A quantum secure network rights management system and method

Abstract

The invention discloses a quantum security network authority management system and method. The system comprises a quantum security device and a border base station. The quantum security device is used to obtain characteristic information of a sender to which an encryption key and an encrypted ciphertext belong. If the characteristic information is not in a pre-configured first preset rule, the quantum security device obtains the characteristic information of the sender to which the encryption key and the encrypted ciphertext belong to determine whether the characteristic information is in the pre-configured first preset rule. If not, the encryption key and the encrypted ciphertext are intercepted, so that the encryption key and the encrypted ciphertext can be intercepted at the source. At the same time, in combination with the characteristic information obtained by the border base station, it is also verified whether it is in the second preset rule to determine whether the encryption key is intercepted, thereby realizing double protection of the encryption key, and the overall security reliability is higher; and simple and efficient authority management can be realized.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a quantum security network authority management system and method. Background Art

[0002] Information security is a major strategic area that concerns the national economy and people's livelihood. Traditional information security is achieved through encryption algorithms that rely on computational complexity. However, with the rapid development of computing power, traditional encryption algorithms that rely on computational complexity are facing increasing security risks.

[0003] Quantum secure communication based on quantum key distribution is the only communication method that is unconditionally secure in principle. Quantum key distribution refers to the use of quantum states to load information and generate keys through certain protocols. The basic principles of quantum mechanics ensure that the keys cannot be eavesdropped, thereby achieving secure quantum secure communication. The security of quantum secure communication is based on the basic principles of physics and has nothing to do with computational complexity. Even if powerful quantum computers are available in the future, it will not pose a threat to its security.

[0004] Quantum secure communication is the first quantum information technology to be put into practical use and industrialization. At present, my country has successively built the world's first fully accessible metropolitan quantum security network, the first quantum government network, and the first large-scale metropolitan quantum security network. In the process, relevant technologies have been developed to maturity. The independently developed quantum secure communication equipment has provided information security for many important activities.

[0005] In terms of quantum security networks, quantum security devices designed for information protection concepts can achieve an all-round information protection environment. They can communicate with the outside world and perform quantum encryption on data information to form encryption keys and encrypted ciphertexts, such as the device disclosed in the patent text of Chinese patent application number: CN202010886203.0. Although this device can improve the security of internal communications, in actual applications, if an illegal user has the same quantum security device, if someone transmits business data to the illegal user, there is a risk of business data leakage. Summary of the invention

[0006] In order to solve the above problems, the present invention discloses a quantum secure network authority management system and method.

[0007] In a first aspect, the present application provides a quantum security network authority management system, the system comprising a quantum security device and a border base station;

[0008] The quantum security device is used to obtain characteristic information of the sender to which the encryption key and the encrypted ciphertext belong, and if the characteristic information is in a pre-configured first preset rule, the encryption key and the encrypted ciphertext are sent to the outside; otherwise, the encryption key and the encrypted ciphertext are intercepted;

[0009] The border base station is used to receive the encryption key and obtain the characteristic information, and if the characteristic information is in a pre-configured second preset rule, send the encryption key to the outside; otherwise, intercept the encryption key;

[0010] The above-mentioned characteristic information includes user identity information, business information, device information and data type.

[0011] Furthermore, the system also includes a network management server and an access base station;

[0012] The network management server is connected to the access base station and the boundary base station respectively; it is used to set the first preset rule and the second preset rule, and distribute the first preset rule to the access base station and distribute the second preset rule to the boundary base station;

[0013] The access base station is used to receive the first preset rule and transmit the first preset rule to the quantum security device.

[0014] Furthermore, the quantum security device includes a confidential area and a non-confidential area, the non-confidential area and the confidential area are connected via a data ferry module, and the non-confidential area has an external communication interface for receiving external data and loading and unloading the data.

[0015] Furthermore, the encrypted area includes a storage module, a processing module, a file system and a quantum encryption and decryption device for encrypting and decrypting data information.

[0016] Furthermore, the file system includes a security sandbox, which includes a sandbox file system and a user interaction layer, and the user interaction layer is used to execute running, browsing and editing operations on the sandbox file system.

[0017] In a second aspect, the present application further provides a quantum security network rights management method, wherein the quantum security network includes a quantum security device and a border base station, and the method includes:

[0018] The following steps are performed by the quantum security device:

[0019] Obtaining the encryption key and the characteristic information of the sender to which the encrypted ciphertext belongs;

[0020] Determine whether the characteristic information is within a pre-configured first preset rule, and if so, send the encryption key and the encrypted ciphertext to the outside; if not, intercept the encryption key and the encrypted ciphertext;

[0021] The following steps are performed by the border base station:

[0022] Acquiring the feature information;

[0023] It is determined whether the characteristic information is within the pre-configured second preset rule. If so, the encryption key is sent to the external network; if not, the encryption key is intercepted.

[0024] Furthermore, the characteristic information includes user identity information, service information, device information and data type.

[0025] Furthermore, the first preset rule is the same as the second preset rule.

[0026] Furthermore, the quantum security device also sends a first preset rule to the border base station, and the border base station determines whether the first preset rule is the same as the second preset rule. If so, the encryption key is sent to the external network; if not, the encryption key is intercepted.

[0027] Compared with the prior art, the beneficial effects of the present invention are as follows: the quantum security device obtains the characteristic information of the sender to which the encryption key and the encrypted ciphertext belong to determine whether the characteristic information is in the pre-configured first preset rule. If not, the encryption key and the encrypted ciphertext are intercepted; and the encryption key and the encrypted ciphertext can be intercepted at the source; at the same time, combined with the characteristic information obtained by the boundary base station, it is verified again whether it is in the second preset rule to determine whether the encryption key is intercepted, avoiding the interception of the quantum security device or the boundary base station by tampering with the first preset rule or the second preset rule alone in actual application, and realizing the double protection of the encryption key; the first preset rule and the second preset rule set for the characteristic information can intercept users or devices without authority, etc., and transmit encryption keys or encrypted ciphertexts to the outside, thereby improving the overall security and reliability, and realizing simple and efficient permission management. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a block diagram of the quantum security network authority management system of an embodiment of the present application;

[0029] Figure 2 It is a structural block diagram of feature information in an embodiment of the present application;

[0030] Figure 3 This is a flow chart of the quantum secure network authority management method in an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solutions and advantages of this application clearer, this application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0032] Example: Figure 1 This is a block diagram of the quantum security network authority management system of an embodiment of the present application;

[0033] The system includes a quantum security device 100 and a border base station 200;

[0034] The quantum security device 100 is used to obtain the characteristic information of the sender to which the encryption key and the encrypted ciphertext belong. If the characteristic information is in the pre-configured first preset rule, the encryption key and the encrypted ciphertext are sent to the outside; otherwise, the encryption key and the encrypted ciphertext are intercepted; specifically, the quantum security device 100 sends the encryption key to the quantum security device 100 of the opposite end through the border base station 200; and sends the encrypted ciphertext to the opposite end through the gateway 500 and the Internet;

[0035] The border base station 200 is used to receive the encryption key and obtain the characteristic information. If the characteristic information is in the pre-configured second preset rule, the encryption key is sent to the outside; otherwise, the encryption key is intercepted;

[0036] The above-mentioned characteristic information mainly includes user identity information, business information, device information and data type. Among them, user information mainly includes account password information, CA certificate, fingerprint information, facial feature information and sound information. Business information includes legal applications and process information. Device information includes device ID. In addition, it can also be a dedicated device, on which only specific data information can be transmitted. Data types include file data, audio and video data.

[0037] The system of this embodiment also includes a network management server 300 and an access base station 400;

[0038] The network management server 300 is connected to the access base station 400 and the boundary base station 200 respectively; it is used to set the first preset rule and the second preset rule, and distribute the first preset rule to the access base station 400 and distribute the second preset rule to the boundary base station 200;

[0039] An access base station 400 is used to receive a first preset rule and transmit the first preset rule to the quantum security device 100;

[0040] The first preset rule and the second preset rule are configured once by the network management server 300 and distributed to the boundary base station 200 and the quantum security device 100 synchronously, which can simplify the operation steps.

[0041] During the specific implementation process, the network management server 300 distributes the first preset rule and the second preset rule to the quantum security device 100 and the border base station 200 respectively. In order to facilitate configuration and simplify the operation steps, the first preset rule and the second preset rule are set to be the same rule; the first preset rule and the second preset rule can both be in the form of a whitelist, and the first preset rule and the second preset rule both include the encryption key and the encrypted ciphertext allowed to be sent by the characteristic information of the sender; when requesting business data from the quantum security device 100, the quantum security device 100 first converts the business data into an encryption key through quantum encryption After the encrypted ciphertext is received, it is prepared to be sent out; before sending, the quantum security device 100 determines the characteristic information of the sender, that is, the specific user, device, and application, according to the preset first rule, whether it is in the preset first rule. If the above characteristic information is in the preset first rule, the encryption key and the encrypted ciphertext are released, and the encryption key is sent to the quantum security device 100 of the other end through the border base station 200; the encrypted ciphertext is sent to the other end through the gateway 500 and the Internet; if the characteristic information is not in the first rule, the encryption key and the encrypted ciphertext are intercepted at the same time to ensure the security of the business data;

[0042] After receiving the encryption key sent from the quantum security device 100, the border base station 200 determines whether the characteristic information of the sender, that is, the specific user, device, application, is in the preset second rule. If the characteristic information is in the second rule, the encryption key is allowed to pass and sent to the quantum security device 100 at the other end; otherwise, the encryption key is intercepted; through the double interception of the border base station 200 and the quantum security device 100, it is avoided to bypass the interception of the quantum security device or the border base station by tampering with the first preset rule or the second preset rule alone in actual application, thereby realizing double protection of the encryption key and improving its overall security.

[0043] The quantum security device 100 in this embodiment also includes a confidential area and a non-confidential area. The non-confidential area is connected to the confidential area through a data ferry module. The non-confidential area has an external communication interface, and the non-confidential area is used to receive external data and load and unload the data. The confidential area and the non-confidential area can be divided at the logical level or at the physical hardware level. The confidential area is used to store sensitive business data. It is not directly connected to the external network, but only communicates with the non-confidential area. When external data needs to enter the confidential area, it can only be stripped of the communication protocol through the non-confidential area, such as the stripping of the TCP / IP protocol, and then transmitted to the confidential area through the data ferry module for interaction; wherein the data ferry module is a private protocol interface module, such as a custom serial port communication protocol (SPCP) interface, etc.

[0044] The encrypted area includes a storage module, a processing module, a file system, and a quantum encryption and decryption device for encrypting and decrypting data information; the quantum encryption and decryption device uses an existing encryption and decryption device based on the principle of quantum encryption; the file system can be an exFAT file system or an NTFS file system, etc.;

[0045] The storage module can be a random access memory (RAM) or a non-volatile memory (NVM), which is used to store data files;

[0046] The processing module may be a general purpose processor, a central processing unit, a network processor (NP), etc., and is used for editing and processing files;

[0047] In some possible implementations, the quantum security device may also adopt a flexibly configurable quantum communication device provided in the patent application with Chinese patent application number CN202010886203.0;

[0048] The file system includes a security sandbox, which includes a sandbox file system and a user interaction layer. The user interaction layer is used to execute running, browsing and editing operations on the sandbox file system. The user interaction layer of the security sandbox can be an independent operating system, and the whole can be realized by installing a virtual machine of a system such as Windows.

[0049] Figure 3 This is a flow chart of a quantum secure network rights management method in an embodiment of the present application;

[0050] The present application also provides a quantum security network rights management method, wherein the quantum security network includes a quantum security device, a border base station and a gateway, and the method includes:

[0051] The following steps are performed by the quantum security device:

[0052] S100: Obtaining the encryption key and the characteristic information of the sender to which the encrypted ciphertext belongs;

[0053] S101: Determine whether the characteristic information is within a pre-configured first preset rule;

[0054] S102: If not, intercept the encryption key and the encrypted ciphertext;

[0055] S103: If yes, the encryption key is sent through the border base station, and the encrypted ciphertext is sent through the gateway;

[0056] The following steps are performed by the border base station:

[0057] S200: Acquire characteristic information; determine whether the characteristic information is within a pre-configured second preset rule;

[0058] S201: If not, intercept the encryption key;

[0059] S202: If yes, send the encryption key to the external network;

[0060] The following steps are performed by the gateway:

[0061] Receive encrypted ciphertext and send it to the external network.

[0062] See also Figure 2 , where the characteristic information includes user identity information, service information, device information and data type;

[0063] Among them, user information includes account password information, CA certificate, fingerprint information, facial feature information and voice information; business information includes legal application and process information; device information includes device ID; data type includes file data, audio and video data.

[0064] The first preset rule and the second preset rule can also be set as different rules. For example, the first preset rule sets relatively few items to be intercepted to ensure the convenience of internal communication, while the second preset rule increases the items to be intercepted to improve its coverage to strictly limit the encryption keys that can be sent externally.

[0065] The quantum security device also sends the first preset rule to the border base station. The border base station determines whether the first preset rule is the same as the second preset rule. If so, it sends the encryption key to the external network. If not, it intercepts the encryption key. By verifying whether the first preset rule is the same as the second preset rule through the border base station, it can prevent the individual tampering of a certain party in the rule configuration, thereby further improving security.

[0066] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A quantum secure network rights management system, characterized by: The system includes a quantum security device and a border base station; The quantum security device is used to obtain characteristic information of the sender to which the encryption key and the encrypted ciphertext belong, and if the characteristic information is in a pre-configured first preset rule, the encryption key and the encrypted ciphertext are sent to the outside; otherwise, the encryption key and the encrypted ciphertext are intercepted; The quantum security device sends an encryption key to the quantum security device at the other end through the border base station; Send encrypted ciphertext to the other end through the gateway and the Internet; The border base station is used to receive the encryption key and obtain the characteristic information. If the characteristic information is in a pre-configured second preset rule, the encryption key is sent to the outside; otherwise, the encryption key is intercepted.

2. A quantum secure network rights management system according to claim 1, characterized in that: The system also includes a network management server and an access base station; The network management server is connected to the access base station and the boundary base station respectively; it is used to set the first preset rule and the second preset rule, and distribute the first preset rule to the access base station and distribute the second preset rule to the boundary base station; The access base station is used to receive the first preset rule and transmit the first preset rule to the quantum security device.

3. A quantum secure network rights management system according to claim 1 or 2, characterized in that: The quantum security device includes a secret area and a non-secret area, the non-secret area and the secret area are connected via a data ferry module, and the non-secret area has an external communication interface for receiving external data and loading and unloading the data.

4. A quantum secure network rights management system according to claim 3, characterized in that: The encrypted area includes a storage module, a processing module, a file system and a quantum encryption and decryption device for encrypting and decrypting data information.

5. A quantum secure network rights management system according to claim 4, characterized in that: The file system includes a security sandbox, which includes a sandbox file system and a user interaction layer, and the user interaction layer is used to execute running, browsing and editing operations on the sandbox file system.

6. A method for managing rights in a quantum secure network, wherein the quantum secure network includes a quantum secure device and a border base station, characterized in that: The method comprises: The following steps are performed by the quantum security device: Obtaining the encryption key and the characteristic information of the sender to which the encrypted ciphertext belongs; Determine whether the characteristic information is within the pre-configured first preset rule, if so, send the encryption key and the encrypted ciphertext to the outside; if not, intercept the encryption key and the encrypted ciphertext; the quantum security device sends the encryption key to the quantum security device of the opposite end through the border base station; send the encrypted ciphertext to the opposite end through the gateway and the Internet; The following steps are performed by the border base station: Acquiring the feature information; It is determined whether the characteristic information is within the pre-configured second preset rule. If so, the encryption key is sent to the external network; if not, the encryption key is intercepted.

7. A quantum secure network rights management method according to claim 6, characterized in that: The characteristic information includes user identity information, service information, device information and data type.

8. A quantum secure network rights management method according to claim 6, characterized in that: The first preset rule is the same as the second preset rule.

9. A quantum secure network rights management method according to claim 6, characterized in that: The quantum security device also sends a first preset rule to the border base station, and the border base station determines whether the first preset rule is the same as the second preset rule. If so, the encryption key is sent to the external network; if not, the encryption key is intercepted.

Images