Quantum cryptographic card device based on quantum key and its application
Through the external service layer and basic functional layer of the quantum cryptographic card device, the problem of cryptographic cards in the existing technology cannot be managed and used, and the convenient management and application of quantum keys is realized, thus reducing application upgrade and maintenance costs. , which has promoted the rapid application and implementation of quantum keys in the traditional encryption field.
Patent Information
- Application Number
- CN202210983559.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-08-16
- Publication Date
- 2024-12-24
- Estimated Expiration
- 2042-08-16
AI Technical Summary
Existing password cards cannot directly manage and use quantum keys. Traditional applications need to communicate directly with QKD devices when using quantum keys, resulting in poor practicality, high application upgrade threshold and high maintenance costs, and it is not convenient for quantum keys to be in itself. Direct application in applications with password computing functions.
Provide a quantum cryptographic card device based on quantum key, including an external service layer and a basic functional layer, communicates with quantum network devices through a quantum key interface module, adapts to different quantum key distribution devices and protocols, and configures and stores quantum secrets. Key, and provide quantum key-based cryptographic algorithm services through cryptographic service module and security management module, supporting key management and encryption and decryption operations in traditional applications.
Reduces the complexity of quantum key use in applications, simplifies the management and application of quantum keys, realizes the rapid testing and application of quantum keys in the traditional encryption field, promotes the implementation of quantum keys in traditional environments, and reduces the security of quantum keys. Application upgrade and maintenance costs.
Smart Images
Figure CN115426105B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of quantum communication, and in particular to a quantum cryptographic card device based on a quantum key and applications thereof. Background Art
[0002] Traditional password cards are installed on application servers or directly on application terminals. Password cards provide key management user interfaces for key management users and provide password services required for security for application systems (programs). The hardware security of the password card product security chip and the security of the key management solution ensure that the application can meet the security requirements of traditional password applications for key management and encryption and decryption of sensitive information.
[0003] Quantum equipment and quantum service providers provide quantum key distribution equipment and services. Quantum keys are ultimately distributed from the quantum network by QKD devices. Application entities with encryption requirements directly call the quantum key distribution interface to obtain quantum keys, and then use the original encryption engine to apply quantum keys for security operations such as addition and decryption.
[0004] Existing cryptographic cards cannot be directly applied to quantum environments, and cannot directly manage and use quantum keys. Traditional applications need to communicate directly with QKD quantum devices when using quantum keys. This method has poor practicality, high application upgrade thresholds and maintenance costs, and requires special transformation of each application. At the same time, QKD only provides key output but not key operations, which makes it inconvenient to directly apply quantum keys to applications that do not have cryptographic operations themselves. Summary of the invention
[0005] In order to solve the above problems, the present invention provides a quantum cryptographic card device based on quantum keys, wherein the quantum cryptographic card device includes an external service layer and a basic function layer, wherein the external service layer is responsible for connecting with quantum network devices, cryptographic applications, system administrators, and security administrators and providing services or management interfaces for them; the basic function layer provides the external service layer with internal functional support for quantum key storage, algorithms, and log basis; the quantum cryptographic card device uses its own key management mechanism to manage storage and management of quantum keys, and at the same time provides cryptographic algorithm services based on quantum keys and supported by the quantum cryptographic card device for applications to meet the needs of traditional applications for using quantum keys.
[0006] In one embodiment, the external service layer includes a quantum key interface module, a cryptographic service module, a security management module and a system management module; the quantum key interface module is responsible for communicating with the quantum key distribution device of the quantum network, adapting to different quantum key distribution devices and protocols, obtaining quantum keys from the quantum key system according to the quantum key demand configuration, and storing and managing quantum keys based on the cryptographic security scheme of the quantum cryptographic card device; the cryptographic service module provides a service interface for cryptographic applications for external cryptographic applications, and uses quantum keys and input messages to perform cryptographic operations according to the cryptographic algorithm capabilities of the quantum cryptographic card device, and the operation results are output as service response data; the security management module manages the keys involved in the quantum cryptographic card device; and the system management module provides a management portal through which the system administrator performs basic management functions of the quantum cryptographic card device.
[0007] In one embodiment, the security management module implements key management including distributed quantum key management and local key management; the distributed quantum key management refers to managing the quantum key interface module to obtain quantum key behavior from the quantum system by configuring a key distribution scheme; and the local key management refers to the management of the key life cycle of locally stored keys, including key synchronization, distribution, backup, recovery and destruction.
[0008] In one implementation, the basic function layer includes a key algorithm module, a security storage module and a log module; the key algorithm module provides necessary algorithm support for other modules of the quantum cryptographic card device, so that all cryptographic operations are completed inside the quantum cryptographic card device; the security storage module is the key storage unit of the quantum cryptographic card device, and the user cannot directly access or obtain the key information stored in the security storage module; and the log module records the key information processing steps and status of the quantum cryptographic card device.
[0009] In one embodiment, the quantum key is transmitted and stored in the secure storage module via the quantum key interface module during its life cycle, used or exported by the cryptographic service module, or directly managed by the key management module during key storage.
[0010] In one implementation, the log module records the operator's operation log of the quantum cryptographic card device, key application and key status change log, and warning and error exception logs.
[0011] In one embodiment, the present invention provides an application based on the above-mentioned quantum cryptographic card device, in which the quantum network QKD distributes quantum keys to classical network nodes, and the quantum cryptographic card device is installed on each quantum key distribution application node in the classical network to securely take over the distributed quantum keys. An application with encryption requirements on the application node directly calls the service interface of the quantum cryptographic card device that provides cryptographic applications to implement quantum key applications.
[0012] In one embodiment, the quantum key distribution application node acts as a quantum cryptography server and simultaneously provides quantum code services to multiple application nodes with encryption requirements.
[0013] Quantum keys are based on quantum mechanics. The non-cloning principle and Heisenberg uncertainty principle in quantum mechanics ensure the security of quantum keys. Quantum keys distributed using quantum communication technology have been proven to be unconditionally secure. Due to the particularity of quantum key distribution, traditional applications need to communicate with quantum key distribution devices in real time to obtain keys when using quantum keys. However, traditional applications are often not convenient for direct connection to quantum devices in terms of implementation technology and application environment. The present invention reduces the complexity of using quantum keys in applications, allowing more applications to quickly transform and adopt quantum keys, thereby promoting the testing and application of quantum keys in the field of traditional encryption.
[0014] The present invention uses a cryptographic card device to connect to a quantum network to obtain distributed quantum keys, and uses the key management mechanism of the cryptographic card itself to manage, store and manage quantum keys. At the same time, it can provide cryptographic algorithm services based on quantum keys and supported by cryptographic card hardware for applications to meet the needs of traditional applications for using quantum keys and achieve quantum key landing security. The quantum cryptographic card storage key management interface is used to effectively manage the quantum keys stored locally; the quantum key application interface enables external applications to directly apply quantum keys to perform the required cryptographic operations. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0016] Figure 1 It is a schematic diagram of the structure of a quantum cryptographic card device based on a quantum key of the present invention;
[0017] Figure 2 This is a flow chart of distributing quantum keys of the quantum cryptographic card device of the present invention;
[0018] Figure 3 It is a flow chart of the cryptographic service module of the quantum cryptographic card device of the present invention;
[0019] Figure 4 It is a management flow chart of the system management module of the quantum cryptographic card device of the present invention;
[0020] Figure 5 It is a flow chart of the security management module of the system of the quantum cryptographic card device of the present invention;
[0021] Figure 6 It is a schematic diagram of the application architecture of the quantum cryptographic card device based on the present invention. DETAILED DESCRIPTION
[0022] In order to enable those skilled in the art to better understand the technical solutions in the present application, the present invention will be further described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work should belong to the scope of protection of the present application. The present invention will be further described below in conjunction with the accompanying drawings and embodiments.
[0023] In one embodiment, if Figure 1 As shown, Figure 1 The schematic diagram of the structure of the quantum cryptographic card device based on quantum key of the present invention. The quantum cryptographic card device based on quantum key of the present invention includes two layers, namely, an external service layer and a basic function layer, with a total of seven submodules. The external service layer is responsible for connecting with quantum network devices, cryptographic applications, system administrators (or user administrators), and security administrators and providing services or management interfaces for them; the basic function layer provides key storage, algorithms, and log-based internal functional support for the upper external service layer. The quantum cryptographic card device uses its own key management mechanism to manage storage and management of quantum keys, and at the same time provides cryptographic algorithm services based on quantum keys and supported by the quantum cryptographic card device to meet the needs of traditional applications for using quantum keys.
[0024] In one embodiment, the external service layer includes a quantum key interface module, a cryptographic service module, a security management module, and a system management module. The quantum key interface module is responsible for communicating with the quantum key distribution device of the quantum network, adapting to different quantum key distribution devices and protocols, obtaining quantum keys from the quantum key system according to the quantum key demand configuration, and storing and managing quantum keys based on the cryptographic security solution of the quantum cryptographic card device.
[0025] In one embodiment, a cryptographic service module provides a cryptographic application service interface for an external cryptographic application program, performs cryptographic operations using a quantum key and an input message according to the cryptographic algorithm capability of a quantum cryptographic card device, and outputs the operation results as service response data.
[0026] In one embodiment, a security management module implements the management of keys involved in quantum cryptographic card devices, which is divided into distributed quantum key management and local key management: managing the quantum key interface to obtain quantum key behavior from the quantum system by configuring the key distribution scheme; managing the key life cycle of locally stored keys such as synchronization, distribution, backup, recovery and destruction through the user interface.
[0027] In one embodiment, the quantum cryptographic card device management module provides a management portal through which the system administrator performs basic management functions such as device initialization, parameter configuration, and user management.
[0028] In one embodiment, the basic function layer includes a key algorithm module, a security storage module and a log module.
[0029] In one embodiment, the key algorithm module, which is composed of the cryptographic algorithm chip of the cryptographic card, a programmable module and related firmware programs, provides necessary algorithm support for other modules of the quantum cryptographic card device. All cryptographic operations are completed inside the cryptographic card to ensure the security of key use and data operations.
[0030] In one embodiment, the secure storage module is a key storage unit provided by the cryptographic card hardware. The cryptographic card firmware provides a key storage and use interface for the user. The user cannot directly access or obtain the stored key information to ensure the security of key storage. During the life cycle of the module, the quantum key is transmitted and stored via the quantum key interface module, used or exported by the cryptographic service module, or directly managed by the key management module during the key storage process.
[0031] In one embodiment, a log module records the key information processing steps and status of the quantum cryptographic card device, including the operator's log of the quantum cryptographic card device operation process, key application and key status change logs, and abnormal logs such as warnings and errors. The operation and key information of the quantum cryptographic card device can be traced.
[0032] In one embodiment, if Figure 2 As shown, Figure 2This is the quantum key distribution process of the quantum cryptographic card device of the present invention. The quantum key interface module obtains the quantum key from the quantum network QKD device. First, the security administrator customizes a quantum key scheme obtained from the quantum system through the key management module; then the quantum key is obtained from the QKD according to the QKD key distribution protocol. The obtained quantum key is protected by the cryptographic algorithm module for the QKD protocol cryptographic algorithm and converted into a locally stored key; finally, the secure storage module saves the key to the cryptographic card.
[0033] In one embodiment, the process of distributing quantum keys from a quantum network QKD to a quantum cryptographic card device is as follows.
[0034] 1. First, the quantum key interface module of the quantum cryptographic card parses the quantum key scheme designed by the security administrator;
[0035] 2. Establish a connection with QKD to obtain the quantum key according to the quantum QKD connection information, QKD distribution protocol, quantum key parameters, quantum key protection scheme and other information in the key scheme;
[0036] 3. The acquired quantum key is converted into a local storage key by the cryptographic algorithm module to provide protection for the QKD protocol cryptographic algorithm;
[0037] 4. Finally, the key is stored internally by the secure storage module.
[0038] In one embodiment, if Figure 3 As shown, Figure 3 This is the cryptographic service module process of the quantum cryptographic card device of the present invention. When the cryptographic service module provides cryptographic services to the cryptographic application, it first requires that the key has been distributed and synchronized to the local through the quantum key interface; then the cryptographic application initiates a cryptographic service request, and when the key-related permissions are met, the cryptographic service module completes the local cryptographic service operation according to the local key and input information in cooperation with the internal cryptographic algorithm module; finally, the operation result is returned to the cryptographic application. The specific cryptographic service process is as follows.
[0039] 1. The cryptographic service module starts listening and waits for service requests to arrive;
[0040] 2. When receiving a cryptographic application request, check and parse the request message to obtain relevant request parameters;
[0041] 3. Determine whether the key to be used for the password service exists. If it does not exist, return an error prompt, otherwise continue;
[0042] 4. Check whether the key has the permission to use the service. If not, an error message will be returned. Otherwise, continue.
[0043] 5. Use the specified key to perform cryptographic operations inside the cryptographic card;
[0044] 6. Output the operation result and return it to the requester.
[0045] In one embodiment, the management process of the system management module of the quantum cryptographic card device is as follows: Figure 4 As shown. The system administrator uses the initial authentication information to log in to the system for the first time. After the first successful login, the initial authentication information is forced to be modified and roles such as security administrator and audit administrator are created; the daily management of the system administrator includes administrator management, log management, and other daily contents. The specific system management process is as follows.
[0046] 1. First, the system administrator enters the authentication information to log into the system;
[0047] 2. If the system administrator logs in for the first time, the system will perform an initialization process: requiring him to change the initial password and create other administrators before logging out;
[0048] 3. Otherwise, the system can be managed through the management interface for daily operations;
[0049] 4. Management is completed and log out.
[0050] In one embodiment, the security management module process of the system of the quantum cryptographic card device is as follows: Figure 5 As shown. First, the security administrator logs in to the key management window of the password card after identity authentication; after logging in, the administrator can manage the quantum key distribution plan (configure the relevant parameters of the quantum key obtained from the quantum system), manage the life cycle of the keys that have been successfully distributed and stored locally; manage the key usage permissions and control the use of cryptographic services; finally, the managed data forms internal parameters and status information and is saved internally for use by other modules. The specific security management process is as follows.
[0051] 1. The security management administrator logs into the system;
[0052] 2. After logging in, configure the quantum key distribution scheme and manage the key status or key permissions;
[0053] 3. Save configuration information;
[0054] 4. Log out.
[0055] In one embodiment, the present invention provides a quantum cryptographic card application architecture based on quantum keys, such as Figure 6As shown, the quantum network QKD distributes quantum keys to classical network nodes. First, quantum cryptographic cards are installed on each quantum key distribution application node (A, B, E) in the classical network to securely take over the distributed quantum keys. Applications with encryption requirements on these application nodes can directly call the cryptographic service interface of the quantum cryptographic card to achieve the purpose of quantum key application; secondly, server nodes such as "Application Node-E" can act as quantum cryptographic servers and provide quantum code services to multiple application nodes with encryption requirements at the same time.
[0056] In this application, QKD, which stands for Quantum Key Distribution, is a device that uses the basic principles of quantum mechanics to ensure that both communicating parties can generate a string of identical random numbers that cannot be obtained by attackers as a shared key.
[0057] Key: Key information or parameters that control the operation of a cryptographic algorithm.
[0058] Password card: A password card is a security device with a password chip. It can store security information internally and has independent computing capabilities. It provides external security interfaces for password management and password application-related software, and generally provides commonly used computer interfaces such as PCI-E.
[0059] PCI-E: The full name is Peripheral Component Interconnect express, which is a high-speed serial computer expansion bus standard and a commonly used external hardware interface for computers.
[0060] Quantum communication technology: As an important branch of quantum information science, quantum communication is a communication technology that uses quantum states as information carriers to interact with each other. Quantum key distribution (QKD) is the first practical quantum information technology and an important direction of quantum communication. Quantum key distribution can share keys between spatially separated users in an information-theoretically secure manner.
[0061] Classical network: the mainstream TCP / IP network relative to the quantum network.
[0062] Traditional applications: as opposed to applications that use quantum technology or quantum keys.
[0063] System Administrator: Responsible for specific daily management and maintenance and administration.
[0064] Security Administrator: An administrator responsible for configuration related to keys and security-sensitive information.
[0065] It is easy for those skilled in the art to understand that the above-mentioned advantageous methods can be freely combined and superimposed without conflict.
[0066] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention shall be included in the protection scope of the present invention. The above are only preferred embodiments of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and variations can be made without departing from the technical principles of the present invention, and these improvements and variations should also be regarded as the protection scope of the present invention.
Claims
1. A quantum cryptographic card device based on a quantum key, characterized in that: The quantum cryptographic card device includes an external service layer and a basic function layer, wherein the external service layer is responsible for connecting with quantum network devices, cryptographic applications, system administrators, and security administrators and providing services or management interfaces for them; the basic function layer provides internal functional support for quantum key storage, algorithms, and logs for the external service layer; the quantum cryptographic card device uses its own key management mechanism to manage, store, and manage quantum keys, and at the same time provides cryptographic algorithm services based on quantum keys and supported by quantum cryptographic card devices for applications to meet the needs of traditional applications for using quantum keys; the external service layer includes a quantum key interface module, a cryptographic service module, a security management module, and a system management module; The quantum key interface module is responsible for communicating with the quantum key distribution device of the quantum network, adapting to different quantum key distribution devices and protocols, obtaining quantum keys from the quantum key system according to the quantum key demand configuration, and storing and managing quantum keys based on the cryptographic security scheme of the quantum cryptographic card device; The cryptographic service module provides a cryptographic application service interface for an external cryptographic application program, performs cryptographic operations using a quantum key and an input message according to the cryptographic algorithm capability of the quantum cryptographic card device, and outputs the operation result as service response data; The security management module manages the keys involved in the quantum cryptographic card device; The system management module provides a management portal through which the system administrator performs basic management functions of the quantum cryptographic card device.
2. The quantum cryptographic card device according to claim 1, characterized in that: The security management module manages the key including distributed quantum key management and local key management; the distributed quantum key management refers to managing the quantum key interface module to obtain quantum key from the quantum system by configuring the key distribution scheme; The local key management refers to the management of the key life cycle of the locally stored keys, including key synchronization, distribution, backup, recovery and destruction.
3. The quantum cryptographic card device according to claim 1, characterized in that: The basic function layer includes a key algorithm module, a security storage module and a log module; The key algorithm module is a secure computing component inside the quantum cryptographic card device, providing necessary algorithm support for other modules so that all cryptographic operations are completed inside the quantum cryptographic card device; The secure storage module is a key storage unit of the quantum cryptographic card device, and a user cannot directly access or obtain the key information stored in the secure storage module; The log module records the key information processing steps and status of the quantum cryptographic card device.
4. The quantum cryptographic card device according to claim 3, characterized in that: During the life cycle of the quantum key in the secure storage module, the quantum key is transmitted and stored via the quantum key interface module, used or exported by the cryptographic service module, or the key management module directly manages the state during the key storage process.
5. The quantum cryptographic card device according to claim 3, characterized in that: The log module records the operator's log of the operation process of the quantum cryptographic card device, the key application and key status change log, and the abnormal log of warning and error.
6. Based on the application of the quantum cryptographic card device described in any one of claims 1 to 5, the quantum network QKD distributes quantum keys to classical network nodes, and the quantum cryptographic card device is installed on each quantum key distribution application node in the classical network to securely take over the distributed quantum keys. The application with encryption requirements on the application node directly calls the service interface of the quantum cryptographic card device that provides cryptographic applications to implement quantum key applications.
7. The use according to claim 6, characterized in that: The quantum key distribution application node acts as a quantum cryptography server and provides quantum cryptography services to multiple application nodes with encryption requirements at the same time.