Application platform security device

Abstract

The present invention provides an application platform security device, which is connected to the external application platform network when working, including: a password management system, which is connected to the application platform network when working; a cipher machine, which is connected to the password management system network when working; and a quantum random number generator, which is connected to the password machine network when working; wherein, when working, when the password management system sends a request content to the cipher machine, which is any one of generating a random number, generating a key, and encoding a digital envelope, the cipher machine receiving the request content sends a request to generate a quantum random number to the quantum random number generator, and the quantum random number generator receives the request to generate a quantum random number and sends it to the cipher machine after generating a quantum random number; the cipher machine sends corresponding content to the password management system based on the received request content of the password management system. It has the characteristics of high security.

Description

[0001] This application is based on and claims the priority benefit of the invention with application number 2023212979760 filed with the China Patent Office on May 26, 2023, and invention name “A kind of application platform security device”, the entire contents of which are incorporated herein by reference. Technical Field

[0002] The present invention belongs to the technical field of network security, and in particular relates to an application platform security device. Background Art

[0003] As the core technology and basic support for network and information security assurance, cryptographic technology plays an irreplaceable role in identity authentication, information encryption, security isolation, integrity protection and non-repudiation of operations.

[0004] At present, the importance of network security is also increasing day by day. Usually, the purpose of strengthening information protection and information security is achieved through cryptographic technology and the construction of network trust system. However, the generation basis of existing passwords is based on the generation of pseudo-random numbers, which leads to certain hidden dangers in the security of the generated passwords. Summary of the invention

[0005] The object of the present invention is to provide an application platform security device so as to make it possible to solve at least one of the above problems.

[0006] Based on the above purpose, the present invention proposes an application platform security device, which is connected to the external application platform network when working, and the application platform security device includes:

[0007] The password management system is connected to the application platform network when in operation;

[0008] The cryptographic machine, when in operation, is connected to the cryptographic management system network; and

[0009] A quantum random number generator, when in operation, is connected to the cryptographic machine network;

[0010] Among them, when working, when the password management system sends a request content to the cryptographic machine, which is any one of generating a random number, generating a key, and encoding a digital envelope, the cryptographic machine receiving the request content sends a request to generate a quantum random number to the quantum random number generator, and after the quantum random number generator receives the request to generate a quantum random number, it generates a quantum random number and sends it to the cryptographic machine; the cryptographic machine sends corresponding content to the password management system based on the received request content of the password management system.

[0011] In one embodiment, the cryptographic machine and the quantum random number generator are arranged on the same cloud computing device; and / or

[0012] The cryptographic machine and the quantum random number generator are arranged in the same sub-network.

[0013] In one embodiment, the password management system includes:

[0014] Database, used to store encrypted data;

[0015] Password management tools; and

[0016] System password service tool;

[0017] Wherein, during operation, the database, password management tool and system password service tool are connected to the network;

[0018] In one embodiment, the password management system is a cluster configuration, including at least two cluster nodes, and when in operation, all the cluster nodes are connected to each other through a network;

[0019] Each of the cluster nodes includes the database, a password management tool and a system password service tool.

[0020] In one embodiment, the number of the cryptographic machines is at least two. When in operation, all the cryptographic machines are connected to the cryptographic management system network, and all the cryptographic machines are connected to each other through the network.

[0021] In one embodiment, the cryptographic management system, the cryptographic machine, and the quantum random number generator are located in different subnetworks.

[0022] In one embodiment, further comprising:

[0023] The signature verification server is connected to the password management system network when in operation.

[0024] In one embodiment, the signature verification server, the cryptographic machine, and the quantum random number generator are arranged on the same cloud computing device; and / or

[0025] The signature verification server, the cryptographic machine, and the quantum random number generator are located in the same subnet;

[0026] The number of the signature verification servers is at least two, and when in operation, all the signature verification servers are connected to each other through a network;

[0027] In one embodiment, further comprising:

[0028] The timestamp server, when in operation, is connected to the password management system network.

[0029] In one embodiment, the signature verification server, the cryptographic machine, and the quantum random number generator are arranged on the same cloud computing device; and / or

[0030] The timestamp server, the cryptographic machine, and the quantum random number generator are located in the same subnetwork;

[0031] The number of the timestamp servers is at least two, and when in operation, all the timestamp servers are connected to each other through a network.

[0032] Additional aspects and advantages of the present invention will be given in the description which follows, and in part will be obvious from the description which follows, or may be learned by practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 FIG. 4 is a deployment diagram according to an embodiment of the present invention.

[0035] Figure 2 The figure is a functional flow chart according to an embodiment of the present invention.

[0036] Figure 3 The figure is a schematic diagram of a data encryption process according to an embodiment of the present invention.

[0037] Figure 4 The figure is a schematic diagram of a data integrity protection process according to an embodiment of the present invention.

[0038] Figure 5 The figure is a business process diagram of an authentication service system according to another embodiment of the present invention.

[0039] Figure 6 The figure is a schematic diagram of a timestamp request process according to another embodiment of the present invention.

[0040] The accompanying drawings are for illustrative purposes only and are not intended to be drawn to scale. In the accompanying drawings, the same reference symbols are used to indicate the same elements. For the purpose of simplicity, not every component is labeled in every drawing. DETAILED DESCRIPTION

[0041] The present invention will be described below with reference to several examples. It should be understood that these embodiments are described to enable those skilled in the art to better understand and implement the present invention, and do not represent or imply any limitation on the scope of the present invention.

[0042] One embodiment of the present invention includes a password management system, a cryptographic machine, and a quantum random number generator, which are connected to the external application platform network when working.

[0043] The password management system, when in operation, is connected to the application platform network;

[0044] The cryptographic machine, when in operation, is connected to the cryptographic management system network; and

[0045] When the quantum random number generator is in operation, it is connected to the cryptographic machine network.

[0046] It should be noted that the above network can be a wired network, a wireless network, or a mixture of the above two networks.

[0047] It should be noted that this device integrates cryptographic technology and quantum technology, and makes it possible to achieve more reliable security services by borrowing the advantages of quantum random numbers.

[0048] The advantages of this quantum random number are as follows:

[0049] (1) The quantum entropy source based on the phase noise of laser spontaneous radiation has the characteristics of clear working mechanism, obvious quantum characteristics, high random number generation rate, and good randomness quality. It can be applied in the one-time one-pad scenario;

[0050] (2) The quantum random number generator generates true random numbers based on the physical properties of quantum. Compared with the traditional key, which is a pseudo-random number generated by an algorithm, the passwords generated by this device are never the same, and security is guaranteed;

[0051] (3) The appropriate random number output rate can be selected according to different application requirements.

[0052] like Figure 2 The flowchart of the embodiment in operation is shown in FIG. 1 , where the random number generation function, key generation (distribution) function and digital envelope encoding function can be realized.

[0053] Specifically, the process of implementing the random number generation function is:

[0054] Step 1: The password management system calls a cryptographic machine (the cryptographic machine here can be in various forms, such as being set up as a server, i.e., a server cryptographic machine, the same below) to send a request to generate a random number for execution;

[0055] Step 2: After receiving the request instruction, the server cryptographic machine calls the quantum random number generator to send a request to generate a quantum random number. After receiving the random number generation request, the quantum random number generator generates a quantum random number internally;

[0056] Step 3: Then send the quantum random number to the server cryptographic machine, and the server cryptographic machine receives the quantum random number;

[0057] Step 4: Then forward it to the password management system to complete the random number generation function.

[0058] Specifically, the process of implementing the key generation (distribution) function is:

[0059] Step 1: The password management system calls the server cryptographic machine to send a request for key generation (distribution) to execute.

[0060] Step 2: After receiving the request instruction, the server cryptographic machine calls the quantum random number generator to send a request to generate a quantum random number;

[0061] Step 3: After receiving the random number generation request, the quantum random number generator generates a quantum random number internally, and then sends the quantum random number to the server cryptographic machine;

[0062] Step 4: The server cryptographic machine receives the quantum random number, generates the user key based on the quantum random data, and then forwards the user key to the cryptographic management system to complete the key generation (distribution) function.

[0063] Specifically, the process of implementing the digital envelope encoding function is as follows:

[0064] Step 1: The password management system calls the server password machine to send a digital envelope code request for execution;

[0065] Step 2: After receiving the request instruction, the server cryptographic machine calls the quantum random number generator to send a request to generate a quantum random number;

[0066] Step 3: After receiving the random number generation request, the quantum random number generator generates a quantum random number internally, and then sends the quantum random number to the server cryptographic machine;

[0067] Step 4: The server cryptographic machine receives the quantum random number, and then encodes and generates a digital envelope according to the quantum random data, and then sends the generated digital envelope encoding data to the password management system to complete the digital envelope encoding function.

[0068] In order to improve efficiency, in a specific embodiment, the above-mentioned cryptographic machine and quantum random number generator can be set in the same sub-network.

[0069] In addition, with the development of big data and cloud computing industries, existing application platforms have been moved to cloud platforms. In order to make an embodiment of this device better integrated with the cloud platform, the server cryptographic machine and quantum random number generator in the device can be set on the same cloud computing device as the application platform. This can provide safe, reliable and compliant key management, encryption and decryption, as well as the signature verification service and timestamp service described below for the cloud business system.

[0070] It should be noted that with the in-depth development and application of cloud computing technology, all walks of life have migrated their business systems to the cloud. However, the cloud environment faces more severe security challenges such as the disappearance of traditional security boundaries and virtual environment data security. How cryptographic technology can ensure the security of the cloud environment has become the focus of research in various industries. To this end, in one implementation of this device, the server cryptographic machine and quantum random number generator are both set on the cloud. This provides strong support for ensuring the security of the cloud environment.

[0071] Specifically, such as the construction of the government cloud center organized by the government, in the past, especially in the stage when the information system was independent of each other, the management and services of the network, equipment, system, users, etc. in operation and maintenance management were scattered and unrelated, and the sharing of data, information and knowledge base was not achieved, and standardization and process were not achieved. At present, in the era of cloud-based information system construction, especially to achieve data sharing and government big data applications in government cloud projects, operation and maintenance management needs to move from extensive and decentralized management to scientific, standardized and centralized professional management. It is urgent to establish a scientific and effective operation and maintenance management system that integrates organization, system, process and technology. Many embodiments of this device can provide users with centralized operation and maintenance management services, including system access management, security inspection, emergency response, risk assessment and other tasks.

[0072] The password management system in one embodiment of the present device includes a database, a password management tool, and a system password service tool.

[0073] The database can be used to store encrypted data. The password management tool can be used to manage encryption and decryption. The system password service tool can be used to manage system passwords.

[0074] like Figure 1 As shown, the password management system is a cluster setting, including at least two cluster nodes, and when working, the network between all the cluster nodes is connected.

[0075] Each of the above cluster nodes is equipped with a database, a password management tool, and a system password service tool.

[0076] The setting of multiple cluster nodes improves the efficiency of the password management system, with different levels of improvement in the number of concurrency, number of online users supported, number of key storages, interface response speed and network delay.

[0077] It should be noted that the password management system can realize multi-machine hot standby, that is, multiple cluster nodes are provided. When working, each cluster node has a corresponding server cryptographic machine and a quantum random number generator connected to its corresponding network. At this time, the server cryptographic machine can also be multiple to realize multi-machine hot standby, so as to improve the security and stability of the device.

[0078] In addition, if Figure 1 As shown, the password management system, the server cryptographic machine, and the quantum random number generator may not be in the same sub-network. In this case, the password management system and the server cryptographic machine may be connected through, but not limited to, an interface on a network switch.

[0079] like Figure 3 The figure shows a flow chart of an embodiment of the present device applied to data encryption.

[0080] The specific data encryption process is as follows:

[0081] 1. The application system uploads the received raw data (referring to the data that needs to be encrypted, the same below) to the cloud server cryptographic machine (that is, the cryptographic machine is located on the cloud and used as a server);

[0082] 2. The cloud server cryptographic machine encrypts the original data using a symmetric encryption algorithm based on the application identifier and the assigned encryption key and returns it to the application system;

[0083] 3. The application system stores the encrypted data in the database;

[0084] 4. The database returns the stored results to the application system.

[0085] like Figure 4 The figure shows a flow chart of an embodiment of the present device applied to data integrity protection.

[0086] The specific data integrity protection process is as follows:

[0087] 1. Party A (i.e., application server 1) announces the digest algorithm (that is, specifies the name of the digest algorithm to be used) to Party B (i.e., application server 2);

[0088] 2. Party A and Party B construct a key according to the agreement, and both parties have the same key;

[0089] 3. Party A uses the key to digest the message, and then sends the message and the generated digest message to Party B;

[0090] 4. After receiving the message, Party B uses the digest algorithm published by Party A and the agreed key to digest the received message, and then compares its own digest message with the digest message sent by Party A to determine whether the message was sent by Party A.

[0091] As another embodiment of the present device, it further comprises a signature verification server. When in operation, the signature verification server is connected to the password management system network.

[0092] It should be noted that there can be multiple signature verification servers, and their locations can be, but are not limited to, being located on the same cloud computing device and / or in the same subnet as the server cryptographic machine and quantum random number generator.

[0093] When there are multiple signature verification servers, all the signature verification servers are connected to each other through a network during operation.

[0094] like Figure 5 The figure shows a flow chart of another embodiment of the device applied to the authentication service system business.

[0095] The specific business process of the authentication service system is as follows:

[0096] 1. Call the authentication service platform interface and send the data to be signed and DN to the authentication service platform;

[0097] 2. The authentication platform verifies the identity of the application system and confirms whether the application system identity has the authority to access the signature verification server;

[0098] 3. After the verification is passed, the authentication service platform sends the data to the signature verification server according to the requirements of the application system, digitally signs the signature data, and transparently returns the signed result to the application system and stores it in the database.

[0099] As another embodiment of the present device, it further comprises a timestamp server, and when in operation, the timestamp server is connected to the password management system network.

[0100] It should be noted that there can be multiple timestamp servers, and their locations can be, but are not limited to, being located on the same cloud computing device and / or in the same subnet as the server cryptographic machine and quantum random number generator.

[0101] When there are multiple timestamp servers, all the timestamp servers are connected to each other through a network during operation.

[0102] like Figure 6 As shown, it is a flowchart of another embodiment of the present device applied to a timestamp request service.

[0103] The specific timestamp request business process is as follows:

[0104] 1. The application system server integrates the authentication platform SDK and calls the corresponding timestamp interface according to the interface form;

[0105] 2. The authentication platform verifies the identity of the application system and confirms whether the application system identity has the authority to access the timestamp server;

[0106] 3. After verification, the authentication service platform sends the parameters for generating the timestamp to the timestamp machine based on the uploaded data according to the requirements of the application system;

[0107] 4. The timestamp server synchronizes and verifies the standard time, and uses the private key corresponding to the timestamp server certificate issued by the CA organization to sign the digital summary and accurate time to generate a timestamp.

[0108] 5. The timestamp data is sent back to the application system. The timestamp and the original text are bound together to provide valid evidence of a certain time.

[0109] Generally, the computing systems and / or devices and / or equipment and / or tools described above may use any number of computer operating systems, including but not limited to versions and / or variations of: applications, application link / smart device link middleware, Microsoft operating systems, Unix operating systems, Linux operating systems, Mac OSX, iOS operating systems, Blackberry OS, Android operating systems, automotive platforms for infotainment provided by QNX Software Systems. Examples of computing devices include, but are not limited to, an onboard vehicle computer, a computer workstation, a server, a desktop, a laptop, a portable computer, or a handheld computer, or some other computing system and / or device.

[0110] A computing device typically includes computer-executable instructions, wherein the instructions can be executed by one or more computing devices such as those listed above. Computer-executable instructions can be compiled or interpreted from a computer program, which is established using a variety of programming languages ​​and / or technologies, including but not limited to JavaTM, C, C++, Visual Basic, Java Script, Perl, etc., alone or in combination. Some of these applications can be compiled and executed on a virtual machine, such as a Java virtual machine, a Dalvik virtual machine, etc. Typically, a processor (e.g., a microprocessor) receives instructions, such as from a memory, a computer-readable medium, etc., and executes these instructions, thereby executing one or more processes, including one or more processes described herein. Such instructions and other data can be stored and transmitted using a variety of computer-readable media.

[0111] Computer-readable storage media (also referred to as processor-readable media) include any non-transitory (e.g., tangible) media that participate in providing data (e.g., instructions) readable by a computer (e.g., by a processor of a computer). Such media can take many forms, including, but not limited to, non-volatile media and volatile media. Non-volatile media can include, for example, optical or magnetic disks and other persistent memory. Volatile media can include, for example, dynamic random access memory (DRAM), which typically constitutes main memory. Such instructions can be transmitted via one or more transmission media, including coaxial cables, copper wire, and optical fiber, including the lines comprising a system bus connected to a processor of a computer. Common forms of computer readable media include, for example, floppy disks, flexible disks, hard disks, magnetic tapes, any other magnetic media, CD-ROMs (compact disk read-only memory), DVDs (digital versatile disks), any other optical media, punch cards, paper tapes, any other physical media with a pattern of holes, RAM (random access memory), PROMs (programmable read-only memory), EPROMs (electrically programmable read-only memory), FLASH-EEPROMs (flash electrically erasable programmable read-only memory), any other memory chip or memory cartridge, or any other computer readable medium.

[0112] A database, data repository, or other data storage described herein may include various types of mechanisms for storing, accessing, and retrieving a variety of data, including hierarchical databases, collections of files in a file system, application databases in a specialized format, relational database management systems (RDBMS), and the like. Each such data storage is typically included in a computing device using a computer operating system such as one of those mentioned above, and is accessed over a network in any one or more of a variety of ways. The file system may be accessed from the computer operating system and may include files stored in a variety of formats. RDBMSs typically use structured query languages ​​(SQL), such as the procedural SQL (PL / SQL) language mentioned above, in addition to using languages ​​for creating, storing, editing, and executing stored procedures.

[0113] In some examples, system elements may be implemented as computer-readable instructions (e.g., software) on one or more computing devices (e.g., servers, personal computers, etc.), stored on computer-readable media associated therewith (e.g., disks, memories, etc.). A computer program product may include such instructions stored on a computer-readable medium for performing the functions described herein.

[0114] In the claims, the word "comprising" does not exclude other units or steps; the word "one" or "an" does not exclude multiple. In the claims, the use of ordinal numbers such as "first" and "second" to modify the claim elements themselves does not mean that one claim element has a priority, order or time sequence of action execution over another claim element, but is only for the purpose of distinguishing one claim element from another claim element. Although certain specific technical features are recorded in different dependent claims, this does not mean that these specific technical features cannot be used in combination. Various aspects of the present invention may be used alone, in combination or in various arrangements not specifically discussed in the aforementioned embodiments, so that their application is not limited to the details and arrangements of the components described above or shown in the drawings. For example, multiple aspects described in one embodiment can be combined with multiple aspects described in other embodiments in any way. The steps, functions or features recorded in multiple modules or units can be performed or satisfied by one module or one unit. The steps of the method disclosed herein are not limited to being performed in any particular order, and it is possible to perform some or all of the steps in other orders. Any figure mark in the claims should not be interpreted as limiting the scope of the claims.

[0115] Although the present invention has been described by way of the drawings and embodiments, such description and explanation should be considered as illustrative or exemplary rather than restrictive. It should be appreciated by those skilled in the art that various modifications, additions and substitutions are possible without departing from the scope and spirit of the present invention disclosed by the appended claims.

Claims

1. An application platform security device, which, when in operation, is connected to an external application platform network, characterized in that: The application platform security device includes: The password management system is connected to the application platform network when in operation; The cryptographic machine, when in operation, is connected to the cryptographic management system network; and A quantum random number generator, when in operation, is connected to the cryptographic machine network; Wherein, when working, when the password management system sends a request content to the password machine, which is any one of the following: generating a random number, generating a key, and encoding a digital envelope, the password machine receiving the request content sends a request to generate a quantum random number to the quantum random number generator, and the quantum random number generator receives the request to generate a quantum random number and sends the generated quantum random number to the password machine; the password machine sends corresponding content to the password management system based on the received request content of the password management system; The password management system comprises: Database, used to store encrypted data; Password management tools; and System password service tool; Wherein, during operation, the database, password management tool and system password service tool are connected to the network; The number of the cryptographic machines is at least two, and when in operation, all the cryptographic machines are connected to the password management system network, and all the cryptographic machines are connected to each other through the network; The signature verification server is connected to the password management system network when in operation; The signature verification server, the cryptographic machine, and the quantum random number generator are arranged on the same cloud computing device; and / or The signature verification server, the cryptographic machine, and the quantum random number generator are located in the same subnet; The number of the signature verification servers is at least two, and when in operation, all the signature verification servers are connected to each other through a network.

2. The application platform security device according to claim 1, characterized in that: The password management system is a cluster configuration, including at least two cluster nodes, and when working, all the cluster nodes are connected to each other through a network; Each of the cluster nodes includes the database, a password management tool and a system password service tool.

3. The application platform security device according to claim 1, characterized in that: The password management system, the cryptographic machine and the quantum random number generator are located in different sub-networks.

4. The application platform security device according to claim 1, characterized in that: Further including: The timestamp server, when in operation, is connected to the password management system network.

5. The application platform security device according to claim 4, characterized in that: The timestamp server, the cryptographic machine, and the quantum random number generator are arranged on the same cloud computing device; and / or The timestamp server, the cryptographic machine, and the quantum random number generator are located in the same subnetwork; The number of the timestamp servers is at least two, and when in operation, all the timestamp servers are connected to each other through a network.

Images