes a password request and a password operation type to be performed for the password request, wherein the password operation type includes one or more of password generation, password update, password reading, password storage, and password deletion; The communication module is used to send the password management request to the trusted password operation module; The trusted cryptographic operation module is used to process the requested password according to the cryptographic operation type in the password management request to obtain a target password, wherein the requested password is a password generated by the trusted cryptographic operation module based on quantum random numbers; Furthermore, the trusted password operation module is further used to encrypt the target password to be stored based on a predefined trusted encryption password and then update it in the memory, and send the processing result of the password management request to the communication module, wherein the trusted encryption password is a password that can only be read in the secure space; The communication module is also used to send the processing result to the cryptographic service management module.

9. A deployment device for a quantum key management system based on confidential computing, characterized in that: The device comprises: A memory storing executable program code; a processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the deployment method of the quantum key management system based on confidential computing as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that: The computer storage medium stores computer instructions, which, when called, are used to execute the deployment method of the quantum key management system based on confidential computing as described in any one of claims 1 to 7.

Images