Method for protecting data flow security and data management system

Abstract

The present invention relates to the field of quantum communication technology, and discloses a method for protecting the security of data flow and a data management system. The method is applicable to a security situation awareness platform, which includes a quantum middleware, a security agent on the first object side, and a key engine on the security situation awareness platform side. The method includes: obtaining a first ciphertext encrypted by a first quantum derivative key for the return data of the first object; using a second quantum derivative key to decrypt the first ciphertext to obtain return data, the first and second quantum derivative keys are derived at least once based on a quantum root key, and the security agent and the key engine obtain a shared quantum root key through negotiation with the quantum middleware. The present invention derives a quantum key tree for the return data of the first object, and uses the derived quantum derivative key to encrypt and decrypt the return data accordingly, thereby realizing data isolation between the first objects and effectively improving the security of the data during the flow process.

Description

Technical Field

[0001] The present invention relates to the field of quantum communication technology, and in particular to a method for protecting data flow security and a data management system. Background Art

[0002] Quantum information technology has made remarkable progress in recent years. With the establishment of the "Network-oriented Quantum Information Technology" Focus Group - QIT4N by the International Telecommunication Union (ITU-T) in 2019, extensive cross-domain and multi-professional cooperation has become a consensus. Research on how quantum information technologies such as quantum computing, quantum communication, and quantum random numbers can serve traditional networks is of great significance, especially for promoting the integration and development of technologies such as quantum key distribution (QKD) and information and communications technology (ICT) and the evolution of future quantum information networks.

[0003] QKD technology can be integrated with widely used emerging ICT technologies such as the Internet of Things and the Internet of Vehicles. QKD is combined with different levels of ICT, including the data link layer, network layer, transport layer and application layer, to form a ubiquitous quantum security network application solution. The ubiquitous quantum security network is centered on the quantum key service desk, extending quantum key services to mobile terminals that are not covered by the quantum private network, creating an integrated information security solution of "cloud, pipe and terminal", and providing a highly mobile and highly available secure communication solution.

[0004] Under the new situation of rapid development of QKD and ICT integrated services, flexible QKD network and ICT application / network interconnection solutions not only provide users with fast, convenient and flexible application experience, but also greatly improve the security performance of ICT applications.

[0005] However, in the process of transmitting massive data of ICT applications, there is still the possibility of mutual leakage of user data passing through the same device or network. Therefore, how to further improve the security of data during data transmission and solve the security responsibility logic and business / user isolation during data flow are technical problems to be solved by the present invention. Summary of the invention

[0006] The purpose of the embodiments of the present invention is to at least provide a method for processing user data and a data management system, which adopts a quantum derived key tree structure to store and manage quantum keys, and uses derived keys to solve the security responsibility logic and business / user isolation in the data flow process, which can at least improve the security of data in the flow process and better solve the problems of security responsibility logic and business / user isolation in the data flow process.

[0007] In order to achieve the above-mentioned purpose, at least one embodiment of the present invention provides a method for protecting the security of data flow, which is applicable to a security situation awareness platform, wherein the security situation awareness platform includes a quantum middleware, a security agent deployed on the first object side, and a key engine deployed on the security situation awareness platform side, including: obtaining a first ciphertext of the first object, wherein the first ciphertext is formed by encrypting the return data of the first object with a first quantum derivative key, and the first quantum derivative key is derived based on at least one derivation of a quantum root key; using a second quantum derivative key to decrypt the first ciphertext to obtain the return data, wherein the second quantum derivative key is derived by the key engine based on at least one derivation of the quantum root key, and the security agent and the key engine negotiate with the quantum middleware to obtain a shared quantum root key.

[0008] In order to achieve the above-mentioned purpose, at least one embodiment of the present invention also provides a data management system, including a security situation awareness platform, wherein the security situation awareness platform includes quantum middleware, a security agent deployed on the first object side, and a key engine deployed on the security situation awareness platform side, wherein the security agent is also connected to the first quantum integrated machine, and the key engine is also connected to the second quantum integrated machine, and the second quantum integrated machine is connected to the first quantum integrated machine via a quantum channel and a classical channel; the security situation awareness platform is used to implement the above-mentioned method for protecting the security of data flow.

[0009] In at least one embodiment of the present invention, the security situation awareness platform includes a quantum middleware, a security agent deployed on the first object side, and a key engine deployed on the security situation awareness platform side. For the return data of the first object, at least one derivation is performed based on the quantum root key, and the first quantum derivative key derived is used to encrypt it to form a first ciphertext. The security situation awareness platform obtains the first ciphertext, and then uses the second quantum derivative key to decrypt the first ciphertext to obtain the return data. Among them, the second quantum derivative key is derived by the key engine based on the quantum root key derived at least once, and the security agent and the key engine negotiate with the quantum middleware to obtain a shared quantum root key. It can be seen that in an embodiment of the present invention, for the return data of the first object, at least one derivation can be performed based on the shared quantum root key to derive the first quantum derivative key used to encrypt the return data of the first object and the second quantum derivative key used for decryption. Since the above-mentioned first quantum derivative key and the second quantum derivative key are both derived from the return data of the first object, the return data between different first objects can be isolated from each other. Therefore, the problems of security responsibility logic and data isolation in the data flow process are solved, and the security of the return data is improved.

[0010] In at least one embodiment, the security agent is also connected to the first quantum integrated machine, the key engine is also connected to the second quantum integrated machine, the second quantum integrated machine is connected to the first quantum integrated machine through a quantum channel and a classical channel, the security agent is connected to the key engine through a service channel via the quantum middleware, and the security agent and the key engine negotiate to obtain a shared quantum root key through the quantum middleware, including: the security agent sequentially or randomly obtains an integrity protection key vector and an encryption key vector from the first quantum integrated machine, and processes the integrity protection key vector and the encryption key vector to form the quantum root key; through the quantum middleware negotiation, the quantum root key at the first quantum integrated machine connected to the security agent is shared to the second quantum integrated machine connected to the key engine through the quantum channel and the classical channel. In this embodiment, the first quantum integrated machine and the second quantum integrated machine share the quantum root key, based on which, only the key engine connected to the second quantum integrated machine can derive the second quantum derivative key for decrypting the first ciphertext, thereby ensuring the security of the returned data of the first object.

[0011] In at least one embodiment, the use of the second quantum derivative key to decrypt the first ciphertext to obtain the return data includes: processing the quantum root key and / or the identifier of the first object based on the KDF function to form a seventh quantum derivative key, the identifier of the first object including at least one of the following: network identifier, user identifier, service identifier, service level identifier, process identifier, and identifier of each node in the data flow process; processing the seventh quantum derivative key based on the KDF function to form an eighth quantum derivative key, and processing the eighth quantum derivative key through the trunc function to form a second quantum derivative key; using the quantum root key to sequentially form the second quantum derivative key through the seventh quantum derivative key and the eighth quantum derivative key derivation process to decrypt the first ciphertext to obtain the return data. In this embodiment, a quantum secret key tree is formed through the derivation process of the seventh quantum derivative key and the eighth quantum derivative key, and the first ciphertext is decrypted using the second quantum derivative key finally derived. The ability to use the quantum key tree structure to store and manage quantum keys not only reduces the storage resources required for quantum keys, but also solves the problems of security responsibility logic and data isolation during data flow.

[0012] In at least one embodiment, when the security agent processes the integrity protection key vector and the encryption key vector to form the quantum root key, obtaining the first ciphertext of the first object includes: the security agent derives the first quantum derivative key at least once based on the quantum root key and the identifier of the first object; and encrypts the return data using the first quantum derivative key to obtain the first ciphertext. The first quantum derivative key used to encrypt the return data of the first object is derived based on the identifier of the first object, and based on this, the first objects cannot access each other's data, thereby achieving logical isolation and slice protection of the data, and effectively improving the security of the data.

[0013] In at least one embodiment, encrypting the returned data using the first quantum-derived key includes: the security agent encrypting the returned data using the first quantum-derived key to obtain the first ciphertext; or the security agent transmitting the derived first quantum-derived key to the key engine via a service channel, so that the key engine encrypts the returned data using the first quantum-derived key to obtain the first ciphertext. The security agent delivers the first quantum-derived key to the key engine, which can better protect the first object.

[0014] In at least one embodiment, when the security agent processes the integrity protection key vector and the encryption key vector to form the quantum root key, obtaining the first ciphertext of the first object further includes: the security agent transmits the quantum root key to the key engine via a service channel, the key engine derives the first quantum derivative key based on the quantum root key and the identifier of the first object at least once, and the key engine encrypts the return data using the first quantum derivative key to obtain the first ciphertext. The security agent delivers the quantum root key to the security engine, and the security engine then derives the first quantum derivative key and uses it to encrypt the return data, which can better protect the return data of the first object.

[0015] In at least one embodiment, the security agent derives the first quantum derivative key based on the quantum root key and the identifier of the first object at least once, including: processing the quantum root key and / or the identifier of the first object based on the KDF function to form a third quantum derivative key, the identifier of the first object including at least one of the following: network identifier, user identifier, service identifier, service level identifier, process identifier, and identifier of each node in the data flow process; processing the third quantum derivative key based on the KDF function to form a fourth quantum derivative key, and processing the fourth quantum derivative key through the trunc function to form a first quantum derivative key; using the quantum root key to sequentially derive the third quantum derivative key and the fourth quantum derivative key to form the first quantum derivative key to encrypt the returned data. In this embodiment, a quantum secret key tree is formed through the derivation process of the third quantum derivative key and the fourth quantum derivative key, and the returned data is encrypted using the first quantum derivative key finally derived. The ability to use the quantum key tree structure to store and manage quantum keys not only reduces the storage resources required for quantum keys, but also solves the problems of security responsibility logic and data isolation in the data flow process.

[0016] In at least one embodiment, the security agent processes the integrity protection key vector and the encryption key vector to form the quantum root key, including: processing the integrity protection key vector and the encryption key vector based on the KDF function to form a quantum root key, wherein the quantum root key = KDF (integrity protection key vector and encryption key vector, Salt, Iterations), the Salt includes at least one of the following: service node ID, user ID, service ID, sequence number, non-secret parameters, and the Iterations is a preset number of iterations; using the KDF function to process the preset integrity protection identifier and encryption identifier and the quantum root key to form a fifth quantum derivative key, and using the trunc function to process the fifth quantum derivative key to form a sixth quantum derivative key, wherein the sixth quantum derivative key is provided to the core network connected via the air interface. When forming the quantum root key, the cryptographic salt Salt is added as a parameter, which increases the difficulty for attackers to crack the quantum root key, thereby improving the security of the quantum root key. In addition, the sixth quantum key can ensure that ICT users or ICT services can also access the core network through the air interface, and at the same time, it can also enable the data of these users or services connected through the air interface to meet the isolation requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplifications do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0018] Figure 1 is a schematic diagram of a hardware environment of a data management system according to at least one embodiment of the present invention;

[0019] Figure 2 is a schematic diagram of a connection between a security agent and a first object according to at least one embodiment of the present invention;

[0020] Figure 3 is a schematic diagram of a structure in which a first object accesses a network according to at least one embodiment of the present invention;

[0021] Figure 4 is a flow chart of a method for protecting data flow security according to at least one embodiment of the present invention;

[0022] Figure 5 is a flow chart of forming a quantum root key by a security agent processing according to at least one embodiment of the present invention;

[0023] Figure 6 is a flow chart of deriving a first quantum-derived key by a security agent according to at least one embodiment of the present invention;

[0024] Figure 7 is a schematic diagram of the structure of a quantum key tree according to at least one embodiment of the present invention;

[0025] Figure 8 is a flowchart of decrypting a first ciphertext using a second quantum-derived key according to at least one embodiment of the present invention;

[0026] Fig. 9 is a schematic diagram of a security situation awareness platform according to at least one embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. However, it can be understood by those skilled in the art that in the embodiments of the present invention, many technical details are provided to enable readers to better understand the present invention. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present invention can be implemented.

[0028] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there may be three relationships, for example, A and / or B, which can represent: A exists alone, A and B exist at the same time, and B exists alone. The terms "include" and "have" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. In addition, the terms "first" and "second" are used only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0029] The purpose of the present invention is to use a quantum key tree structure to store and manage quantum keys, and to use the quantum key tree to solve the security responsibility logic and business / user isolation problems of data flowing between nodes. The realization of the above invention purpose can rely on a data management system. The overall network architecture of the data management system can be divided into a core layer and a convergence layer. The hardware environment of the data management system can be as follows: Figure 1 shown.

[0030] The core layer corresponds to Figure 1 The centralized control station of the quantum network shown in . The centralized control station can specifically include a quantum key management service system server and a quantum network element management system. Among them, the quantum key management service system server is used to realize the management of all quantum devices in the quantum network, quantum key generation control and quantum key routing control and other functions. In addition, the quantum network element management system is used to accept the management of the quantum network element management system through the EMS northbound interface to realize the management function of quantum devices at all sites in the quantum network. The upstream connection of the centralized control station can use a dual-fiber link to complete the export connection between the metropolitan area network and the backbone network equipment, and the downstream connection is connected to the user node through the external network switch. The centralized control station is mainly responsible for connecting to the backbone network, responsible for the convergence of the business control layer equipment within the metropolitan area network, and the large-capacity and high-speed forwarding of messages between the nodes of the network.

[0031] The pooling layer corresponds to Figure 1The aggregation station and user station of the quantum network shown in the figure, the aggregation station can be divided into the classical network external network area and the quantum device network area. Among them, the classical network external network area is used to realize the interconnection between Ethernet service data points, and the quantum device network area is used to realize the quantum key transmission between stations, as well as the key and instruction information exchange between the quantum gateway and the key management machine within the station. The user nodes in the user station deploy quantum key generation and management terminals (such as quantum all-in-one machines), and realize quantum key distribution with quantum key distribution devices (such as quantum all-in-one machines, single-receive quantum key distribution devices QKD-B) through optical quantum switches, and realize functions such as quantum key management and relay. It should also be noted that the aggregation station is equipped with switches in each area of ​​the classical network external network area and the quantum device network area for service aggregation, and interconnects each network area, and uses firewalls for regional isolation. The user nodes in the user station adopt a dual-fiber mode, which is used for quantum channels (such as Figure 1 The dashed line in the middle) and the classical channel (as shown in Figure 1 The user node is connected to the quantum network through a quantum secure encryption router, the quantum all-in-one machine (or single-shot quantum key generation and management terminal) is connected to the centralized control station through a quantum channel, and the user access switch is connected to the centralized control station through a quantum classical channel.

[0032] Based on the above-mentioned software and hardware environment, at least one embodiment of the present invention proposes a method for protecting the security of data flow, which is applicable to a security situation awareness platform. The security situation awareness platform mentioned here includes an embedded quantum middleware, a security agent deployed on the first object side, and a key engine deployed on the security situation awareness platform side. The security agent is encapsulated in the quantum security gateway of the user station, and the key engine is encapsulated in the quantum security gateway of the aggregation station. Among them, the quantum middleware is used to centrally manage and control the security agent and the key engine, introduce the traffic that needs to be securely transmitted into the quantum encryption router through static routing or policy routing, complete the traffic encryption and introduce the ciphertext traffic into the quantum security transmission channel, and then send the traffic to the target node according to the government external network routing.

[0033] Security Agent (see Figure 1 The quantum security gateway in the user station shown in the figure is used to encapsulate quantum keys into standard security capabilities, including keys, algorithms, cryptographic protocols, etc., and provide user nodes with identity authentication, key negotiation, cryptographic operations, key management and other functions in the form of standard API (Application Programming Interface). The security agent is deployed on the first object side. The first object mentioned here can be the provider of data, that is, the user to which the user station of the data management platform is facing. The connection diagram of the security agent and the user / service (first object) can be referred to Figure 2 The schematic diagram of the structure of the first object accessing the network can be referred to Figure 3 .

[0034] Key Engine (see Figure 1 The quantum security gateway in the aggregation station shown in the figure is deployed on the security situation platform side, and its function is similar to that of the security agent, which is used to encapsulate the quantum key into a standard security capability and provide it to the security situation awareness platform. It is also worth mentioning that the security situation awareness platform also includes a convergence and diversion device, which includes a traffic data security management and control platform and a traffic collection and monitoring probe unit. Among them, the traffic data security management and control platform builds a unified traffic data basic platform to support traffic data delivery needs, and can form a complete traffic scheduling data delivery network by self-organizing; the traffic collection and monitoring probe unit introduces an advanced SDN architecture for bypass traffic data management, and all its ports support traffic access / traffic control output.

[0035] It should be noted that before executing the steps included in the method for protecting the security of data flow, the authorization and network access process within the first object can be performed first, including: the security agent deployed at the first object initiates a network access request to the quantum middleware embedded in the security situation awareness platform; the quantum middleware authenticates and authorizes the security agent; after successful authorization, the quantum middleware sends service policies, configuration policies, and quantum key tree policies (including traffic delivery, key delivery, etc.) to the security agent; the security agent initializes service interfaces, configuration information, quantum key tree policies and other information, and the middleware platform synchronously updates the security agent information; wherein, the user service at the first object uses the task template of the software service bus or the master control program to call the software plug-in with the security agent API to realize identity authentication of the first object and confidentiality and integrity protection of the service and data.

[0036] It is worth mentioning that the identity authentication and key setting of the first object mentioned here can be initiated by the security situation awareness platform and triggered by the authentication process.

[0037] The following is a detailed description of the implementation details of the method for protecting data flow security in this embodiment. The following content is only for the convenience of understanding the implementation details of this solution and is not necessary for implementing this solution. Figure 4 As shown, the following steps may be included:

[0038] Step 101, obtaining a first ciphertext of a first object, wherein the first ciphertext is formed by encrypting the return data of the first object with a first quantum derived key, and the first quantum derived key is derived based on a quantum root key derived at least once;

[0039] Step 102: Decrypt the first ciphertext using the second quantum-derived key to obtain the returned data, wherein the second quantum-derived key is derived by the key engine based on at least one derivation of the quantum root key.

[0040] Through the above-mentioned method of the present invention, a quantum derived key tree structure is used to store and manage quantum keys, and the derived key tree (first quantum derived key, second quantum derived key) is used to solve the security responsibility logic and business / user isolation problems of each flow node in the data flow process, and the security of data in the flow process is also improved.

[0041] In step 101, the first ciphertext of the first object is obtained. For ease of explanation, the foregoing content of this embodiment only involves one first object. It can be understood that the user station of the data management system can actually access multiple first objects to protect the security of the return data flow of multiple first objects. The first object can be the provider of the data, that is, the user facing the user station, for example, major communication operators and major government cloud platform service providers. In this step, the first object obtains the return data in the network core layer by traffic replication or splitting. The return data is encrypted by the first quantum derived key to form a first ciphertext. The return data can be ICT business data such as the Internet of Things and the Internet of Vehicles, or cloud application data such as OA, CRM, ERP, MES, or security log information of systems and security devices.

[0042] In some embodiments, the security agent also communicates with the first quantum machine (see Figure 1 The key engine is also connected to the second quantum machine ( Figure 1 The second quantum integrated machine is connected to the first quantum integrated machine via a quantum channel (such as Figure 1 The dashed line in the middle) and the classical channel (as shown in Figure 1 The security agent and the key engine of the present invention are connected through a business channel via the quantum middleware. The security agent and the key engine of the present invention obtain a shared quantum root key through the quantum middleware negotiation, for example: the security agent sequentially or randomly obtains the integrity protection key vector and the encryption key vector from the first quantum integrated machine, and processes the integrity protection key vector and the encryption key vector to form a quantum root key; the quantum middleware negotiates that the quantum root key at the first quantum integrated machine connected to the security agent is shared to the second quantum integrated machine connected to the key engine via the quantum channel and the classical channel.

[0043] It is worth noting that the first quantum integrated machine involved in the above embodiment may include three business units, which are respectively connected to the user access switch through RJ45 jumpers (the user access switch isolates quantum services through VLAN technology); the first quantum integrated machine accesses the quantum metropolitan area network through the uplink link to establish a classical channel for quantum communication, so that the quantum devices at both ends can negotiate through the classical channel, thereby completing the management process of quantum key generation, storage, and equipment management; the quantum devices at both ends send and receive optical signals for quantum communication through optical fiber links.

[0044] Optionally, the quantum root key is securely delivered to the security agent via the key output interface of the first quantum integrated machine and the key input interface of the security agent. In some embodiments, the security agent can sequentially or randomly obtain two tag keys from the first quantum integrated machine, and add timestamp information or other information to the two tag keys to form an integrity protection key vector and an encryption key vector, and process the integrity protection key vector and the encryption key vector to form a quantum root key, and then the quantum root key is delivered to the key input interface of the security agent via the key output interface. The encryption key vector is deformed relative to the integrity protection key vector, and the encryption key vector is equivalent to a scrambling code, and its purpose is to improve timing recovery capability and confidentiality. The integrity protection key vector plays an error correction role. If there is no integrity protection key vector, there will be problems such as the inability to correct errors and the inability to identify tampering. Figure 5 As shown, the integrity protection key vector and the encryption key vector are processed to form a quantum root key, which may include the following steps:

[0045] Step 201, the integrity protection key vector and the encryption key vector are processed based on the KDF function to form a quantum root key, wherein the quantum root key = KDF (integrity protection key vector and encryption key vector, Salt, Iterations), Salt includes at least one of the following: service node ID, user ID, service ID, sequence number, non-secret parameter, Iterations is a preset number of iterations;

[0046] Step 202: Using a KDF function to process the preset integrity protection identifier, encryption identifier, and quantum root key to form a fifth quantum derived key, and using a trunc function to process the fifth quantum derived key to form a sixth quantum derived key, wherein the sixth quantum derived key is provided to a core network connected via an air interface.

[0047] Through the above-mentioned method of the present invention, the kdf function is used to derive sub-keys of different levels according to the user / service ID, flow node ID, etc., thereby realizing encryption of different levels (process) data of the user service, which not only better realizes the storage and management of quantum keys, but also solves the problems of security responsibility logic and service / user isolation in the data flow process.

[0048] In step 201, the integrity protection key vector and the encryption key vector are processed based on the KDF function to form a quantum root key. The KDF (Key derivation function) function is a key derivation function. DK = KDF (Key, Salt, Iterations), which means that one or more derived keys DK are derived from the master key Key using a pseudo-random function, that is, the KDF function can be used to extend the key to a longer key or obtain a key in a required format. In this step, the integrity protection key vector and the encryption key vector are used as the master key, and the KDF function is used to obtain DK as the quantum root key. Salt is a random number used as a password salt, which is equivalent to a scrambling code, which can increase the difficulty for attackers to crack the quantum root key, thereby improving the security of the quantum root key; Salt can include at least one of the following: business node ID, user ID, business ID, serial number, non-secret parameters, so that attackers who obtain the quantum root key can be prevented from learning useful information about the input secret value or any other derived key. Iterations is a preset number of iterations, which can correspond to different levels of ICT users / businesses (i.e., the first object), such as processes. It is worth mentioning that the Salt and Iterations values ​​can be stored with the hashed password or transmitted in plain text in an encrypted message.

[0049] In step 202, the preset integrity protection identifier, encryption identifier and quantum root key are processed by using the KDF function to form a fifth quantum derivative key, and the fifth quantum derivative key is processed by using the trunc function to form a sixth quantum derivative key, wherein the sixth quantum derivative key is provided to the core network connected via the air interface. That is to say, after generating the quantum root key, the present invention can not only derive the first quantum derivative key for data encryption, but also derive the sixth quantum derivative key for use by the core network, so that the data of users or services connected to the core network via the air interface also meets the isolation requirements.

[0050] It is worth noting that if the integrity protection key vector and encryption key vector require a 128-bit key as input, the key will be truncated by the trunc function and the 128 least significant bits will be used; the trunc function accepts a 256-bit string as input and returns a predefined truncated output.

[0051] In some embodiments, the first quantum derivative key used to encrypt the return data of the first object can be derived by the key engine. In these embodiments, obtaining the first ciphertext of the first object may include: the security agent transmits the quantum root key to the key engine via the business channel, the key engine derives the first quantum derivative key based on the quantum root key and the identifier of the first object at least once, and the key engine encrypts the return data using the first quantum derivative key to obtain the first ciphertext. This method in which the security agent transmits the quantum root key to the key engine for the key engine to derive the quantum key tree can be called a quantum secret key tree strategy for quantum root key delivery. It can be understood that the method of quantum root key delivery focuses on protecting user services on user nodes (first objects).

[0052] In some embodiments, the first quantum derived key for encrypting the returned data of the first object may be derived by a security agent. In these embodiments, obtaining the first ciphertext of the first object may include: the security agent derives the first quantum derived key based on the quantum root key and the identifier of the first object at least once; and encrypts the returned data using the first quantum derived key to obtain the first ciphertext. Since the first quantum derived key is derived based on the identifier of the first object, based on this, the first objects cannot access each other's data, thereby achieving logical isolation and slice protection of the data, and effectively improving the security of the data.

[0053] Optionally, the security agent uses the first quantum-derived key to encrypt the returned data to obtain the first ciphertext. The way in which the security agent derives the quantum key tree and encrypts the returned data to obtain the first ciphertext can be called a quantum key tree strategy for ciphertext delivery, which focuses on protecting data traffic. Optionally, the security agent transmits the derived first quantum-derived key to the key engine through the quantum middleware through the service channel, so that the key engine uses the first quantum-derived key to encrypt the returned data to obtain the first ciphertext. This can be called a quantum key tree strategy for first quantum-derived key delivery, which focuses on protecting user nodes (i.e., the first object). Consider Figure 6 As shown, the security agent or key engine derives the first quantum derivative key based on the quantum root key and the identifier of the first object at least once, which may include the following steps:

[0054] Step 301, processing the quantum root key and / or the identifier of the first object based on the KDF function to form a third quantum derived key, where the identifier of the first object includes at least one of the following: a network identifier, a user identifier, a service identifier, a service level identifier, a process identifier, and an identifier of each node in the data flow process;

[0055] Step 302, processing the third quantum derived key based on the KDF function to form a fourth quantum derived key, and processing the fourth quantum derived key through a trunc function to form a first quantum derived key;

[0056] Step 303, encrypt the returned data using the first quantum derived key formed by the quantum root key through the third quantum derived key and the fourth quantum derived key derivation process.

[0057] Through the above-mentioned method of the present invention, the kdf function is used to derive sub-keys of different levels according to the user service ID, the flow node ID, etc., to realize the encryption of different levels of user service data, which not only realizes the storage and management of quantum keys better, but also solves the problems of security responsibility logic and service / user isolation in the data flow process. The first quantum derivative key and the sixth quantum derivative key are derived based on the quantum root key, and the structure diagram of the derived quantum key tree is as follows: Figure 7 shown.

[0058] In view of the fact that a large number of keys will be generated when performing quantum encryption for massive data of ICT applications, these keys will occupy a large amount of storage space, so how to store a large number of keys has become a huge challenge facing users today. The present invention forms a quantum key tree through the derivation process of the third quantum derivative key and the fourth quantum derivative key, and uses the first quantum derivative key finally derived to encrypt the returned data. The quantum key tree structure can be used to store and manage quantum keys, reducing the storage resources required for quantum keys. In addition, the KDF function is used to derive sub-keys of different levels based on the identifier of the first object, thereby realizing the encryption of data of different levels (processes) of user services, thereby also solving the problems of security responsibility logic and service / user isolation during data flow.

[0059] In some embodiments, the present invention can also be used as a public key infrastructure, introducing certificates and public-private key systems, that is, the security agent uses the public key to encrypt K1, and the ciphertext is sent to the security engine via the Internet. The security engine uses the private key to decrypt the key to obtain K1, and then the two parties perform heterogeneous processing on K1 and the first quantum derived key to form a working key KK. The security agent or key engine uses the working key KK to encrypt the plaintext traffic.

[0060] In step 102, the first ciphertext is decrypted using the second quantum-derived key to obtain the return data. After the return data is decrypted, the security situation awareness platform can further perform security monitoring and analysis on the decrypted return data. The second quantum-derived key is derived by the key engine based on the quantum root key at least once. For the quantum key tree strategy of ciphertext delivery, step 102 may include: the key engine derives the second quantum-derived key based on the shared quantum root key, and uses the second quantum-derived key to decrypt the received first ciphertext; for the quantum key tree strategy of first quantum-derived key delivery or quantum root key delivery, step 102 may include: the security agent uses the second quantum-derived key to decrypt the first ciphertext.

[0061] Since the security agent and the key engine obtain a shared quantum root key through the quantum middleware negotiation, the quantum middleware can centrally manage and control the security agent and the key engine, which means that the present invention creates a cross-domain management mechanism for the key service (quantum middleware) and key management (security agent, key engine). Figure 8 As shown, the first ciphertext is decrypted using the second quantum derived key to obtain the returned data. The reference flow diagram may include the following sub-steps:

[0062] Step 1021, processing the quantum root key and / or the identifier of the first object based on the KDF function to form a seventh quantum derived key, the identifier of the first object including at least one of the following: a network identifier, a user identifier, a service identifier, a service level identifier, a process identifier, and an identifier of each node in the data flow process;

[0063] Step 1022, processing the seventh quantum derived key based on the KDF function to form an eighth quantum derived key, and processing the eighth quantum derived key through a trunc function to form a second quantum derived key;

[0064] Step 1023, using the second quantum derived key formed by the quantum root key through the seventh quantum derived key and the eighth quantum derived key derivation process to decrypt the first ciphertext to obtain the returned data.

[0065] It should be noted that the identifier of the first object used to derive the second quantum derivative key in this embodiment can be transmitted to the key engine by the security agent through the quantum middleware through the classical channel. Based on the method for protecting the security of data flow provided by this embodiment, a quantum key tree can be configured on a network device shared by two or more networks, so that although different ICT user services are carried on the network device, they cannot access each other. While using the quantum key tree to improve the security performance of ICT users / services, the logical isolation and slice protection of ICT user services are better achieved, and less storage resources are occupied.

[0066] In addition, the security situation awareness platform in this embodiment is responsible for building a multi-dimensional statistical model to conduct massive heterogeneous big data analysis, form a panoramic view of security, support security decision-making, emergency response, and issue security warnings and security patches. It can effectively improve the network security risk assessment, security risk perception, monitoring and early warning, attack source tracing and evidence collection, and emergency security reinforcement capabilities of government users. The security situation awareness platform governs the network with business as the center to achieve a business-centric security resilience architecture. It can ensure that the system continues to ensure the confidentiality, integrity, availability and other security goals of the business when certain security agreements do not exist (such as: threats cannot be eliminated, vulnerabilities cannot be repaired, and some security functions fail). Furthermore, the security situation awareness platform can provide a list of integrity protection algorithms and a list of encryption algorithms, which are prioritized by operators.

[0067] In addition, it is worth noting that the present invention allows the use of 128-bit AS encryption protection and NAS integrity protection keys, and the network interface supports 256-bit keys for future use.

[0068] Some embodiments of the present invention also propose a data management system. The data management system at least includes a security situation awareness platform, which includes a quantum middleware, a security agent deployed on the first object side, and a key engine deployed on the security situation awareness platform side. The security agent is also connected to the first quantum integrated machine, and the key engine is also connected to the second quantum integrated machine. The second quantum integrated machine is connected to the first quantum integrated machine through a quantum channel and a classical channel; the security situation awareness platform is used to implement the method for protecting the security of data flow involved in the aforementioned embodiments. The data management system involved in this embodiment can continue to refer to Figure 1 .

[0069] In some embodiments, the first quantum integrated machine is connected to the centralized control station via the user access switch, the user aggregation switch, and the external network switch, and establishes a classical channel with the second quantum integrated machine. The first quantum integrated machine establishes a quantum channel with the second quantum integrated machine via the optical quantum switch; the user access switch of the first object establishes a service channel between the first object and the security situation awareness platform via the first quantum security gateway and the second quantum security gateway.

[0070] Some embodiments of the present invention also provide a security situation awareness platform, such as Fig. 9As shown, it includes: a processor 901; and a memory 903, configured to store computer program instructions, the computer program instructions are suitable for being loaded by the processor and executing the method for protecting the security of data flow developed by the present invention. Optionally, at least one embodiment of the present invention also provides a computer-readable non-volatile storage medium, storing computer program instructions, when the computer executes the program instructions, the method for protecting the security of data flow developed by the present invention is executed.

[0071] The processor 901 can be any applicable processor, for example, implemented in the form of a central processing unit, a microprocessor, an embedded processor, etc., and can adopt an architecture such as X86, ARM, etc. The memory 903 can be any applicable storage device, such as a non-volatile storage device, including but not limited to a magnetic storage device, a semiconductor storage device, an optical storage device, etc., and can be arranged as a single storage device, a storage device array, or a distributed storage device, which is not limited by the embodiments of the present invention. It can be understood by those skilled in the art that the structure of the security situation awareness platform described above is only illustrative and does not limit the structure of the device. For example, the security situation awareness platform may also include: Fig. 9 The transmission device is used to receive or send data via a network. In one embodiment, the transmission device is a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0072] It can be understood that the technical details involved in the aforementioned embodiments and the technical effects that can be achieved are still applicable in this embodiment. In order to reduce repetition, they will not be repeated in this embodiment.

[0073] The above embodiments are provided to those of ordinary skill in the art to implement and use the present invention. Those of ordinary skill in the art can make various modifications or changes to the above embodiments without departing from the inventive concept of the present invention. Therefore, the protection scope of the present invention is not limited to the above embodiments, but should conform to the maximum scope of the innovative features mentioned in the claims.

Claims

1. A method for protecting data flow security, applicable to a security situation awareness platform that manages quantum keys using a quantum-derived key tree structure, characterized in that: The security situation awareness platform includes a quantum middleware, a security agent deployed on the first object side, and a key engine deployed on the security situation awareness platform side, including: Obtaining a first ciphertext of a first object, wherein the first ciphertext is formed by encrypting the returned data of the first object with a first quantum-derived key, and the first quantum-derived key is derived by the security agent based on at least one derivation of a quantum root key; The first ciphertext is decrypted using a second quantum-derived key to obtain the returned data, wherein the second quantum-derived key is derived by the key engine based on at least one derivation of the quantum root key, and the security agent and the key engine obtain a shared quantum root key through negotiation by the quantum middleware.

2. According to the method of claim 1, the security agent is also connected to the first quantum integrated machine, the key engine is also connected to the second quantum integrated machine, the second quantum integrated machine is connected to the first quantum integrated machine through a quantum channel and a classical channel, and the security agent is connected to the key engine through a service channel via the quantum middleware, characterized in that: The security agent and the key engine negotiate through the quantum middleware to obtain a shared quantum root key, which includes: The security agent sequentially or randomly obtains an integrity protection key vector and an encryption key vector from the first quantum integrated machine, and processes the integrity protection key vector and the encryption key vector to form the quantum root key; Through negotiation by the quantum middleware, the quantum root key at the first quantum integrated machine connected to the security agent is shared to the second quantum integrated machine connected to the key engine via the quantum channel and the classical channel.

3. The method according to claim 1, characterized in that The decrypting the first ciphertext using the second quantum-derived key to obtain the returned data includes: Processing the quantum root key and / or the identifier of the first object based on the KDF function to form a seventh quantum derived key, wherein the identifier of the first object includes at least one of the following: a network identifier, a user identifier, a service identifier, a service level identifier, a process identifier, and an identifier of each node in a data flow process; An eighth quantum-derived key is formed by processing the seventh quantum-derived key based on a KDF function, and the eighth quantum-derived key is processed by a trunc function to form a second quantum-derived key; The first ciphertext is decrypted using the second quantum derived key formed by the quantum root key through the seventh quantum derived key and the eighth quantum derived key to obtain the returned data.

4. The method according to claim 2, characterized in that: Obtaining a first ciphertext of a first object includes: The security agent derives the first quantum derivative key based on the quantum root key and the identifier of the first object at least once; The returned data is encrypted using the first quantum-derived key to obtain the first ciphertext.

5. The method according to claim 4, characterized in that Encrypting the returned data using the first quantum-derived key includes: The security agent encrypts the returned data using the first quantum-derived key to obtain the first ciphertext; Alternatively, the security agent transmits the derived first quantum-derived key to the key engine via a service channel, so that the key engine uses the first quantum-derived key to encrypt the returned data to obtain the first ciphertext.

6. The method according to claim 2, characterized in that Obtaining the first ciphertext of the first object further includes: The security agent transmits the quantum root key to the key engine via a service channel, so that the key engine derives the first quantum derivative key based on the quantum root key and the identifier of the first object at least once, and the key engine encrypts the returned data using the first quantum derivative key to obtain the first ciphertext.

7. The method according to claim 5 or 6, characterized in that: Derivation of the first quantum derivative key based on the quantum root key and the identifier of the first object at least once comprises: Processing the quantum root key and / or the identifier of the first object based on the KDF function to form a third quantum derived key, wherein the identifier of the first object includes at least one of the following: a network identifier, a user identifier, a service identifier, a service level identifier, a process identifier, and an identifier of each node in a data flow process; Processing the third quantum-derived key based on a KDF function to form a fourth quantum-derived key, and processing the fourth quantum-derived key using a trunc function to form a first quantum-derived key; The returned data is encrypted using the first quantum derived key formed by deriving the quantum root key from the third quantum derived key and the fourth quantum derived key.

8. The method according to claim 2, characterized in that: The security agent processes the integrity protection key vector and the encryption key vector to form the quantum root key, including: Processing the integrity protection key vector and the encryption key vector based on the KDF function to form a quantum root key, wherein the quantum root key = KDF (integrity protection key vector and encryption key vector, Salt, Iterations), the Salt includes at least one of the following: a service node ID, a user ID, a service ID, a sequence number, a non-secret parameter, and the Iterations is a preset number of iterations; The preset integrity protection identifier and encryption identifier and the quantum root key are processed by using a KDF function to form a fifth quantum derived key, and the fifth quantum derived key is processed by using a trunc function to form a sixth quantum derived key, wherein the sixth quantum derived key is provided to a core network connected via an air interface.

9. A data management system, characterized in that: The invention comprises a security situation awareness platform, wherein the security situation awareness platform comprises a quantum middleware, a security agent deployed on the first object side, and a key engine deployed on the security situation awareness platform side, wherein the security agent is also connected to the first quantum integrated machine, and the key engine is also connected to the second quantum integrated machine, and the second quantum integrated machine is connected to the first quantum integrated machine through a quantum channel and a classical channel; The security situation awareness platform is used to implement the method for protecting data flow security as described in any one of claims 1 to 8.

10. The data management system according to claim 9, characterized in that: Also includes: The first quantum integrated machine is connected to the centralized control station via the user access switch, the user aggregation switch, and the external network switch, and a classical channel is established with the second quantum integrated machine. The first quantum integrated machine establishes a quantum channel with the second quantum integrated machine via the optical quantum switch. The user access switch of the first object establishes a service channel between the first object and the security situation awareness platform via the first quantum security gateway and the second quantum security gateway.

Images