Method and system for communication between terminal and cloud server

Abstract

The invention provides a communication method and system for a terminal and a cloud server, and the method comprises the steps: the terminal configures an agent client, sets an agent parameter at the agent client, starts an agent, and enters a first communication mode, and the agent parameter comprises a local agent port; in the first communication mode, the terminal applies for a service key from a cloud server, and if the service key is successfully acquired, the terminal is allowed to enter a cloud computer interface; wherein the service key is used for encrypting or decrypting a cloud resource service flow packet transmitted by the local agent port. A terminal proxy client is set to start a proxy, a secure communication mode between a terminal and a cloud server is entered, and a cloud resource service flow packet is encrypted by using service keys held at two ends, so that cloud resources are prevented from being intercepted, leaked and tampered in transmission, and office security is protected; encryption at a flow layer is realized through an agent, the execution efficiency is high, encryption and decryption are implemented by combining a symmetric cryptographic algorithm with a high encryption and decryption processing rate, so that the processing capability and the response speed of the whole system are extremely high, and non-inductive secure acquisition of cloud resources is realized; encryption is carried out on the flow layer, and compared with a service layer, keys can be saved; the terminal is set to obtain the service key and enter the cloud computer interface, so that unauthorized users or hostile attackers are prevented from operating the cloud computer, and the system security is improved.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a method and system for communicating between a terminal and a cloud server. Background Art

[0002] With cloud services, enterprises do not need to purchase and maintain a large number of servers, storage devices and other IT infrastructure, which greatly reduces hardware costs. It also supports remote collaboration and real-time sharing, allowing team members to access and share data anytime and anywhere, promoting team collaboration, and becoming the first choice for many enterprises for low-cost and high-efficiency office facilities.

[0003] In the prior art, cloud servers and cloud terminals do not encrypt data when transmitting data on the public network, making the data easy to be intercepted and parsed. Attackers can easily obtain sensitive information, causing the risk of data leakage. In addition, during the plain text transmission process, the data may be tampered with or damaged, causing the recipient to receive incorrect information, resulting in office errors. Summary of the invention

[0004] The present invention provides a method for communicating between a terminal and a cloud server. By turning on a terminal agent to enter a confidential communication mode, a business key is used to encrypt a cloud resource business flow packet to prevent cloud resources from being intercepted, leaked, or tampered with during transmission, thereby protecting office security.

[0005] According to a first aspect of the present invention, a method for communicating between a terminal and a cloud server is provided, comprising: configuring a proxy client on the terminal, setting proxy parameters on the proxy client to enable the proxy, and entering a first communication mode, wherein the proxy parameters include a local proxy port; in the first communication mode, the terminal applies for a business key from the cloud server, and upon successful acquisition of the business key, the terminal is allowed to enter a cloud computer interface; wherein the business key is used to encrypt or decrypt cloud resource business traffic packets transmitted by the local proxy port.

[0006] Furthermore, the cloud resource business traffic data at a preset time interval of the local proxy port is assembled with the target address to form the cloud resource business traffic packet; the cloud service end includes a quantum gateway, the proxy parameters also include a gateway proxy address, and the cloud resource business traffic packet ciphertext and the gateway proxy address are packaged and sent to the quantum gateway.

[0007] Furthermore, before the terminal applies for a business key from the cloud service end, it first connects to the quantum key management system to obtain a session key; the terminal forms the business key application and sends it to the quantum gateway, the quantum gateway applies for the session key from the quantum key management system, and uses the session key to encrypt the business key and send it down; the terminal uses the session key on its side to decrypt and obtain the business key.

[0008] Furthermore, before the terminal obtains the session key, it applies for identity authentication from the quantum gateway to obtain a session identifier; the terminal and the quantum gateway both carry the session identifier when applying for the session key from the quantum key management system.

[0009] Furthermore, the terminal has a built-in first security medium and applies for identity authentication to the quantum gateway, including: the first security medium generates an SM2 public-private key pair, uses the SM2 private key to sign the first security medium ID, and the signature information and the SM2 public key are sent to the quantum gateway; the quantum gateway uses the SM2 public key to verify the signature, generates a session identifier, calculates the session identifier hash value, and also uses the SM2 public key to encrypt the session identifier, and returns it to the terminal together with the session identifier hash value; the terminal uses the SM2 private key to decrypt and obtain the session identifier, verifies that the session identifier hash value is consistent with the returned one, and then saves the session identifier.

[0010] Furthermore, before applying for identity authentication from the quantum gateway, the terminal applies for network access authentication from the quantum key management system to obtain a network access token and a network access key, where the network access key is used to encrypt the session key; the terminal applies for the session key to carry the network access token.

[0011] Furthermore, before the first security medium is applied, it connects to the quantum key management system to obtain the injection key; when the terminal applies for network access authentication to the quantum key management system, it forms a first key based on the injection key, at least encrypts the local account carried, and sends it to the quantum key management system as a package with the first security medium ID and the first key handle; the quantum key management system forms the first key based on plaintext parameters, decrypts to obtain the local account, and verifies the binding relationship between the local account and the first security medium ID; if the binding relationship is correct, the quantum key management system forms the network access key and the network access token, uses the first key to at least encrypt the network access key, and returns it to the terminal; the terminal uses the first key on its side to decrypt and obtain the network access key.

[0012] Furthermore, the first security medium is pre-set with a PIN code; before the terminal applies for network access authentication to the quantum key management system, the terminal enters the PIN code in the proxy client, calculates the input PIN code hash value and sends it to the first security medium, and compares it with the preset PIN code hash value; if they are consistent, the terminal is allowed to communicate and connect to the quantum key management system.

[0013] Furthermore, the terminal applies for the business key to carry at least the first security medium ID, the local account, and the session identification hash value; the quantum gateway verifies that the session identification hash value sent is consistent with that held by this side, forms the business key, establishes a corresponding relationship between the business key and the local account and the first security medium, and uses the session key on this side to encrypt and send it to the terminal.

[0014] Furthermore, the terminal decrypts and obtains the business key, clears the session key temporary storage area, and instructs the quantum gateway to clear the session key temporary storage area.

[0015] Furthermore, the quantum gateway is powered on and applies to the quantum key management system for network access authentication, and re-applies at preset intervals.

[0016] Furthermore, after entering the cloud computer interface, the first security medium cannot be unbound.

[0017] Furthermore, the quantum gateway has a built-in second security medium, which is connected to the quantum key management system to obtain an injection key before use, and the business key is formed based on the injection key; or, the quantum gateway is securely connected to a quantum random number generator, and the business key is formed based on the quantum random number generated by the quantum random number generator.

[0018] In a second aspect of the present invention, a terminal and cloud server communication system is provided, comprising a terminal, a cloud server, a quantum secret management system, and a quantum gateway, wherein the quantum gateway is securely connected to the cloud server, the terminal has a built-in first security medium, the quantum gateway has a built-in second security medium, the terminal is configured with a proxy client, and the quantum gateway is configured with a proxy server;

[0019] Entering a PIN code on the terminal proxy client and comparing it with the hash value of the PIN code built into the first security medium to verify the authority;

[0020] After the authority verification is passed, the terminal applies to the quantum key management system for network access authentication and obtains a network access token and a network access key, wherein the first secure medium is used to inject the key to at least encrypt the local account number carried in the network access authentication, and the quantum key management system uses the first secure medium to inject the key to at least encrypt the network access key and issue it;

[0021] The terminal applies for identity authentication from the quantum gateway to obtain a session identifier;

[0022] The terminal carries the session identifier and applies for a session key from the quantum key management system, wherein the session identifier is used

[0023] The network access key at least encrypts the session identifier, and the quantum key management system uses the network access key to at least encrypt the session key and sends it;

[0024] The terminal applies for a service key from the quantum gateway, and the quantum gateway carries the session key

[0025] Applying for the session key from the quantum key management system, and encrypting the service key with the session key and issuing it, wherein the service key is formed based on the quantum key injected by the second security medium;

[0026] The terminal decrypts and obtains the service key, and uses the service key to encrypt or decrypt the cloud resource service traffic packet transmitted by the proxy port set by the proxy client.

[0027] The beneficial effects of the present invention include at least:

[0028] (1) The present invention sets a terminal proxy client to start the proxy, enters a confidential communication mode between the terminal and the cloud service end, and uses the business keys held by both ends to encrypt cloud resource business traffic packets, thereby preventing cloud resources from being intercepted, leaked, or tampered with during transmission, thereby protecting office security; encryption is implemented at the traffic layer through the proxy, with high execution efficiency, and encryption and decryption are implemented in combination with a symmetric encryption algorithm with a fast encryption and decryption processing rate, so that the processing capacity and response speed of the overall system are extremely fast, and cloud resources can be obtained securely without feeling; encryption is implemented at the traffic layer, which can save keys compared to the business layer; the terminal is set to obtain the business key before entering the cloud computer interface, thereby preventing unauthorized users or malicious attackers from operating the cloud computer, thereby improving system security.

[0029] (2) The present invention forwards the request of the terminal through a proxy, so that the real port of the terminal and the real IP of the communication counterpart are hidden, thereby preventing a third party from tracking and monitoring the terminal.

[0030] (3) The present invention realizes two communication modes by setting the proxy on and off, meeting the user's multi-scenario needs.

[0031] (4) The present invention compares the input PIN code hash value with the preset PIN code hash value before the terminal communicates with the quantum secret management system, thereby ensuring that the user has the authority and preventing the terminal from being illegally operated, provided that the PIN code has not been tampered with.

[0032] (5) The present invention utilizes the built-in charging key of the first security medium and the charging key on the quantum key management system side to encrypt the key data of the network access authentication application and the returned network access key, thereby protecting the security of the network access key issuance, thereby providing guarantee for the acquisition of session keys and business keys, and further protecting cloud resources.

[0033] (6) The present invention performs identity authentication on the terminal before distributing the service key to the terminal, filters illegal access, and realizes that both ends of the communication hold session identifiers, laying the foundation for both ends to obtain the same session key.

[0034] (7) The present invention uses the truly random session key distributed by the quantum key management system to encrypt the business key and issue it, thereby preventing the business key from being stolen and protecting cloud resources.

[0035] (8) The present invention destroys the session key after its application is completed to prevent it from being used by attackers to decrypt and steal the business key, and also simplifies key management.

[0036] (9) The present invention is configured such that after entering the cloud computer interface, the first security medium cannot be unbound, thereby avoiding the business communication process between the terminal and the cloud service end, and cloud resources cannot be decrypted in the terminal and acquisition fails. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0038] Figure 1 It is a schematic diagram of a communication method between a terminal and a cloud service end in one embodiment of the present invention. DETAILED DESCRIPTION

[0039] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0041] Unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in the embodiments of the present application are used to distinguish multiple objects and are not used to limit the order, timing, priority or importance of the multiple objects.

[0042] In a first aspect of the present invention, Figure 1As shown, a method for communicating between a terminal and a cloud server is provided. The cloud server provides an operating system, application software, computing resources, storage resources, etc., and presents the corresponding cloud resource image (including desktop environment, application program, data, etc.) to the terminal according to the needs and configuration of the user. The terminal can be a thin terminal or an ordinary computer device. The communication between the terminal and the cloud server of the present invention involves two communication modes, namely, a confidential communication mode and a common communication mode. In the confidential communication mode, the two transmit cloud resource business data in ciphertext, such as cloud resource application data or issued cloud resource image data, which are encrypted by a key; in the common communication mode, the two transmit cloud resource business data in plaintext. The method includes: the terminal configures a proxy client, sets proxy parameters in the proxy client to start the proxy, and enters a first communication mode, wherein the proxy parameters include a local proxy port; in the first communication mode, the terminal applies for a business key from the cloud server, and the business key is successfully obtained, allowing the terminal to enter the cloud computer interface; wherein the business key is used to encrypt or decrypt the cloud resource business traffic packet transmitted by the local proxy port.

[0043] Specifically, the terminal of the present invention is installed with a proxy client, and the user can set proxy parameters in the proxy client, such as setting the local proxy port, target address, and gateway proxy address. The target address is the device address that the terminal actually accesses and obtains resources. In the present invention, the target address is the cloud server address, and the gateway proxy address points to the network address of the communication counterpart. After the setting is completed, the proxy is turned on, and the terminal and the cloud server enter the first communication mode, that is, the confidential communication mode. In the confidential communication mode, the terminal applies for a business key from the cloud server, and the cloud server returns the business key to it based on the terminal request. The terminal successfully obtains the business key and clicks the cloud computer icon to enter the cloud computer interface. The terminal peripherals can be operated in this interface to obtain the cloud resources of the cloud server. If the business key fails to be obtained, the terminal is not allowed to enter the cloud computer interface, and it cannot be entered by clicking the cloud computer icon. The business key is used to encrypt the cloud resource business traffic packet transmitted from the local proxy port of the terminal, or to decrypt the cloud resource business traffic packet transmitted from the local proxy port. In other words, the data encryption and decryption of the present invention is based on the flow data packets formed by the proxy port at a certain time interval, not on the business level. In the encryption method based on the operation action, keyboard operations and mouse operations in a smaller interval need to be encrypted separately. For the encryption method based on the port flow packet, it only needs to be encrypted once and consumes a key. The terminal uses the business key to encrypt the cloud resource business flow packet output by the local proxy port within the preset interval and sends it to the cloud service end. The cloud service end uses the business key on this side to decrypt and obtain the cloud resource business, configure the relevant cloud resource image, and then uses the business key on this side to encrypt the cloud resource business flow packet formed by the cloud resource image output by the proxy port on this side at the preset interval and returns it to the terminal. The terminal uses the business key on this side to decrypt the cloud resource business flow packet and obtain the cloud resource image. It should be noted that the use of the business key to encrypt data adopts a symmetric encryption algorithm, and the decryption key is the same as the encryption key.

[0044] The present invention starts the proxy by setting the terminal proxy client, enters the confidential communication mode between the terminal and the cloud service end, and uses the business keys held by both ends to encrypt the cloud resource business traffic packets, so as to prevent the cloud resources from being intercepted, leaked, and tampered during transmission, thereby protecting office security; the proxy is used to implement encryption at the traffic layer, which has high execution efficiency, and is combined with the use of a symmetric encryption algorithm with a fast encryption and decryption processing rate to implement encryption and decryption, so that the processing capacity and response speed of the overall system are extremely fast, and cloud resources can be obtained safely without feeling; encryption is implemented at the traffic layer, which can save keys compared to the business layer; the terminal is set to obtain the business key before entering the cloud computer interface, so as to prevent unauthorized users or malicious attackers from operating the cloud computer, thereby improving system security.

[0045] In one embodiment of the present invention, the cloud service end includes a cloud server and a quantum gateway in communication connection, and the two are connected by a local area network or a wired connection, so that the transmission between the two is stable, reliable and efficient. The quantum gateway processes the terminal request and also forwards the cloud resources on the cloud server to the terminal. The quantum gateway is also configured with a service client, which can set the local proxy port, the target address, and the terminal proxy address. The cloud resource business flow data of the local proxy port at a preset time interval on the terminal side is assembled with the target address to form a cloud resource business flow packet. The target address in this communication is the cloud server address, and the gateway proxy address points to the network address of the quantum gateway device. The business key encrypts the cloud resource business flow packet to obtain the cloud resource business flow packet ciphertext. The terminal sends the cloud resource business flow packet ciphertext and the gateway proxy address set when the proxy is turned on to the quantum gateway. The quantum gateway uses the business key on this side to decrypt, obtain the target address, and forward the cloud resource business flow data to the target address device, that is, the cloud server. When the cloud server transmits cloud resource business data to the terminal, the data is transmitted to the quantum gateway, assembled with the target address set by the quantum gateway service client, that is, the actual address of the terminal, encrypted with the business key on the quantum gateway side, and sent to the terminal device pointed to by the terminal proxy address.

[0046] The target address of the present invention is transmitted in encrypted form, reducing the risk of terminal users being located, tracked or attacked; that is, the present invention implements double encryption of business data and target address, achieving better privacy protection and higher communication security.

[0047] In one embodiment of the present invention, the quantum gateway has a built-in second security medium, which is connected to the quantum key management system to obtain a charging key before use, and the business key is formed based on the charging key; or, the quantum gateway is securely connected to a quantum random number generator, and the business key is formed based on the quantum random number generated by the quantum random number generator.

[0048] Specifically, the business key of the present invention includes two ways of formation. In one case, the second security medium is installed before the quantum gateway, and is connected to the quantum key management system to obtain the injection key. The quantum key management system records the corresponding relationship between the injection key and the second security medium ID. The quantum key management system has a quantum random number generation module, which can generate a truly random quantum random number to form a quantum key, which is injected into the security medium of the present invention, or sent to a terminal or a quantum gateway. In another case, the quantum gateway is wired or connected to a quantum random number generator on a local area network, and the quantum random number generator transmits the generated quantum random number to the quantum gateway to form an injection key. Therefore, the injection key is essentially a truly random quantum key, and the business key formed based on the injection key also has a truly random characteristic. This ensures that under a symmetric cryptographic algorithm, data encrypted using a business key is difficult to decipher.

[0049] In one embodiment of the present invention, when the proxy is set to off on the proxy client, the second communication mode, i.e., the normal communication mode, is entered, and the cloud resource business data transmission between the terminal and the cloud service end is in plain text. When the proxy is set to off, the cloud computer interface can be entered by clicking the cloud computer icon on the proxy client, and there is no proxy port listening for data transmission. The terminal peripherals are operated to form a cloud resource request, which is transmitted in plain text to the quantum gateway and forwarded to the cloud server via the quantum gateway. The cloud server configures the relevant cloud resource image and returns it to the terminal via the quantum gateway. This embodiment is suitable for scenarios where cloud resources are not confidential. The present invention realizes two communication modes by setting the proxy on and off to meet the user's multi-scenario needs.

[0050] In the present invention, before the terminal communicates with the cloud service end, that is, before transmitting the cloud resource business traffic data packet, the terminal user authority is first verified. After the verification is passed, the terminal applies for network access authentication to the quantum key management system to obtain a network access token and a network access key; then applies for identity authentication to the quantum gateway to obtain a session identifier; then applies for a session key to the quantum key management system with the session identifier, and uses the network access key to protect the application and issuance of the session key; the quantum gateway receives the business key application, applies for the same session key to the quantum key management system with the session identifier, encrypts the business key with the session key and sends it to the terminal, and the terminal uses the local session key to decrypt and obtain the business key.

[0051] In one embodiment of the present invention, the terminal has a built-in first security medium, and the first security medium is pre-set with a PIN code, such as a PIN code written in the factory; before the terminal communicates with the cloud service end, specifically before the terminal applies for network access authentication to the quantum key management system, the user enters the PIN code in the proxy client, and the terminal calculates the input PIN code hash value in a cache area and sends it to the first security medium. The first security medium uses the same hash algorithm as the terminal to calculate the preset PIN code hash value, and compares the sent input PIN code hash value with the preset PIN code hash value; if they are consistent, the terminal used is allowed to communicate and connect to the quantum key management system, and further obtain related keys, such as obtaining the network access key and the session key. The present invention ensures that the user has authority and avoids illegal operation of the terminal by comparing the input PIN code hash value with the preset PIN code hash value before the terminal communicates with the quantum key management system, ensuring that the PIN code has not been tampered with.

[0052] In one embodiment of the present invention, before applying for identity authentication to the quantum gateway, specifically after entering the PIN code to verify that the user has the authority, the terminal applies to the quantum key management system for network access authentication, obtains a network access token and a network access key, and the network access key is used to encrypt the session key to prevent key data in the session key application process from being stolen or tampered with; the terminal applies for the session key carrying the network access token for authentication.

[0053] In a further embodiment of the present invention, the terminal has a built-in first security medium, and the first security medium is connected to the quantum key management system to obtain a charging key before application; when the terminal applies for network access authentication to the quantum key management system, a first key is formed based on the charging key, at least the local account carried is encrypted, and the first security medium ID and the first key handle are grouped and sent to the quantum key management system; the quantum key management system forms the first key based on plaintext parameters, decrypts to obtain the local account, and verifies the binding relationship between the local account and the first security medium ID; if the binding relationship is correct, the quantum key management system forms the network access key and the network access token, uses the first key to at least encrypt the network access key, and returns it to the terminal; the terminal uses the first key on its side to decrypt and obtain the network access key.

[0054] Specifically, before the first security medium is used, such as when it leaves the factory, or before it is used in the confidential communication of the present invention, the quantum key management system is connected to obtain the charging key, and the quantum key management system records the corresponding relationship between the charging key and the first security medium ID. It should be noted that the charging key, network access key, and session key issued by the quantum key management system of the present invention are all truly random quantum keys. After the terminal verifies the user's authority, it applies to the quantum key management system for network access authentication, which is specifically implemented as follows: the terminal randomly generates a first key handle, locates and intercepts relevant data from the charging key to form a first key, and uses the first key to encrypt at least the local account, which is the unique identifier of the terminal. The encrypted local account is packaged with plaintext parameters to form a network access authentication application, which is sent to the quantum key management system. The plaintext parameters include the first security medium ID and the first key handle. It can be understood that the first key handle indicates that the first key is formed at the starting position of the charging key data. The quantum key management system receives the network access authentication application sent by the terminal, forms the first key based on the plaintext parameters, that is, corresponds to the injection key on this side based on the first security medium ID, forms the first key based on the first key handle positioning, uses the first key to decrypt and obtain the local account, and verifies the binding relationship between the local account and the security medium ID. It can be understood that the first key formed on the quantum key management system side is the same as the first key on the terminal side. It should be noted that when the terminal with the first security medium built-in is authenticated for the first time, the quantum key management system queries the first security medium for no binding information, then binds the first security medium to the local account, and the subsequent terminal authenticates again, and the binding relationship between the local account and the first security medium ID needs to be verified. In this way, it is ensured that the terminal and the security medium are uniquely corresponding to each other before they can access the quantum key management system, effectively preventing hackers from trying to access the quantum key management system by forging media, thereby protecting the key security of the quantum key management system. If the binding relationship is correct, the quantum key management system forms a network access key and a network access token, and can also form a network access key ID associated with the network access key. The first key formed on this side is used to at least encrypt the network access key, and the network access key ID can also be encrypted at the same time. The encrypted network access key and the encrypted network access key ID are packaged with the network access token, the first security medium ID, and the first key handle to form a network access authentication response and return it to the terminal. The terminal receives the network access authentication response, obtains the network access token, and forms a first key based on the first security medium ID and the first key handle, and uses the first key to decrypt and obtain the network access key and the network access key ID. The present invention uses the built-in injection key of the first security medium and the injection key on the quantum key management system side to encrypt the key data of the network access authentication application and the returned network access key, and protects the security of the issuance of the network access key, thereby providing guarantees for the acquisition of session keys and business keys, and further protecting cloud resources.

[0055] In one embodiment of the present invention, before the terminal obtains the session key, it applies for identity authentication from the quantum gateway to obtain a session identifier; the terminal and the quantum gateway both carry the session identifier when applying for the session key from the quantum key management system.

[0056] Specifically, the terminal obtains the network access token, that is, it applies for identity authentication to the quantum gateway. After the identity authentication is passed, the quantum gateway agrees to establish a session with the terminal and returns a session identifier to the terminal. The terminal carries the session identifier to apply to the quantum key management system for a session key, and then applies to the quantum gateway for a business key. The quantum gateway receives the business key application and carries the session identifier to apply to the quantum key management system for a session key. It can be understood that the same session identifier obtains the same session key in the quantum key management system. Therefore, the data encrypted by the quantum gateway using the session key can be decrypted again on the terminal side using the session key. The present invention authenticates the terminal before distributing the business key to the terminal, filters illegal access, and realizes that both ends of the communication hold a session identifier, laying the foundation for both ends to obtain the same session key.

[0057] In a further embodiment of the present invention, the terminal applies for identity authentication to the quantum gateway as follows: the first security medium generates an SM2 public-private key pair, including an SM2 public key and an SM2 private key, and uses the SM2 private key to sign the first security medium ID. The signature information and the SM2 public key are sent to the quantum gateway, and the first security medium ID is also sent to the quantum gateway; the quantum gateway uses the SM2 public key to verify the signature, generates a session identifier, calculates the session identifier hash value, and also uses the SM2 public key to encrypt the session identifier, and returns it to the terminal together with the session identifier hash value; the terminal uses the SM2 private key to decrypt and obtain the session identifier, and uses the same hash algorithm as the quantum gateway to calculate the decrypted session identifier hash value, and the hash algorithm can use the SM3 algorithm. Verify that the session identifier hash value is consistent with the one returned by the quantum gateway, and then save the session identifier. The present invention ensures the authenticity of key data by using SM2 to sign and transmit the first security medium ID during terminal identity authentication; and uses SM2 encryption and hash calculation in the return of the session identifier to ensure the integrity of key data and prevent key data from being stolen or tampered with.

[0058] In one embodiment of the present invention, before the terminal applies for a business key from the cloud service end, it first connects to the quantum key management system to obtain a session key; the terminal forms the business key application and sends it to the quantum gateway, the quantum gateway applies for the session key from the quantum key management system, and uses the session key to encrypt the business key and send it down; the terminal uses the session key on its side to decrypt and obtain the business key.

[0059] Specifically, the terminal applies for identity authentication to the quantum gateway and obtains the session identifier. The previously obtained network access key is used to encrypt the session identifier, the local account, and the opposite account. In this communication, the local account is the unique identifier of the terminal, and the opposite account is the unique identifier of the quantum gateway. The encrypted ciphertext data is packaged with the network access token and the network access key ID to form a session key application, which is sent to the quantum key management system. The quantum key management system confirms that the network access token is valid, corresponds to the network access key based on the network access key ID, and uses the network access key to decrypt the ciphertext data to obtain the session identifier, the local account, and the opposite account to form a session key. The session key is associated with the session identifier, and a corresponding relationship between the session identifier and the local account and the opposite account is established. The session key is then encrypted using the previously formed network access key, packaged with the network access key ID, and a session key application response is formed, which is returned to the terminal. The terminal corresponds to the local network access key based on the network access key ID, and uses the local network access key to decrypt and obtain the session key.

[0060] The terminal hashes the session identifier held by the terminal to obtain the session identifier hash value, which at least carries the first secure medium ID, the local account, and the session identifier hash value to apply for a business key from the quantum gateway. The local account is the unique identifier of the terminal. The quantum gateway receives the business key application, uses the same hash algorithm as the terminal, hashes the session identifier on this side, verifies whether the session identifier hash value sent by the business key application is consistent with the session identifier hash value held by this side. If they are consistent, a business key is formed, and a corresponding relationship between the business key and the local account and the first secure medium is established. When the cloud resource business traffic packet encrypted by the business key is sent to the quantum gateway, it also carries the local account and the first secure medium ID. The local account is the unique identifier of the terminal, which is convenient for the communication counterpart, that is, the quantum gateway, to accurately identify the identity and confirm the corresponding business key.

[0061] The quantum gateway also carries the session identifier, the local account, and the opposite account to apply for the session key from the quantum key management system. In this communication, the local account is the unique identifier of the quantum gateway and the opposite account is the unique identifier of the terminal. The quantum key management system corresponds to the session key based on the session identifier, and verifies the correspondence between the session identifier of this communication and the local account and the opposite account. The correspondence is established in the terminal session key application. If the correspondence is correct, the session key is returned to the terminal. It can be understood that the session key obtained from the quantum key management system with the same session identifier is the same. Therefore, the session key obtained by the quantum gateway is the same as the session key obtained by the terminal. When the symmetric cryptographic algorithm is substituted, the data encrypted by the quantum gateway using the session key can be decrypted by the terminal using the session key. The quantum gateway uses the session key on this side to encrypt the business key and send it to the terminal, and the terminal uses the session key on this side to decrypt and obtain the business key. The present invention uses the truly random session key distributed by the quantum key management system to encrypt the business key and send it to the terminal, so as to prevent the business key from being stolen, thereby protecting cloud resources.

[0062] Preferably, the quantum gateway is powered on and applies for network access authentication to the quantum key management system. Based on the second security medium built-in, the key is filled to form a second key. The key data of the network access authentication application is encrypted using the second key, such as the local account, that is, the unique identifier of the quantum gateway. The network access authentication application also includes the second security medium ID and the second key handle. The quantum key management system forms the second key based on the second security medium ID and the second key handle, decrypts to obtain the local account, verifies the binding relationship between the unique identifier of the quantum gateway and the second security medium, and if the binding relationship is correct, forms a network access token and a network access key. The network access key is encrypted using the second key on this side and sent to the quantum gateway. The quantum gateway receives the network access token and decrypts using the second key on this side to obtain the network access key. The quantum gateway re-applies for network access authentication to the quantum key management system at a preset interval, such as re-authentication every 24 hours, to update the network access key and keep the network access token valid. When the quantum gateway receives the service key application and applies for the session key from the quantum key management system, it uses the network access key to encrypt the session identifier, the account numbers of both ends of the communication, and other key data. When the quantum key management system sends the session key to the quantum gateway, it also uses the network access key on this side to encrypt and send it. In this way, the session key obtained by the quantum gateway is guaranteed to be reliable.

[0063] In one embodiment of the present invention, the terminal decrypts and obtains the business key, clears the session key temporary storage area, and instructs the quantum gateway to clear the session key temporary storage area. Specifically, the terminal and the quantum gateway receive the session key encrypted by the network access key issued by the quantum key management system, and after decrypting using the network access key on this side, the session key is stored in a session key temporary storage area. The terminal receives the business key ciphertext sent by the quantum gateway, calls the session key on this side to complete the decryption, and then clears the session key temporary storage area to destroy the session key. At the same time, the terminal sends a session key destruction instruction to the quantum gateway, and the quantum gateway synchronously clears the session key temporary storage area on this side and destroys the session key on this side. In this way, it is prevented from being exploited by attackers to decrypt and steal business keys, and key management is also simplified.

[0064] In one embodiment of the present invention, after entering the cloud computer interface, the first security medium cannot be unbound. The terminal of the present invention is connected to the first security medium in a single thread. After the terminal enters the cloud computer interface, the first security medium is identified to the cloud, and the terminal will fail to process the unbinding operation of the first security medium, thereby avoiding the business communication process between the terminal and the cloud service end. Unbinding the first security medium causes the cloud resource business traffic packet to be unable to be decrypted in the terminal, and cloud resource acquisition fails.

[0065] The second aspect of the present invention, as Figure 1, a terminal and cloud service end communication system is provided, including a terminal, a cloud server, a quantum key management system, and a quantum gateway, wherein the quantum gateway is securely connected to the cloud server, such as a local area network connection or a wired connection. The terminal has a built-in first security medium, and the quantum gateway has a built-in second security medium. Before the first security medium and the second security medium are used, they are connected to the quantum key management system to charge quantum keys. The terminal is configured with a proxy client, and the quantum gateway is configured with a proxy server; a PIN code is input in the terminal proxy client, and compared with the hash value of the built-in PIN code of the first security medium to verify the authority; after the authority verification is passed, the terminal applies to the quantum key management system for network access authentication, obtains a network access token and a network access key, wherein the first security medium is used to charge the key to at least encrypt the local account carried by the network access authentication, and the quantum key management system uses the first security medium to charge the key to at least encrypt the network access key issued; the terminal applies to the quantum gateway for identity authentication and obtains a session identifier; the terminal carries the session identifier to apply to the quantum key management system for a session key, wherein , the access key is used to at least encrypt the session identifier, the quantum key management system is used to at least encrypt the session key and send it, and the terminal uses the access key on this side to decrypt and obtain the session key; the terminal applies for the service key from the quantum gateway, the quantum gateway carries the session identifier and applies for the session key from the quantum key management system, and uses the session key to encrypt and send the service key, wherein the service key is formed based on the quantum key filled with the second security medium; the terminal uses the session key on this side to decrypt and obtain the service key, and uses the service key to encrypt or decrypt the cloud resource service traffic packet transmitted by the proxy port set by the proxy client. The terminal and cloud service end communication system provided by the present invention uses the service keys held by both ends to encrypt the cloud resource application and send it, so as to avoid the cloud resources being intercepted, leaked, or tampered with during transmission, and protect office safety; the proxy is used to realize encryption at the traffic layer, which has high execution efficiency, and is combined with the use of a symmetric cryptographic algorithm with a fast encryption and decryption processing rate to implement encryption and decryption, so that the processing capacity and response speed of the overall system are extremely fast, and cloud resources can be obtained safely without feeling; encryption is implemented at the traffic layer, which can save keys compared with the business layer.

[0066] It should be noted that the present invention uses a symmetric cryptographic algorithm to encrypt data using a business key, a network access key, and a charging key, and the encryption key is the same as the decryption key.

[0067] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for communicating between a terminal and a cloud server, characterized in that: The method comprises: The terminal configures a proxy client, sets proxy parameters in the proxy client to start the proxy, and enters a first communication mode, wherein the proxy parameters include a local proxy port; In the first communication mode, the terminal applies for a business key from the cloud service end, and if the business key is successfully obtained, the terminal is allowed to enter the cloud computer interface; The business key is used to encrypt or decrypt the cloud resource business traffic packet transmitted by the local proxy port.

2. The method for communicating between a terminal and a cloud server according to claim 1, characterized in that: The cloud resource service flow data of the local proxy port at a preset time interval is assembled with the target address to form the cloud resource service flow packet; The cloud service end includes a quantum gateway, the proxy parameters also include a gateway proxy address, and the cloud resource service traffic packet ciphertext and the gateway proxy address are combined into a package and sent to the quantum gateway.

3. The method for communicating between a terminal and a cloud server according to claim 2, characterized in that: Before the terminal applies for a business key from the cloud server, it first connects to the quantum key management system to obtain a session key; The terminal forms the service key application and sends it to the quantum gateway, the quantum gateway applies for the session key from the quantum key management system, and uses the session key to encrypt the service key and sends it; The terminal uses the session key on its side to decrypt and obtain the service key.

4. The method for communicating between a terminal and a cloud server according to claim 3, characterized in that: Before obtaining the session key, the terminal applies for identity authentication from the quantum gateway to obtain a session identifier; When the terminal and the quantum gateway apply for the session key from the quantum key management system, both carry the session identifier.

5. The method for communicating between a terminal and a cloud server according to claim 4, characterized in that: The terminal has a built-in first security medium and applies for identity authentication from the quantum gateway, including: The first secure medium generates an SM2 public-private key pair, uses the SM2 private key to sign the first secure medium ID, and the signature information and the SM2 public key are sent to the quantum gateway; The quantum gateway uses the SM2 public key to verify the signature, generates a session identifier, calculates the session identifier hash value, and also uses the SM2 public key to encrypt the session identifier, and returns it to the terminal together with the session identifier hash value; The terminal uses the SM2 private key to decrypt and obtain the session identifier, verifies that the session identifier hash value is consistent with the returned one, and then saves the session identifier.

6. The method for communicating between a terminal and a cloud server according to claim 4, characterized in that: Before applying for identity authentication from the quantum gateway, the terminal applies for network access authentication from the quantum key management system to obtain a network access token and a network access key, where the network access key is used to encrypt the session key acquisition; The terminal applies for the session key and carries the network access token.

7. The method for communicating between a terminal and a cloud server according to claim 6, characterized in that: Before the first security medium is used, it is connected to the quantum key management system to obtain the injection key; When the terminal applies for network access authentication to the quantum key management system, the first key is formed based on the injection key, at least the local account carried is encrypted, and the first security medium ID and the first key handle are packaged and sent to the quantum key management system; The quantum key management system forms the first key based on the plaintext parameters, decrypts to obtain the local account, and verifies the binding relationship between the local account and the first security medium ID; If the binding relationship is correct, the quantum key management system generates the network access key and the network access token, uses the first key to at least encrypt the network access key, and returns it to the terminal; The terminal uses the first key on the local side to decrypt and obtain the network access key.

8. The method for communicating between a terminal and a cloud server according to claim 7, characterized in that: The first security medium is preset with a PIN code; Before the terminal applies for network access authentication to the quantum key management system, the terminal enters a PIN code in the proxy client, calculates a hash value of the input PIN code and sends it to the first security medium, and compares it with the preset hash value of the PIN code; If they are consistent, the terminal is allowed to communicate with the quantum secret pipe system.

9. The method for communicating between a terminal and a cloud server according to claim 6, characterized in that: The terminal applies for the service key and carries at least the first security medium ID, the local account, and the session identifier hash value; The quantum gateway verifies that the session identifier hash value sent is consistent with that held by this side, forms the business key, establishes a corresponding relationship between the business key and the local account and the first security medium, and uses the session key on this side to encrypt and send it to the terminal.

10. The method for communicating between a terminal and a cloud server according to claim 3, characterized in that: The terminal decrypts and obtains the business key, clears the session key temporary storage area, and instructs the quantum gateway to clear the session key temporary storage area.

11. The method for communicating between a terminal and a cloud server according to claim 2, characterized in that: The quantum gateway is powered on and applies to the quantum key management system for network access authentication, and re-applies at preset intervals.

12. The method for communicating between a terminal and a cloud server according to any one of claims 5 to 11, characterized in that: After entering the cloud computer interface, the first security medium cannot be unbound.

13. The method for communicating between a terminal and a cloud server according to any one of claims 1 to 11, characterized in that: The quantum gateway has a built-in second security medium, which is connected to the quantum key management system to obtain a charging key before application, and the service key is formed based on the charging key; Alternatively, the quantum gateway is securely connected to a quantum random number generator, and the business key is formed based on a quantum random number generated by the quantum random number generator.

14. A terminal and cloud server communication system, characterized in that: It includes a terminal, a cloud server, a quantum secret management system, and a quantum gateway. The quantum gateway is securely connected to the cloud server. The terminal has a built-in first security medium. The quantum gateway has a built-in second security medium. The terminal is configured with a proxy client. The quantum gateway is configured with a proxy server. Entering a PIN code on the terminal proxy client and comparing it with the hash value of the PIN code built into the first security medium to verify the authority; After the authority verification is passed, the terminal applies to the quantum key management system for network access authentication and obtains a network access token and a network access key, wherein the first secure medium is used to inject the key to at least encrypt the local account number carried in the network access authentication, and the quantum key management system uses the first secure medium to inject the key to at least encrypt the network access key and issue it; The terminal applies for identity authentication from the quantum gateway and obtains a session identifier; The terminal carries the session identifier and applies for a session key from the quantum key management system, wherein the session identifier is at least encrypted using the network access key, and the quantum key management system uses the network access key to at least encrypt the session key and sends it; The terminal applies for a service key from the quantum gateway, the quantum gateway carries the session identifier and applies for the session key from the quantum key management system, and uses the session key to encrypt the service key and issue it, wherein the service key is formed based on the quantum key injected by the second security medium; The terminal decrypts and obtains the service key, and uses the service key to encrypt or decrypt the cloud resource service traffic packet transmitted by the proxy port set by the proxy client.

Images