Method for monitoring the entire life cycle of quantum keys and secure execution module

Abstract

The embodiment of the present application relates to the field of quantum communication technology, and discloses a method for monitoring the entire life cycle of a quantum key and a secure execution module. The method for monitoring the entire life cycle of a quantum key is applicable to a secure execution module deployed on the client side, and includes: receiving a key creation request from a client, wherein the key creation request carries a parent key identifier; deriving a first quantum key according to the parent key identifier, and returning the quantum key ID of the first quantum key to the client; synchronizing the life cycle information of the first quantum key to a fusion security management platform. After the quantum key is generated, the life cycle process of the quantum key can be monitored through the secure execution module to synchronize the life cycle information of the quantum key to the quantum fusion security management platform, thereby supporting the fusion security management platform to supervise the life cycle of the quantum key, which is conducive to improving the security and confidentiality of the quantum key.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of quantum communication technology, and in particular to a method for monitoring the entire life cycle of a quantum key and a secure execution module. Background Art

[0002] Encrypted communication refers to a communication technology in which both parties perform special information transformation according to agreed rules during the communication process. Specifically, during the communication process, the sender encrypts according to the agreed rules and transforms the plaintext into ciphertext; the receiver decrypts according to the agreed rules and transforms the ciphertext into plaintext. The agreed rules are cryptographic algorithms, which can be abstracted as y=f(x, key), where x is the information sent, y is the output obtained by the cryptographic algorithm, and key is the key.

[0003] Among them, according to the viewpoint of modern cryptographic system, the security of the entire cryptographic system does not depend on the confidentiality of cryptographic algorithms or the protection of encryption devices, but on the confidentiality of keys. Cryptographic algorithms can be made public, cryptographic devices can be lost, and encryption devices of the same model can continue to be used, but if the key is lost or wrong, illegal users will steal information, and leaking the key to others means that encrypted documents are worse than using plain text. Therefore, key management is extremely important in the design of computer security and confidentiality systems, including the management of a series of technical issues such as key generation, distribution, storage, organization, use, and destruction, as well as the management of administrative management and personnel quality issues.

[0004] However, there is currently no suitable solution to regulate the life cycle of quantum keys, which is not conducive to the security and confidentiality of quantum keys. Summary of the invention

[0005] The embodiment of the present application provides a method for monitoring the entire life cycle of a quantum key and a security execution module. After the quantum key is generated, the life cycle process of the quantum key can be monitored through the security execution module to synchronize the life cycle information of the quantum key to the quantum fusion security management platform, thereby supporting the fusion security management platform to supervise the life cycle of the quantum key, which is conducive to improving the security and confidentiality of the quantum key.

[0006] According to some embodiments of the present application, on the one hand, the embodiments of the present application provide a method for monitoring the entire life cycle of a quantum key, which is applicable to a security execution module deployed on the client side, and the security execution module is connected to a fusion security management platform and managed by the fusion security management platform, including: receiving a key creation request from a client, wherein the key creation request carries a parent key identifier; deriving a first quantum key based on the parent key identifier, and returning the quantum key ID of the first quantum key to the client; synchronizing the life cycle information of the first quantum key to the fusion security management platform.

[0007] According to some embodiments of the present application, on the other hand, the embodiments of the present application further provide a secure execution module, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for monitoring the entire life cycle of a quantum key as provided in any embodiment of the present application.

[0008] The technical solution provided by the embodiment of the present application has at least the following advantages: after receiving the key creation request from the client, the security execution module can derive the first quantum key according to the parent key identifier carried in the key creation request, realize the generation of the quantum key, and start the life cycle of the quantum key. Therefore, when the life cycle information changes with the development of the quantum key life cycle, the life cycle of the quantum key can be monitored and the corresponding life cycle information can be synchronized to the fusion security management platform to which it is connected, so as to support the centralized and unified life cycle supervision of the quantum key on the fusion security management platform, thereby improving the security and confidentiality of the quantum key. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0010] Figure 1 It is a schematic diagram of the setting of the existing desired quantum secure communication application service layer;

[0011] Figure 2 This is a schematic diagram of the structure of a system for monitoring the entire life cycle of a quantum key provided in an embodiment of the present application;

[0012] Figure 3 This is another structural diagram of a system for monitoring the entire life cycle of a quantum key provided in one embodiment of the present application;

[0013] Figure 4 is a schematic diagram of the structure of a secure execution module provided in an embodiment of the present application;

[0014] Figure 5 This is a flow chart of a method for monitoring the entire life cycle of a quantum key provided in an embodiment of the present application;

[0015] Figure 6 It is another flow chart of the method for monitoring the entire life cycle of a quantum key provided in one embodiment of the present application;

[0016] Figure 7 It is another flow chart of the method for monitoring the entire life cycle of a quantum key provided in one embodiment of the present application;

[0017] Figure 8 It is another flow chart of the method for monitoring the entire life cycle of a quantum key provided in one embodiment of the present application;

[0018] Fig. 9 It is a flowchart of synchronizing information to a fusion security management platform during deregistration involved in the method for monitoring the entire life cycle of a quantum key provided in one embodiment of the present application;

[0019] Fig.10 It is a flow chart of synchronizing information to a fusion security management platform when deactivating the method for monitoring the entire life cycle of a quantum key provided in one embodiment of the present application;

[0020] Fig.11 It is a flowchart of synchronizing information to a fusion security management platform during updates involved in the method for monitoring the entire life cycle of a quantum key provided in one embodiment of the present application;

[0021] Fig.12 It is a flowchart of synchronizing information to a fusion security management platform during recovery and backup involved in a method for monitoring the entire life cycle of a quantum key provided in an embodiment of the present application;

[0022] Fig.13 It is an interactive flow chart of the derivation involved in the method for monitoring the entire life cycle of a quantum key provided in one embodiment of the present application;

[0023] Fig.14 It is an interactive flow chart of the update involved in the method for monitoring the entire life cycle of a quantum key provided in one embodiment of the present application;

[0024] Fig.15 It is an interactive flow chart of expiration involved in the method for monitoring the entire life cycle of a quantum key provided in an embodiment of the present application;

[0025] Fig.16 It is an interactive flow chart of encryption and decryption operations involved in the method for monitoring the entire life cycle of a quantum key provided in one embodiment of the present application;

[0026] Fig.17 This is a schematic diagram of the communication architecture between a security execution module related to a quantum key lifecycle management method provided in one embodiment of the present application and a key management / key service of a client business system. DETAILED DESCRIPTION

[0027] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the present application, many technical details are proposed in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can also be implemented. The division of the following embodiments is for the convenience of description, and the specific implementation of the present application should not be construed as any limitation, and the various embodiments can be combined and referenced with each other under the premise of no contradiction.

[0028] Although there is no suitable solution to regulate the life cycle of quantum keys, there have been some discussions. For example, Key Management (KM) has been proposed to be responsible for receiving and managing the keys generated by the quantum key distribution network module throughout its life cycle, relaying the keys and providing the keys to cryptographic applications. And considering that the quantum key distribution network is difficult to adapt to diverse applications and the carrying capacity of the quantum key distribution network is limited, in order to better form a systematic quantum secure communication service, it has been proposed to add a quantum secure communication application service layer between the underlying quantum key distribution network and the upper user network to perform quantum key life cycle management between the client and the quantum key distribution network, so as to improve the security and confidentiality of quantum keys. Specifically, the setting of the quantum secure communication application service layer is as follows: Figure 1 As shown, it is located between the client and the quantum key distribution network, which can organically connect the quantum key distribution network with various clients and their business applications and user networks, and support the full life cycle management of quantum keys. Figure 1 The architecture shown is a concept only and does not imply a practical solution.

[0029] Based on this, the embodiment of the present application provides a system for monitoring the entire life cycle of a quantum key. The system can be used as a quantum secure communication application service layer and can be connected to a quantum key distribution network (Quantum Key Distribution Network, QKDN) and a client. In some embodiments, such as Figure 2As shown, the system consists of a security execution module (SEM) and a harmonized security control module (HSCM). The harmonized security management platform can manage and control the security execution module, and can receive and manage the life cycle information of the quantum key monitored by the security execution module, so as to supervise the life cycle of the quantum key; the security execution module is a cryptographic computing device for data encryption and decryption, and has key generation / storage, digital signature / signature verification, identity authentication, data encryption / decryption, random numbers, and key life cycle management capabilities. In order to facilitate those skilled in the art to better understand the harmonized security management platform and security execution module provided in the above embodiment, they will be explained below.

[0030] Regarding the integrated security management platform: In some embodiments, the integrated security management platform can be divided into two levels of nodes: core nodes and access nodes according to node types. Figure 3 As shown, the integrated security management platform can be regarded as an application security management network composed of several core nodes and several access nodes. Among them, a core node (or an access node) is a sub-platform, and each access node is connected to the corresponding core node, and there is also a connection relationship between the core nodes. In this way, through the connection between the security execution module and the access node, the connection between the access node and the core node, and the connection between the core nodes, the cross-domain interconnection and interoperability of the system that monitors the entire life cycle of the quantum key is realized. Of course, the number of nodes in the integrated security management platform is not limited, and the core nodes and access nodes can be one-to-many or many-to-many.

[0031] In addition, the integrated security management platform can be divided into two parts according to its functions: the application management system and the key management system. The application management system provides the functions of managing users, devices, network management, network management, and billing; the key management system provides the function of managing the quantum key life cycle. In some cases, it is understandable that the quantum network may involve users, devices, gateways, billing, etc. located in different metropolitan area networks. Therefore, the application management system can adopt several units that are interconnected across domains, and these units can adopt a distributed architecture. The key management system is mainly for the supervision of the quantum key life cycle information. Therefore, the key management system can adopt centralized management, that is, it can be a central server.

[0032] Regarding the security execution module: In some embodiments, the security execution module is as follows: Figure 4As shown, it includes: at least one processor 401; and a memory 402 that is communicatively connected to the at least one processor 401; wherein the memory 402 stores instructions that can be executed by the at least one processor 401, and the instructions are executed by the at least one processor 401 so that the at least one processor 401 can execute the method for monitoring the entire life cycle of a quantum key applied to a secure execution module described in an embodiment of the present application.

[0033] Among them, the memory 402 and the processor 401 are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors 401 and the memory 402 together. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art, and therefore, are not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor 401 is transmitted on a wireless medium through an antenna, and further, the antenna also receives data and transmits the data to the processor 401. The processor 401 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. The memory 402 can be used to store data used by the processor 401 when performing operations.

[0034] It is not difficult to find that the present embodiment is a module embodiment corresponding to the method embodiment, and the present embodiment can be implemented in conjunction with the method embodiment. The relevant technical details mentioned in the method embodiment are still valid in the present embodiment, and will not be repeated here to reduce repetition. Correspondingly, the relevant technical details mentioned in the present embodiment can also be applied in the method embodiment. Among them, the method embodiment will be explained later, so it will not be repeated here. It should be noted that in order to highlight the innovative part of the present application, the above embodiments do not introduce units that are not closely related to the quantum key lifecycle supervision process, but this does not mean that there are no other units in the system, integrated security management platform and security execution module described in the above embodiments.

[0035] In order to monitor the life cycle of quantum keys and their life cycle information, the present application also provides a method for monitoring the entire life cycle of quantum keys, which can be used in conjunction with the security execution module provided in the above embodiments. In some embodiments, the method for monitoring the entire life cycle of quantum keys is applicable to a security execution module, which is connected to and managed by the fusion security management platform. The process is as follows: Figure 5 As shown, the following steps are included:

[0036] Step 501: Receive a key creation request from a client, where the key creation request carries a parent key identifier.

[0037] Step 502: derive a first quantum key according to the parent key identifier, and return the quantum key ID of the first quantum key to the client.

[0038] Step 503: Synchronize the lifecycle information of the first quantum key to the integrated security management platform.

[0039] In this way, after receiving the key creation request from the client, the security execution module can derive the first quantum key according to the parent key identifier carried in the key creation request, realize the generation of the quantum key, and start the life cycle of the quantum key. Therefore, when the life cycle information changes with the development of the quantum key life cycle, it can monitor the life cycle of the quantum key and synchronize the corresponding life cycle information to the integrated security management platform to which it is connected, so as to support the centralized and unified life cycle supervision of the quantum key on the integrated security management platform, thereby improving the security and confidentiality of the quantum key.

[0040] In order to help those skilled in the art better understand the method for monitoring the entire life cycle of a quantum key provided by the above embodiment, it will be explained below.

[0041] In step 501, a key creation request from a client is received, and the key creation request carries a parent key identifier. The key creation request is used to instruct the creation of a quantum key (including a symmetric key or an asymmetric key) used by the client, that is, to encrypt the session or data during the communication process. It is understandable that in order to ensure the security of the quantum key, a multi-level key structure is usually used for management of the quantum key. At this time, the quantum key used by the client will be derived based on the previous key. In this process, the previous key is the parent key. Therefore, the key creation request also carries a parent key identifier, which is used to indicate which key the security execution module uses to generate the quantum key distributed to the client.

[0042] At the same time, it is also understandable that in order to ensure the security of the quantum key, authentication is also required. Based on this, in some embodiments, such as Figure 6 As shown, receiving a key creation request from a client includes the following steps: Step 511, performing a first authentication to the fusion security management platform, and obtaining a quantum key vector from a quantum key distribution network if the first authentication passes; Step 521, receiving a second authentication from the client, and receiving a key creation request from the client if the second authentication passes.

[0043] Among them, in step 511, the first authentication is used to authenticate the security execution module to the integrated security management platform. In some examples, the first authentication can be an authentication based on a Certificate Authority (CA) certificate. In step 521, the second authentication is used to authenticate the client to the security execution module. In some examples, the second authentication is an authentication based on an API interface. In this way, the security of the security execution module is guaranteed by the first authentication, and the security of the client is guaranteed by the second authentication. Thereby, the security and confidentiality of the quantum key in the process of quantum key generation and distribution can be guaranteed.

[0044] Among them, the above authentication process can be a one-way authentication, that is, the authentication is considered to be completed after the first authentication and the second authentication are passed, so that the authentication can be completed efficiently and quickly and the quantum key can be created. The above authentication process can also be a two-way authentication, that is, after the first authentication is passed, the fusion security management platform also initiates authentication to the security execution module, and after the second authentication is passed, the security execution module also initiates authentication to the client, thereby further ensuring the security of the fusion security management platform and improving the security of the security execution module when the quantum key is generated, and can further improve the security and confidentiality of the quantum key in the process of quantum key generation and distribution. Of course, the above is only an exemplary description, and it can also be based on the security of the fusion security management platform itself, setting the first authentication to a one-way authentication and the second authentication to a two-way authentication.

[0045] It should be noted that the first authentication and the second authentication do not need to be two adjacent authentication processes. In some examples, the first authentication may occur each time the security execution module is started and establishes a connection with the fusion security execution module, and the second authentication may occur each time the client needs to perform encrypted communication or prepare for encrypted communication. Among them, the quantum key requested to be created by the client is derived from the parent key identifier. Therefore, after the first authentication is passed, the security execution module also obtains the quantum key vector from the quantum key distribution network to generate the corresponding parent key. In this way, after the second authentication initiated by the client is passed, the security execution module will allow the client that has passed the second authentication to initiate a key creation request, and derive the quantum key requested to be created by the client through the corresponding parent key, so as to respond to the key creation request.

[0046] It should also be noted that the second authentication of the client can carry a component ID, which is used to indicate the relevant application ( / facility). If the second authentication of the client is passed, each time the client subsequently initiates a request to the security execution module by calling the API interface, it will carry the token issued by the security execution module in the public information of the request header, and report the caller, component identifier (such as ID number) and execution operation identifier (such as ID number), so that the security execution module can verify through the above information carried in the request. If the verification fails, the request failure information is returned to the client. In addition, it should be noted that in some cases, the size of the data packet transmitted each time a request is initiated cannot exceed 64K (65535 bytes); the component identifier cannot exceed 512 bytes to control the traffic size and avoid overload.

[0047] In addition, the embodiments of the present application do not limit the protocol and form of the key creation request. For example, in some examples, the key creation request can be based on the Hypertext Transfer Protocol Secure (HTTPS), and the Uniform Resource Location (URL) it carries can be defined as follows: IP:PORT / v1 / symmetric / createKey.

[0048] In step 502, a first quantum key is derived according to the parent key identifier, and a quantum key ID of the first quantum key is returned to the client. In some examples, the first quantum key can be maintained by a quantum key pool, wherein the quantum key pool is implemented by a built-in password card or by mounting. In some examples, the quantum key ID can be any form of information that can uniquely identify the first quantum key.

[0049] It should be noted that, since the request initiated by the client is a key creation request, rather than a request for key distribution, what is returned to the client is the quantum key ID of the created first quantum key, rather than the first quantum key and its quantum key ID. Of course, in some embodiments, in order to simplify the interaction process between the client and the security execution module, the key creation request and the request for key distribution can be combined into the same request, that is, after receiving the request, the security execution module not only creates the first quantum key, but also distributes the created first quantum key and its quantum key ID to the client.

[0050] It should also be noted that Figure 5The illustrated embodiment does not limit the derivation method of the first quantum key. For example, the derivation of the first quantum key may introduce a quantum key vector obtained in real time from a quantum key distribution network to further improve the security and confidentiality of the first quantum key; the derivation of the first quantum key may not introduce a new quantum key vector but only rely on a parent key, etc.; the derivation of the first quantum key may be implemented according to a derivation algorithm specified by a client; the derivation of the first quantum key may also be implemented according to a derivation algorithm specified by a secure execution module for a corresponding parent key, etc., which will not be described one by one here.

[0051] Exemplarily, in some embodiments, the key creation request also carries an algorithm identifier, a validity period, and an update period, wherein the algorithm identifier is used to indicate the derivation algorithm of the first quantum key, the validity period is used to indicate the validity period of the first quantum key, and the update period is used to indicate the update period of the first quantum key. Figure 7 As shown, deriving a first quantum key according to a parent key identifier and returning the quantum key ID of the first quantum key to a client can be achieved through the following steps: Step 512, calling a KDF derivation function to derive a first quantum key in a standby state according to the parent key identifier, the quantum key vector, the algorithm identifier, the validity period and the update period, wherein the first quantum key in the standby state is stored in a standby key library; Step 522, activating the first quantum key in the standby state to be in-use state, and moving the first quantum key from the standby key library to the in-use key library.

[0052] In this way, the parent key identifier, algorithm identifier, validity period and update period carried by the key creation request initiated by the client, and the quantum key vector obtained in real time from the quantum key distribution network, are used to derive the first quantum key using the key derivation function (KDF) derivation function, so that the configuration processing pressure of the quantum key life cycle can be dispersed to each client instead of being concentrated on the security execution module, thereby reducing the processing pressure of the security execution module. In addition, the quantum key can be set according to the information indicated by the client, which can also better fit the characteristics of the client. For example, when the client or another terminal that communicates encrypted with the client is in an insecure network, the client can indicate a shorter update period, etc., thereby improving the matching degree between the quantum key and the client, which is conducive to improving the security and confidentiality of the quantum key.

[0053] It should be noted that, considering that the security execution module is controlled by the integrated security management platform, in some examples, the integrated security management platform can control information related to quantum key lifecycle management such as key validity period and update period, and the security execution module can obtain this information by initiating a request to the integrated security execution module. That is, in some cases, the request initiated by the security execution module to the integrated security management platform to obtain the above information can be as follows: https: / / IP:PORT / v1 / keymanagement / getKeyInfo, and the request carries the quantum key ID so that the integrated security management platform can find or determine the corresponding information. Of course, the above is only an example. In some examples, the security execution module can also store policies issued by the integrated security management platform, and determine the above information through corresponding policies, etc., which will not be repeated here. Among them, when the security execution module requests information related to quantum key lifecycle management such as key validity period and update period from the integrated security management platform, exemplarily, the format of the information returned by the integrated security management platform to the security execution module can be shown in the following table:

[0054] Table 1 Transmission format of information such as key validity period and update cycle

[0055] Parameter name type illustrate status Integer The current state of the key createTime long Timestamp of the current key generation usageTime long The timestamp when the current key starts to be used offlineTime long The timestamp of when the current key is offline keyIdTree Object The current key consists of the key ID in each security domain and the sub-ID tree of each module.

[0056] In step 503, the life cycle information of the first quantum key is synchronized to the fusion security management platform. The life cycle information may include some information related to the life process of the quantum key. In some examples, the life cycle information includes one or more of the following information: the current key state; the key ID of the current key in each security domain, and the sub-ID tree composition of each module; the timestamp of the key when it is generated, used and cancelled. The management process related to key generation, use and cancellation in the life cycle management of the quantum key must be synchronized with the timestamp, and other links can use the timestamp according to the situation; in addition, when the life cycle management of the quantum key involves the derivation of the subordinate key from the superior key, the hierarchical relationship of the quantum key also needs to be synchronized. In some examples, the life cycle information may also include one or more of the following information: the timestamp of key generation, use and cancellation, the hierarchical relationship of the key and other information.

[0057] It should be noted that, according to different application requirements, the life cycle of a quantum key may have different stages. In some embodiments, the life cycle of a first quantum key includes any of the following stages or a combination thereof: quantum key generation stage, quantum key derivation stage, quantum key distribution stage, quantum key use stage, quantum key update stage, quantum key storage stage, quantum key backup / recovery stage, and quantum key destruction stage. Of course, the above is only an example of the stages involved in the life cycle management of a quantum key. In other embodiments, other stages that may exist in the life cycle of a quantum key may also be managed, which will not be described one by one here.

[0058] In some embodiments, Figure 8 As shown, synchronizing the life cycle information of the first quantum key to the fusion security management platform may include the following steps: step 513, in the quantum key generation stage, managing and recording the generation of the first quantum key based on the session or token, and synchronizing the managed and recorded first information to the fusion security management platform; step 523, in the quantum key derivation stage, synchronizing the second hierarchical relationship between the parent key and the first quantum key to the fusion security management platform; step 533, in the quantum key distribution stage, recording the third timestamp, the third validity period and the third update period of the first quantum key, synchronizing the third timestamp, the third validity period and the third update period to the fusion security management platform, wherein the third timestamp includes at least one of a third key creation timestamp, a third key use timestamp, a third deregistration timestamp, a third deactivation timestamp and a third delivery timestamp, and the third validity period includes a third effective time and a third loss time. At least one of the validity periods, the third update period is year, month, week, day, hour, minute or second; step 543, in the quantum key use stage, recording the fourth timestamp of the first quantum key, and synchronizing the fourth timestamp to the fusion security management platform, wherein the fourth timestamp includes the timestamp of current key generation, the timestamp of current key start use, and the timestamp of current key offline; step 553, in the quantum key update stage, synchronizing the update information of the first quantum key to the fusion security management platform; step 563, in the quantum key storage stage, synchronizing the storage information of the first quantum key to the fusion security management platform; step 573, in the quantum key backup / recovery stage, synchronizing the backup information / recovery information of the first quantum key to the fusion security management platform; step 583, in the quantum key destruction stage, recording the fifth timestamp of the first quantum key, and synchronizing the fifth timestamp to the fusion security management platform.

[0059] In this way, the security execution module monitors the life cycle of each stage of the quantum key life cycle and synchronizes it to the integrated security management platform, so that the management and control functions provided by the integrated security management platform can be used to monitor the entire life cycle of the quantum key, which is conducive to improving the security and confidentiality of the quantum key. Figure 8 The execution order of steps 513 to 583 is only a schematic diagram. It is understandable that before entering the key destruction phase, there may be multiple key update phases, that is, multiple steps 553 are repeated before step 583; or, key use and key update may occur alternately, that is, step 543 and step 553 are executed alternately, etc., which will not be described one by one here. It should also be noted that Figure 8 This is just an exemplary description. In some embodiments, Figure 8 Some of the steps in the process may not be performed, or may be combined with other possible stages of the quantum key life cycle, which will not be described in detail here.

[0060] As mentioned above, the system for monitoring the entire life cycle of a quantum key involves multiple objects: a client, a security execution module, and a fusion security management platform. It is understandable that, according to different requirements, different objects may be allowed to trigger corresponding life cycle stages. For example, one or more of the client, the security execution module, and the fusion security management platform may be allowed to trigger the update of the quantum key. Therefore, in order to facilitate those skilled in the art to better understand the different stages of the quantum key life cycle and the acquisition of the corresponding life cycle information, further explanation is provided below.

[0061] In step 543, during the quantum key usage phase, the fourth timestamp of the first quantum key is recorded, and the fourth timestamp is synchronized to the fusion security management platform, such as Fig. 9 As shown, in some examples, it can be implemented by the following steps: Step 5431, receiving a key cancellation request; Step 5432, detecting whether the first quantum key is currently used for encryption and decryption operations. If not, executing step 5433, if yes, executing step 5433; Step 5433, setting the first quantum key to a cancellation state and moving it to the historical key library; Step 5434, setting the first quantum key to a cancellation state after completing the encryption and decryption operation, and moving it to the historical key library; Step 5435, recording the timestamp of the generation of the first quantum key, the timestamp of the start of use, and the timestamp of the cancellation to form a fourth timestamp, and synchronizing the fourth timestamp to the fusion security management platform.

[0062] Among them, in step 5431, the key cancellation request is initiated by the client calling the cancellation symmetric key interface or notified by the fusion security management platform, and the key cancellation request is used to indicate the cancellation of the first quantum key. In this way, the fusion security management platform or the client is allowed to trigger the key destruction operation, and the life cycle information related to the cancellation of the quantum key can be transmitted to the fusion security management platform by synchronizing the fourth timestamp to the fusion security management platform, thereby supporting the fusion security management platform to supervise the cancellation in the life cycle of the quantum key.

[0063] In step 543, during the quantum key usage phase, the fourth timestamp of the first quantum key is recorded, and the fourth timestamp is synchronized to the fusion security management platform, such as Fig.10 As shown, in some examples, this can be achieved through the following steps: Step 5436, receiving a key deactivation notification; Step 5437, setting the first quantum key to a deactivated state and moving it to a historical key library; Step 5438, recording the timestamp of generation of the first quantum key, the timestamp of start of use, and the timestamp of deactivation to form a fourth timestamp, and synchronizing the fourth timestamp to the fusion security management platform.

[0064] Among them, in step 5436, the key deactivation notification is initiated by the fusion security management platform when deactivation is required. In this way, the fusion security management platform is allowed to trigger the key deactivation operation, and the deactivation-related life cycle information of the quantum key can be transmitted to the fusion security management platform by synchronizing the fourth timestamp to the fusion security management platform, thereby supporting the fusion security management platform to supervise the deactivation of the quantum key in the life cycle.

[0065] In step 553, during the quantum key update phase, the update information of the first quantum key is synchronized to the fusion security management platform, such as Fig.11 As shown, in some examples, it can be implemented by the following steps: Step 5531, receiving the key update instruction; Step 5532, detecting whether the first quantum key is currently used for encryption and decryption operations. If not, execute step 5533, if yes, execute step 5534; Step 5533, set the first quantum key to an expired state and move it to the archive key library, activate the second quantum key in the spare key library to an in-use state and place it in the in-use key library; Step 5534, after waiting for the first quantum key to complete the current encryption and decryption operation, set the first quantum key to an expired state and move it to the archive key library, activate the third quantum key in the spare key library to an in-use state and place it in the in-use key library; Step 5535, synchronize the key state of the first quantum key, the second quantum key related information or the third quantum key related information to the fusion security management platform. Among them, in step 5531, the key instruction is used to indicate the update of the first quantum key. In step 5533, the second quantum key is derived by calling the same KDF derivation function as the first quantum key.

[0066] In this way, by synchronizing relevant information to the integrated security management platform, the life cycle information related to the update of the quantum key can be passed to the integrated security management platform, thereby supporting the integrated security management platform to supervise the updates in the quantum key life cycle.

[0067] It should be noted that the above example does not limit the triggering object of the update. That is to say, receiving the key update instruction can be implemented in the following ways: receiving the key update instruction initiated by the client calling the update symmetric key interface; or, receiving the key update instruction initiated by the integrated security management platform; or, receiving the key update instruction initiated by the security execution module. Among them, when the client initiates the key update instruction, it can be initiated when the key is perceived to be leaked, or it can be initiated when the key is perceived to be expired. In other words, the client-side business can set a certain exception handling mechanism, and when anomalies such as key leakage occur, corresponding processing can be performed to ensure the security of related equipment and quantum keys. Of course, the above is only an example. The client can also initiate it in other cases where it perceives that the quantum key is not safe or wants to replace the quantum key, etc., which will not be repeated here.

[0068] When the security execution module initiates the key update instruction, the steps that the security execution module needs to implement include: regularly detecting whether the first quantum key has reached the update cycle or exceeded the validity period, if the first quantum key has reached the update cycle or exceeded the validity period, confirming with the client whether the first quantum key is allowed to be updated; when the client returns that the first quantum key is allowed to be updated, initiating the key update instruction. In this way, by regularly detecting and updating the quantum key, the quantum key can have a high degree of freshness, which is conducive to further improving the security and confidentiality of the quantum key. Of course, the security execution module can also regularly obtain key usage, state changes, and management changes to understand the following information about the quantum key: the key ID of the quantum key in each security domain, and the sub-ID tree passing through each module, the hierarchical relationship between the quantum keys, timestamps, states, and other information. Among them, confirming with the client whether the update is allowed is to ensure the normal communication process of the client and avoid the occurrence of adverse situations such as the update of the quantum key being applied during the communication process. Of course, in some examples, it is also possible to directly update without confirming with the client whether the update is allowed to ensure the security of the quantum key, etc., which will not be repeated here. In addition, when the security execution module initiates a key update instruction, it does not restrict the response method when the client does not allow the update. In some examples, the period for detecting whether the quantum key in the key library in use has reached the update period can be decreased, such as exponentially decreased, so as to avoid unnecessary inquiries by increasing the period of timed detection (it is highly likely that the client will not allow updates for a period of time after not allowing updates), saving resources, reducing the number of inquiries to the client, and improving the user experience; it can also be to keep the period of timed detection unchanged, but abandon the subsequent i-time detection, i is a positive integer, so as to avoid unnecessary inquiries by reducing the most recent detections, saving resources, reducing the number of inquiries to the client, and improving the user experience. Of course, the above is only an example, and it can also be set according to needs in other examples, which will not be repeated here.

[0069] In some examples, confirming to the client whether to allow the update of the first quantum key can be implemented through an interface provided by a service ( / facility) deployed on the client. For example, the relevant information of the interface can be as follows: the interface protocol is: HTTPS; the interface URL is: IP:PORT / v1 / secret-events; the interface input parameters are shown in the following table:

[0070] Table 2 Interface input parameter format

[0071]

[0072] Correspondingly, the parameter format returned by the client to indicate whether quantum key update is allowed can be as shown in the following table:

[0073] Table 3 Parameter format returned by the client to determine whether quantum key update is allowed

[0074] Parameter name type illustrate permit int Whether to allow changes (0: not allowed, 1: allowed)

[0075] The integrated security management platform can initiate a key update command when the management user issues relevant instructions, such as when the regulator requires a mandatory key update, which will not be elaborated here.

[0076] In step 573, in the quantum key backup / recovery phase, the backup information / recovery information of the first quantum key is synchronized to the fusion security management platform, such as Fig.12 As shown, in some examples, it can be implemented by the following steps: Step 5731, receiving a key backup notification; Step 5732, backing up the first quantum key to Ukey, and synchronizing the backup information of the first quantum key to the fusion security management platform; Step 5733, obtaining a key recovery notification; Step 5734, restoring the first quantum key backed up by the Ukey, and synchronizing the recovery information of the first quantum key to the fusion security management platform. Among them, in step 5731, the key backup notification is initiated by the fusion security management platform, and the key backup notification is used to indicate the backup of the first quantum key. In step 5733, the key recovery notification is initiated by the fusion security management platform, and the key recovery notification is used to indicate the recovery of the first quantum key.

[0077] In this way, the fusion security management platform is allowed to trigger key backup and / or recovery operations, and can transmit the life cycle information related to quantum key backup and / or recovery to the fusion security management platform by synchronizing relevant information to the fusion security management platform, thereby supporting the fusion security management platform to supervise the backup and / or recovery of quantum keys in their life cycle. Fig.12 This is merely an exemplary description of the execution order of step 5731-step 5734. In some embodiments, step 5731-step 5732 may be implemented after step 5734, etc., which will not be elaborated here.

[0078] It is understandable that the life cycle of a quantum key also includes a quantum key import phase, a quantum key export phase, a quantum key encryption and decryption processing phase, and a quantum key traffic statistics phase. In some embodiments, during the quantum key import phase, the client may be allowed to trigger key import, that is, receive a first processing request, which is initiated by the client when the quantum key needs to be imported to trigger the key import phase. At this time, the security execution module will save the quantum key and add an import tag to the quantum key, and synchronize the imported quantum key and related information to the fusion security platform. In some embodiments, during the quantum key export phase, the client may be allowed to trigger key export, that is, receive a first processing request, which is initiated by the client when the quantum key needs to be exported to trigger the key export phase. At this time, the security execution module will detect whether the quantum key is generated by importing. If the quantum key is generated by importing, the quantum key will be sent to the client. In some embodiments, during the quantum key encryption and decryption processing stage, the client may be allowed to trigger the encryption and decryption processing, that is, receive a second processing request, which is initiated by the client when encryption and decryption are required to trigger the quantum key encryption and decryption processing stage. At this time, the security execution module will detect whether the quantum key is currently used for encryption and decryption operations; if the quantum key is not currently used for encryption and decryption operations, the quantum key is called to perform encryption and decryption operations, and the operation results are sent to the client. In some embodiments, during the quantum key traffic statistics stage, the client may be allowed to trigger traffic statistics, that is, receive a third processing request, which is initiated by the client when traffic statistics are required to trigger the quantum key traffic statistics stage. At this time, the security execution module will send the sum of the key lengths of the quantum keys associated with the client in the in-use key library, archived key library, and historical key library for the client that initiated the third processing request to the client.

[0079] It should be noted that the above is mainly the description of step 503 for the case where the security execution module directly maintains the quantum key. As mentioned above, in some cases, the fusion security management platform may also include a key management system for providing key lifecycle management functions, that is, the quantum key can be directly managed based on the key management system. At this time, in the lifecycle management of the quantum key, the security execution module mainly acts as a relay between the client and the fusion security management platform, transmitting requests and management results between the client and the fusion security management platform. That is: in some embodiments, the client's request or transmitted information is synchronized to the key management system of the fusion security management platform through the Key Management Interoperability Protocol (KMIP) to perform corresponding quantum key lifecycle supervision.

[0080] In order to help those skilled in the art better understand the control of the key management system described above, an exemplary description will be given below. Fig.13 As shown, the key management system can also trigger quantum key acquisition autonomously. At this time, the interactive process of the quantum key acquisition method includes the following steps: Step 1301, the key management system determines the configuration of the key pool according to the key pre-production task; Step 1302, the key management system initiates a key derivation notification to the security execution module through the KMIP protocol, wherein the key derivation notification may carry one or more of the following information: the number of keys to be derived, the sampled key algorithm, etc.; Step 1303, the security execution module queries the trusted root key corresponding to the user of the client according to the key derivation notification and derives the quantum key according to the trusted root key and the key algorithm; Step 1304, the security execution module returns the derived quantum key to the key management system; Step 1305, the key management system saves the received quantum key.

[0081] like Fig.14 As shown, the interactive process of quantum key update initiated by the security execution module may include the following steps: step 1401, the security execution module performs regular detection according to the update cycle obtained during activation to obtain the quantum key list that currently needs to be updated; step 1402, the security execution module synchronizes the quantum key list that currently needs to be updated to the client; step 1403, the client returns the quantum key list that is allowed to be updated to the security execution module; step 1404, the security execution module initiates a key update request to the key management system through KMIP; step 1405, the key management system updates the quantum key according to the key update request; step 1406, the key management system returns the key ID of the updated first quantum key to the security execution module; step 1407, the security execution module synchronizes the first quantum key and related information to the client; step 1408, the security execution module synchronizes the first quantum key and related information to the fusion security management platform.

[0082] It should be noted that the quantum key update on the key management system is basically the same as the quantum key update on the secure execution module provided in the aforementioned embodiment, and the difference mainly lies in the different execution subjects. In some examples, the quantum key update on the key management system can be implemented through a key change lock. Specifically, it is detected whether the quantum key is currently used for encryption and decryption operations. When the quantum key is not currently used for encryption and decryption operations, the key management system obtains a password change lock. If the password change lock can be successfully obtained, the password change lock can be called to implement the update of the quantum key, and the key change lock is released after the quantum key update is completed. Among them, the steps implemented on the password change lock include: according to the quantum key ID allowed to be updated by the client, the corresponding key algorithm, key length and other information are obtained, and then, according to the obtained information, the corresponding first quantum key is determined in the spare key library, and the first quantum key is moved to the online key library, and the quantum key allowed to be updated by the client is moved to the archive key library, and the state of the first quantum key is modified to the in-use state, and the state of the quantum key allowed to be updated moved to the archive key library is modified to the expired state.

[0083] In addition, after returning the synchronization result to the security execution module, the integrated security management platform can also notify the security execution module that initiated the update to synchronize the result to other security execution modules, and receive the synchronization result fed back by the security execution module that initiated the update.

[0084] It should also be noted that, as described in the above embodiment, the process of the fusion security management platform notifying the security execution module to update the quantum key and cancel the quantum key is roughly the same, the difference is mainly that the quantum key is moved to different key libraries during the quantum key update and quantum key cancellation process, and the modified key state is different. Here, the process of quantum key update and quantum key cancellation on the key management system is also roughly the same, the difference is also mainly that the quantum key is moved to different key libraries during the quantum key update and quantum key cancellation process, and the modified key state is different, which will not be repeated here.

[0085] like Fig.15As shown, the key management system can also trigger key expiration autonomously. At this time, the interactive process of the quantum key expiration method includes the following steps: Step 1501, the key management system obtains the current quantum key list to be expired according to the recorded key expiration time; Step 1502, the key management system sends the corresponding expiration notification of the current quantum key to be expired to the security execution module that uses the current quantum key to be expired for the first time according to the current quantum key list to be expired; Step 1503, the security execution module returns a response result to the key management system according to the received expiration notification; Step 1504, when the response result of the expiration notification is successful, the security execution module initiates a key expiration request to the key management system through the KMIP protocol; Step 1505, the key management system performs quantum key expiration processing on the corresponding quantum key according to the received key expiration request; Step 1506, the key management system returns the response result of the key expiration request to the security execution module; Step 1507, the security execution module synchronizes the response result of the key expiration request to the client; Step 1508, the security execution module synchronizes the response result of the key expiration request to the fusion security management platform. It should be noted that the expiration of the quantum key on the key management system is basically the same as the expiration of the quantum key on the secure execution module provided in the aforementioned embodiment, and the main difference lies in the different execution entities.

[0086] In some examples, the quantum key expiration on the key management system can also be implemented through a key change lock. Specifically, it is detected whether the quantum key is currently used for encryption and decryption operations. When the quantum key is not currently used for encryption and decryption operations, the key management system obtains a password change lock. If the password change lock can be successfully obtained, the password change lock can be called to implement the expiration of the quantum key, and the key change lock is released after the quantum key expiration is completed. Among them, the steps implemented on the password change lock include: moving the quantum key to be expired to the archive key library and changing the state of the quantum key to be expired to an expired state.

[0087] like Fig.16As shown, the key management system can also participate in the encryption and decryption process. At this time, the interactive process of the encryption and decryption method includes the following steps: Step 1601, the client initiates a second processing request to the security execution module; Step 1602, the security execution module initiates a key acquisition request to the key management system; Step 1603, the key management system detects whether the quantum key is currently used for encryption and decryption operations according to the key acquisition request; Step 1604, the key management system returns the quantum key to the security execution module when the quantum key is not currently used for encryption and decryption operations; Step 1605, the security execution module performs encryption and decryption operations according to the received quantum key; Step 1606, after the encryption and decryption operations are completed, the security execution module initiates a key operation lock release request to the key management system through KMIP; Step 1607, the key management system releases the key operation lock according to the key operation lock release request; Step 1608, the security execution module returns the operation result to the client. In some examples, the key management system adds a key operation lock to the quantum key returned to the security execution module for encryption and decryption. In this way, on the one hand, it is convenient to detect whether the quantum key is currently used for encryption and decryption operations, and on the other hand, it can also ensure the security of the quantum key currently used for encryption and decryption operations.

[0088] Similarly, when the quantum key is imported and / or exported, the security execution module forwards the first processing request initiated by the client to the key management system, and the key management system imports the corresponding quantum key and marks its generation mode as imported, and / or determines whether the generation mode is imported and exports the corresponding quantum key when the generation mode is imported, and returns the relevant results to the security execution module, so that the security execution module is synchronized. When traffic statistics are collected, the security execution module forwards the third processing request to the key management system, and the key management system creates a traffic statistics task according to the third processing request, and continuously updates the sum of the key lengths of the quantum keys associated in the in-use key library, the archived key library, and the historical key library, and then the key management system returns the results to the client through the security execution module.

[0089] Of course, the above is only an exemplary description of the specific implementation process of quantum key lifecycle management. In some embodiments, other methods can also be used for description, which will not be described here one by one.

[0090] In addition, it can also be understood that the client may also use the quantum key, which may cause its life cycle to change. At this time, synchronizing the life cycle information of the first quantum key to the integrated security management platform can also be achieved through the following steps: when the first quantum key is used by the client, the life cycle information of the first quantum key synchronized from the client is synchronized to the integrated security management platform, wherein the client synchronizes the life cycle management information of the first quantum key to the security execution module through WatchDog. The life cycle information includes key usage, status changes, and management changes. The management changes include the key ID of the first quantum key in each security domain and the sub-ID tree, hierarchical relationship and timestamp of each module. The security execution module and the client adopt the proxy mode, the security execution module is the HOST end, and the client is the Agent end.

[0091] That is to say, Fig.17 As shown in the figure, the security execution module manages the key management / secret service of the business system deployed by the client through KMIP. The key management of the security execution module and the key management of the client's business system adopt an agent mode. The Host is the security execution module and the Agent is the client. After the Host delivers the key to the Agent, the Agent must report the key usage, status changes, and management changes to the Host in real time. At the same time, the Host also adds WatchDog to monitor the quantum key of the Agent, such as whether the life cycle has timed out; if it has timed out, the Agent must be informed to update, cancel or destroy the key; and an alarm is generated at the same time. Among them, the KMIP message includes information such as agent identity authentication, operation identification, and operation parameters.

[0092] Therefore, it can be seen from the above embodiments that the quantum key has five states as shown in the following table:

[0093] Table 4 The state of quantum key

[0094]

[0095] It should be noted that the above embodiments provide the in-use key library and in-use state to manage the acquisition process of the quantum key mainly for the convenience of managing the quantum key. However, in some embodiments, other methods can be used to achieve this, such as maintaining the quantum key in a key library through different tags without moving between key libraries, which will not be described here one by one. In some embodiments, based on the five states in the above table, the quantum key can have a structure as shown in the following table:

[0096] Table 5 Structure of quantum key

[0097]

[0098]

[0099] The step division of the above methods is only for the purpose of clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this patent.

[0100] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A method for monitoring the entire life cycle of a quantum key, characterized in that: Applicable to a security execution module deployed on the client side, the security execution module is connected to the integrated security management platform and is managed by the integrated security management platform, including: Receiving a key creation request from a client, wherein the key creation request carries a parent key identifier; Based on the derivation function, derive a first quantum key according to the parent key identifier, and return the quantum key ID of the first quantum key to the client; Synchronize the lifecycle information of the first quantum key to the fusion security management platform.

2. The method according to claim 1, characterized in that Receiving a key creation request from a client includes: Performing a first authentication on the integrated security management platform, and obtaining a quantum key vector from a quantum key distribution network if the first authentication passes, wherein the first authentication is an authentication based on a CA certificate; Receive a second authentication of the client, and receive the key creation request of the client if the second authentication passes, wherein the second authentication is an authentication based on an API interface.

3. The method according to claim 2, characterized in that The key creation request also carries an algorithm identifier, a validity period, and an update period. The first quantum key derived according to the parent key identifier includes: Calling a KDF derivation function to derive a first quantum key in a standby state according to the parent key identifier, the quantum key vector, the algorithm identifier, the validity period, and the update period, wherein the first quantum key in the standby state is stored in a standby key library; The first quantum key in the standby state is activated to be in use, and the first quantum key is moved from the standby key library to the in-use key library.

4. The method according to claim 1, wherein the life cycle of the first quantum key comprises any one of the following stages or a combination thereof: a quantum key generation stage, a quantum key derivation stage, a quantum key distribution stage, a quantum key use stage, a quantum key update stage, a quantum key storage stage, a quantum key backup / recovery stage and a quantum key destruction stage, wherein: Synchronizing the lifecycle information of the first quantum key to the fusion security management platform includes: In the quantum key generation stage, the generation of the first quantum key is managed and recorded based on the session or token, and the managed and recorded first information is synchronized to the fusion security management platform; or, In the quantum key derivation phase, synchronizing the second hierarchical relationship between the parent key and the first quantum key to the fusion security management platform; or, In the quantum key distribution stage, a third timestamp, a third validity period and a third update period of the first quantum key are recorded, and the third timestamp, the third validity period and the third update period are synchronized to the integrated security management platform, wherein the third timestamp includes at least one of a third key creation timestamp, a third key use timestamp, a third cancellation timestamp, a third deactivation timestamp and a third delivery timestamp, the third validity period includes at least one of a third effective time and a third expiration time, and the third update period is year, month, week, day, hour, minute or second; or, In the quantum key use phase, record the fourth timestamp of the first quantum key, and synchronize the fourth timestamp to the fusion security management platform, wherein the fourth timestamp includes the timestamp of current key generation, the timestamp of current key start of use, and the timestamp of current key offline; or, In the quantum key update phase, synchronizing the update information of the first quantum key to the fusion security management platform; In the quantum key storage stage, synchronizing the storage information of the first quantum key to the fusion security management platform; In the quantum key backup / recovery phase, synchronizing the backup information / recovery information of the first quantum key to the fusion security management platform; During the quantum key destruction phase, the fifth timestamp of the first quantum key is recorded, and the fifth timestamp is synchronized to the fusion security management platform.

5. The method according to claim 4, characterized in that In the quantum key use phase, recording the fourth timestamp of the first quantum key and synchronizing the fourth timestamp to the fusion security management platform includes: receiving a key deregistration request, wherein the key deregistration request is initiated by the client calling a deregistration symmetric key interface or is notified by the fusion security management platform, and the key deregistration request is used to instruct the deregistration of the first quantum key; Detecting whether the first quantum key is currently used for encryption and decryption operations, and if the first quantum key is not currently used for encryption and decryption operations, setting the first quantum key to a deregistered state and moving it to a historical key library; or if the first quantum key is currently used for encryption and decryption operations, setting the first quantum key to a deregistered state after completing the encryption and decryption operations and moving it to a historical key library; The timestamp of generating the first quantum key, the timestamp of starting to use, and the timestamp of canceling are recorded to form a fourth timestamp, and the fourth timestamp is synchronized to the integrated security management platform.

6. The method according to claim 4, characterized in that In the quantum key use phase, recording the fourth timestamp of the first quantum key and synchronizing the fourth timestamp to the fusion security management platform includes: Receiving a key deactivation notification, wherein the key deactivation notification is initiated by the converged security management platform when deactivation is required; Setting the first quantum key to a deactivated state and moving it to a historical key library; The timestamp of generating the first quantum key, the timestamp of starting to use, and the timestamp of deactivation are recorded to form a fourth timestamp, and the fourth timestamp is synchronized to the integrated security management platform.

7. The method according to claim 4, characterized in that In the quantum key update phase, synchronizing the update information of the first quantum key to the fusion security management platform includes: receiving a key update instruction, wherein the key update instruction is used to instruct to update the first quantum key; Detecting whether the first quantum key is currently used for encryption and decryption operations, if the first quantum key is not currently used for encryption and decryption, setting the first quantum key to an expired state and moving it to an archive key library, activating a second quantum key in a standby key library to an in-use state and placing it in an in-use key library, wherein the second quantum key is derived by calling the same KDF derivation function as the first quantum key; or, if the first quantum key is currently used for encryption and decryption operations, after waiting for the first quantum key to complete the current encryption and decryption operations, setting the first quantum key to an expired state and moving it to an archive key library, activating a third quantum key in a standby key library to an in-use state and placing it in an in-use key library; Synchronize the key state of the first quantum key, the second quantum key-related information, or the third quantum key-related information to the fusion security management platform.

8. The method according to claim 7, characterized in that Receiving a key update instruction includes: receiving the key update instruction initiated by the client calling the symmetric key update interface; or, receiving the key update instruction initiated by the converged security management platform; or, The key update instruction initiated by the security execution module is received, wherein the security execution module initiating the key update instruction includes: regularly detecting whether the first quantum key has reached an update cycle or has exceeded a validity period, and if the first quantum key has reached an update cycle or has exceeded a validity period, confirming with the client whether the first quantum key is allowed to be updated; and initiating the key update instruction if the client returns a reply that the first quantum key is allowed to be updated.

9. The method according to claim 4, characterized in that In the quantum key backup / recovery phase, synchronizing the key state of the first quantum key to the fusion security management platform includes: receiving a key backup notification, wherein the key backup notification is initiated by the fusion security management platform, and the key backup notification is used to instruct to back up the first quantum key; Backing up the first quantum key to Ukey, and synchronizing the backup information of the first quantum key to the fusion security management platform; Obtaining a key recovery notification, wherein the key recovery notification is initiated by the fusion security management platform, and the key recovery notification is used to instruct recovery of the first quantum key; Restore the first quantum key backed up by the Ukey, and synchronize the recovery information of the first quantum key to the fusion security management platform.

10. The method according to claim 1, characterized in that Synchronizing the lifecycle information of the first quantum key to the fusion security management platform also includes: When the first quantum key is used by the client, the life cycle information of the first quantum key synchronized from the client is synchronized to the integrated security management platform, wherein the client synchronizes the life cycle management information of the first quantum key to the security execution module through WatchDog, and the life cycle information includes key usage, status change, and management change. The management change includes the key ID of the first quantum key in each security domain and the sub-ID tree, hierarchical relationship and timestamp passing through each module. The security execution module and the client adopt a proxy mode, the security execution module is the HOST end, and the client is the Agent end.

11. A secure execution module, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for monitoring the entire life cycle of a quantum key as described in any one of claims 1 to 10.

Images