Application control method, secure execution module and storage medium based on quantum network

Abstract

The present invention relates to the field of quantum communication technology, and discloses an application control method based on a quantum network, a security execution module, and a storage medium. The application control method based on a quantum network is applied to a first security execution module on the side of a fusion security management platform, including: applying for a first quantum key from a quantum network, wherein the first quantum key is used to generate a first session key; sending a first control instruction encrypted based on the first session key to a second security execution module through the quantum network, wherein the first control instruction is used to instruct to deactivate a first working key used by an application, and the second security execution module decrypts the first encrypted control instruction received according to the first session key to obtain the first control instruction, and deactivates the first working key to achieve control over the application.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of quantum communication technology, and in particular to an application management and control method, a secure execution module, and a storage medium based on a quantum network. Background Art

[0002] Key update is the process of replacing old keys with new ones, which is one of the important contents of key management. Key update includes two update methods: generating new keys from old keys before the key expires and replacing old keys with new keys, and directly replacing old keys with new keys. Keys are usually updated in the following two situations: ① The key life cycle ends. ② It is known or suspected that the key is leaked. As a basic requirement of key management, key update should be updated regularly regardless of whether the key is leaked, so as to prevent attackers from analyzing the key by intercepting a large amount of ciphertext over a long period of time.

[0003] At the current stage of quantum secure communication applications, quantum key negotiation is highly secure, which helps to increase the frequency of key updates and protect data security. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide an application management and control method, a secure execution module and a storage medium based on a quantum network, so as to achieve effective and secure management and control of application data to improve the security of the application.

[0005] To solve the above technical problems, an embodiment of the present invention provides an application control method based on a quantum network, which is applied to a first security execution module on the side of a fusion security management platform. The first security execution module negotiates with the second security execution module on the other end to share a quantum key through a quantum network. The second security execution module is deployed on the application side, including: applying for a first quantum key from the quantum network, wherein the first quantum key is used to generate a first session key; sending a first control instruction encrypted based on the first session key to the second security execution module through the quantum network, wherein the first control instruction is used to instruct the deactivation of a first working key used by the application, and the second security execution module decrypts the received encrypted first control instruction according to the first session key to obtain the first control instruction, and deactivates the first working key to achieve control over the application.

[0006] An embodiment of the present invention also provides an application control method based on a quantum network, which is applied to a second security execution module on the application side. The second security execution module negotiates with the first security execution module on the other end to share a quantum key through a quantum network. The first security execution module is deployed on the fusion security management platform side, including: receiving a first quantum key pushed by the quantum network, wherein the first quantum key is used to generate a first session key; receiving a first control instruction encrypted by the first session key through the quantum network, and decrypting the received encrypted first control instruction according to the first session key, wherein the first control instruction is used to instruct to deactivate the first working key of the application; and using the second working key to update and replace the first working key to achieve control of the application.

[0007] In an embodiment of the present invention, when it is necessary to control the data of an application, the first control instruction is transmitted to the opposite security execution module through the quantum network. Compared with the method of transmitting the first control instruction through the management channel from the integrated security management platform to the security execution module, the transmission security of the first control instruction can be effectively guaranteed. Moreover, since the session key used to encrypt the first control instruction is generated based on the quantum key, the possibility of the first control instruction being attacked and tampered with can be avoided, thereby improving the security of the application data. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] One or more embodiments are exemplarily described by the pictures in the corresponding drawings, and these exemplary descriptions do not constitute limitations on the embodiments.

[0009] Figure 1 is a schematic diagram of the system structure involved in the application control method based on quantum network according to an embodiment of the present application;

[0010] Figure 2 is a flow chart of a quantum network-based application management and control method applied in a first SEM according to an embodiment of the present application;

[0011] Figure 3 is an interactive schematic diagram of an application control method based on a quantum network according to an embodiment of the present application;

[0012] Figure 4 is a schematic diagram of the composition of the control command controlCmd in an embodiment of the present application;

[0013] Figure 5 is a flow chart of a quantum network-based application management and control method applied in a second SEM according to an embodiment of the present application;

[0014] Figure 6 It is a schematic diagram of the structure of the security execution module in an embodiment of the present application. DETAILED DESCRIPTION

[0015] To make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present invention, many technical details are proposed in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented. The division of the following embodiments is for the convenience of description, and should not constitute any limitation on the specific implementation of the present invention. The various embodiments can be combined and referenced with each other without contradiction.

[0016] At least one embodiment of the present application provides a key update management system, such as Figure 1 As shown, the system includes: a harmonized security control module (HSCM), multiple security execution modules (SEM), a key management terminal (KMT), a key management device (KMS) and a quantum key distribution (QKD) device.

[0017] Among them, HSCM is the central management platform of SEM, with the ability of user, business management, equipment, network management, interconnection and policy control; HSCM is connected to SEM to centrally manage and control SEM. SEM is a cryptographic computing device for data encryption and decryption, with key generation / storage, policy storage, digital signature / verification, identity authentication, data encryption / decryption, quantum random number, quantum key service capabilities, and external application interface supports JAVA and C language API.

[0018] Among them, KMT, as a key generation control client, is controlled by the key management server; controls the quantum key distribution equipment under its jurisdiction to perform quantum key distribution; controls the optical quantum switch under its jurisdiction to perform optical path switching; outputs quantum keys to application layer devices; receives quantum keys input from the quantum layer and realizes local secure storage of quantum keys; collaborates with the quantum key management service system to complete the key relay process; and provides a network management interface to realize the network management server's secure monitoring of the equipment.

[0019] Among them, KMS, including QKM-C600 and QKM-S600, QKM-S600 can also interact with QKM-C600 as a management domain subnet to complete key management related functions, share data with other servers, and accept the management of the network management system, further expanding the network control range and enhancing the robustness of the entire network.

[0020] Among them, QKD, including polarization-encoded QKD products, polarization-encoded QKDM products, high-speed polarization-encoded QKD products, time-phase-encoded QKD products and miniaturized polarization-encoded QKD products, is the core equipment that constitutes the quantum secure communication network (the basic QKD system usually consists of a pair of QKD devices connected by a quantum channel), which can realize information-theoretically secure symmetric key distribution on point-to-point links.

[0021] This application deploys a SEM on the operation center side (or called this side, or called the integrated security platform side, or called the operation side) and the IDC data center side (or called the opposite side, or called the application side). For the convenience of description, the local SEM located on the integrated security management platform side is called the first SEM, and the SEM located on the IDC opposite side is called the second SEM. Both the first SEM and the second SEM are connected to the HSCM and are managed by the HSCM. The HSCM transmits the pre-information of the key update to the first SEM and the second SEM. The first control instruction for the key update is signed by the HSCM and handed over to the first SEM. Before the key update starts, the first SEM and the second SEM have learned the device IDs (including QKD device ID, KMT device ID, etc.) in the quantum network of both parties.

[0022] In the above-mentioned operating environment of the present application, at least one embodiment of the present application provides an application management and control method based on a quantum network, which is applied to a first security execution module on the side of the integrated security management platform, and the first security execution module and the second security execution module of the opposite end negotiate a shared quantum key (for example, a first quantum key) through the quantum network, and the second security execution module is deployed on the application side, such as Figure 2 As shown, including:

[0023] Step S201, applying for a first quantum key from a quantum network, wherein the first quantum key is used to generate a first session key;

[0024] Step S203: Send the first control instruction encrypted based on the first session key to the second security execution module through the quantum network, wherein the first control instruction is used to instruct the deactivation of the first working key used by the application. The second security execution module decrypts the received encrypted first control instruction according to the first session key to obtain the first control instruction, and deactivates the first working key to achieve control over the application.

[0025] In the above-mentioned manner, when it is necessary to control the data of the application, the first control instruction is transmitted to the opposite end security execution module through the quantum network. Compared with the method of transmitting the first control instruction through the management channel from the integrated security management platform to the security execution module, the transmission security of the first control instruction can be effectively guaranteed. Moreover, since the session key used to encrypt the first control instruction is generated based on the shared quantum key, the possibility of the first control instruction being attacked and tampered can be avoided, thereby improving the security of the application data. The implementation details of the application control method based on the quantum network of the embodiment of the present invention are specifically described below. The following content is only the implementation details provided for the convenience of understanding and is not necessary for the implementation of this solution.

[0026] In step 201, a first quantum key is applied to a quantum network. For example, a first SEM applies to a quantum network for generating a quantum key for a session key, and the session key includes a first session key and a second session key. In one example, after receiving a first control instruction from an HSCM, the first SEM applies to a quantum network for generating a first quantum key for a first session key. The first control instruction is initiated from the HSCM, and the initiators include: (1) initiated by a government regulatory department or a regulatory unit with regulatory responsibilities, and the HSCM provides a management terminal; (2) initiated autonomously by the HSCM management platform or display screen, and triggered manually by the HSCM or the network security system; (3) initiated by the cloud management platform, and the HSCM provides an interface.

[0027] Optionally, applying for the first quantum key from the quantum network may include: obtaining the first quantum key from the first quantum key distribution device located on the fusion security management platform side in the quantum network through the quantum key service SDK interface, wherein the first quantum key is generated by quantum key negotiation between the first quantum key distribution device and the second quantum key distribution device, and the second quantum key distribution device is used to push the first quantum key to the second security execution module. That is to say, in view of the fact that the quantum network includes a first QKD device (local QKD device) located on the fusion security management platform side and a second QKD device (opposite QKD device) located on the IDC data center side, in this step, the first SEM applies for quantum key Index1 from the local QKD device through the quantum key service SDK interface, and the length of Index1 may be 1024B; Figure 3 As shown, after receiving the quantum key application from the first SEM, the local QKD device returns the applied first quantum key to the first SEM and distributes the first quantum key through the QKD network quantum channel; the local QKD device distributes the allocated first quantum key to the opposite QKD device through the quantum channel, and the second SEM obtains the first quantum key Index1: 1024B from the opposite QKD device through the push mode.

[0028] Optionally, after step S201, the present application further includes step 202, generating a first session key based on the first quantum key. In one example, Figure 3 As shown, the first SEM generates a first session key based on the applied first quantum key: the first SEM generates the first session key as the encryption key K1:128b by intercepting the preset length (such as 128b length) of the first quantum key Index1. In addition, the second SEM also intercepts the quantum key Index1 in the same way to generate the decryption key K1:128b.

[0029] In another example, the first SEM can obtain multiple key components through multiple channels, and generate a session key based on the multiple key components (such as the first session key, and the second session key is generated in a similar way), that is, the knowledge splitting of the key is used to generate the session key. Knowledge splitting mainly refers to splitting the key into several independent key components, exporting them to the outside of the cryptographic module for storage; when importing, each key component is imported separately, and finally synthesized inside the cryptographic module. For example, the key K is split into several n components K1, ..., Kn with the same length, where the first n-1 components are randomly generated, and the original key is restored by XOR operation when imported, that is: K = K1⊕...⊕Kn. Therefore, the first SEM can obtain the first key component from the quantum network through the quantum key service SDK interface, obtain the second key component from the quantum network through the consistency verification interface, obtain the third key component through the management channel between the first SEM and the HSCM, and generate the first session key based on the first key component, the second key component and the third key component. In this example, three key components are obtained through two channels (quantum network and HSCM), but in other examples, two key components can be obtained through two channels, or more key components can be obtained through more channels, which will not be described here one by one.

[0030] In step 203, the first control instruction encrypted based on the first session key is sent to the second security execution module through the quantum network, wherein the first control instruction is used to instruct to deactivate the first working key used by the application, and the second security execution module decrypts the received encrypted first control instruction according to the first session key to obtain the first control instruction, and deactivates the first working key to implement control over the application. In an example, Figure 3As shown, the first control instruction is received from the HSCM (the timing may be before applying for the first quantum key to the quantum network), the first SEM uses the first session key as the encryption key K1, uses SM4 to encrypt the first control instruction, and then sends the encrypted first control instruction to the local QKD device through the consistency verification interface. The local QKD device transparently transmits the first control instruction to the opposite QKD device through the consistency verification interface, and the opposite QKD device sends the encrypted first control instruction to the second SEM, and the second SEM uses the decryption key K1 to decrypt the first control instruction to obtain the indication information of the first working key of the deactivated application. After the second SEM decrypts and obtains the indication information of the first working key of the deactivated application, it enters the control state: the API interface corresponding to the controlled target application stops providing cryptographic application services to the outside and outputs an alarm.

[0031] In this control state (i.e., the first control instruction corresponds to the first control state), the key state needs to be changed and the first working key encryption and decryption needs to be disabled. In addition, the second SEM pushes the key state synchronization information of the first working key to the application, stops using the first working key for data encryption and decryption operations, and transmits the control success response (i.e., the first control success response to the first control control) to the first SEM through the quantum network.

[0032] Optionally, after step S203, the present application further includes step 204, after receiving the first control success response transmitted by the second security execution module through the quantum network, sending the first control success response to the integrated security management platform. In one example, after receiving the control success response transmitted by the second security execution module through the quantum network, the first SEM sending the control success response to the HSCM may include: the second SEM sending the control success response to the opposite QKD device (i.e., the second QKD device), the opposite QKD device sending the control success response to the local QKD device (i.e., the first QKD device), the local QKD device sending the control success response to the first SEM, and the first SEM sending the received control success response to the HSCM, such as Figure 3 shown.

[0033] It can be understood that when it is necessary to control the application data, transmitting the first control instruction to the opposite secure execution module through the quantum network can effectively ensure the transmission security of the first control instruction compared to the method of transmitting the first control instruction through the management channel from HSCM to the secure execution module. Moreover, since the session key used to encrypt the first control instruction is generated based on the quantum key, the possibility of the first control instruction being attacked and tampered with can be avoided, thereby improving the security of application data.

[0034] It can also be understood that when the control is over and the target API interface that needs to be controlled resumes providing cryptographic application services to the outside world, the HSCM will send a second control instruction to the first SEM. The first SEM uses the second session key to encrypt the second control instruction (wherein the second session key is also derived based on the first quantum key), and then sends the encrypted second control instruction to the second SEM on the other end through the quantum network, where the second control instruction is used to instruct the restoration of the first working key of the application and to use the second working key to update and replace the first working key. For example, using the second session key as the encryption key K2, after using SM4 to encrypt the second control instruction, the encrypted second control instruction is sent to the local QKD device through the consistency verification interface, and the local QKD device transparently transmits the encrypted second control instruction to the opposite QKD device through the consistency verification interface. The opposite QKD device sends the encrypted second control instruction to the second SEM, and the second SEM uses the decryption key K2 to decrypt the second control instruction to obtain the first working key of the restored application and use the second working key to update and replace the first working key. The second SEM resumes providing cryptographic application services to the outside world and outputs the status for the controlled target API interface, that is, restoring the key state of the first working key, notifying the application to update the key, using the first working key to decrypt the original data, and using the new key (second working key) to update and replace the first working key for subsequent cryptographic operations. In this way, through the control of keys, the control of data access and application operation is achieved.

[0035] In an example, the control command controlCmd is composed as follows Figure 4 As shown, it includes: quantum key update type field (2 bytes), component ID serial number field (20 bytes), control operation type field (4 bytes), key operation type field (1 byte, N is transmitted for key update, U is transmitted for only changing key status) and extended parameter field (5 bytes, all 0s can be filled). Among them, the quantum key update type field is used to indicate whether the application is to be controlled or restored. For example, when the value of the quantum key update type field is Q1, it indicates that the application is to be controlled, that is, the control instruction is the first control instruction; when the value of the quantum key update type field is R1, it indicates that the application is to be restored, that is, the control instruction is the second control instruction.

[0036] Since the control requirements support 5 scenarios and 8 items, including: (1) Virtualization scenario: virtual machine trusted startup, virtual machine runtime protection; (2) Data storage scenario: virtual machine image file encryption, distributed storage encryption; (3) Cloud management platform scenario: identity authentication; (4) Cloud platform software scenario: cloud platform service process trusted startup, cloud platform sensitive parameter protection; (5) Cloud security resource pool scenario: security policy access. Therefore, the types of control operations include:

[0037] a) Virtualization (V000): Virtual machine trusted boot (V000), virtual machine runtime (Runtime) protection (V001);

[0038] b) Data storage (D000): virtual machine image file encryption (D000), distributed storage encryption (D001);

[0039] c) Cloud management platform (M000): identity authentication (M000);

[0040] d) Cloud platform software (S000): trusted startup of cloud platform service processes (S000), protection of cloud platform sensitive parameters (S001);

[0041] e) Cloud security resource pool (R000): security policy access (R000).

[0042] The 20 bytes of the component ID serial number include: 8 bytes for the device ID, 6 bytes for YYMMDD and 6 bytes for the serial number, where YYMMDD is a 6-byte time stamp. When a timestamp is used, it is a 2-byte reserved field + a 4-byte timestamp. A 6-byte custom time stamp can also be used. The component ID (20 bytes) can be used to query the database table to obtain complete key information.

[0043] That is to say, when the control of step S204 is completed and the target API interface that needs to be controlled resumes providing cryptographic application services to the outside world, step 205 can also be entered to receive a second control instruction from the integrated security management platform, and send the second control instruction encrypted based on the second session key to the second security execution module, wherein the second session key is generated based on the first quantum key, and the second control instruction is used to instruct the restoration of the first working key of the application, and use the second working key to update and replace the first working key.

[0044] In one example, after receiving the second control instruction from the HSCM, the first SEM continues to generate a new session key (such as the second session key) based on the first quantum key, and uses the second session key as the encryption key to encrypt the second control instruction. That is, the first SEM generates a new session key as the encryption key K2 by intercepting the preset length (such as 128b length) of the first quantum key Index1, and the second SEM also intercepts the first quantum key Index1 in the same way to generate a new decryption key K2. After the first SEM sends the second control instruction encrypted with K2 to the second SEM at the opposite end through the quantum network, the second SEM uses the newly generated decryption key K2 to decrypt the second control instruction, and obtains the indication information of the key use of the application with the updated key recovery.

[0045] Through the above-mentioned embodiments, when it is necessary to control the data of the application, the present application transmits the first control instruction to the opposite SEM through the quantum network. Compared with the method of transmitting the first control instruction through the management channel from HSCM to SEM, the transmission security of the first control instruction can be effectively guaranteed. Moreover, since the session key used to encrypt the first control instruction is generated based on the quantum key, the possibility of the first control instruction being attacked and tampered with can be avoided, thereby improving the security of the application data.

[0046] In the above operating environment of the present application, at least one of the present application further provides an application control method based on a quantum network, which is applied to a second security execution module on the application side, and the second security execution module negotiates with the first security execution module on the opposite end to share a quantum key through a quantum network, and the first security execution module is deployed on the fusion security management platform side, such as Figure 5 As shown, including:

[0047] Step S501, receiving a first quantum key pushed by a quantum network, wherein the first quantum key is used to generate a first session key;

[0048] Step S503, receiving a first control instruction encrypted by a first session key through the quantum network, and decrypting the received encrypted first control instruction according to the first session key, wherein the first control instruction is used to instruct to deactivate a first working key of the application;

[0049] Step S505: Use the second working key to update and replace the first working key to implement control over the application.

[0050] In the above-mentioned manner, when it is necessary to control the data of the application, the first control instruction is transmitted to the opposite end security execution module through the quantum network. Compared with the method of transmitting the first control instruction through the management channel from the integrated security management platform to the security execution module, the transmission security of the first control instruction can be effectively guaranteed. Moreover, since the session key used to encrypt the first control instruction is generated based on the shared quantum key, the possibility of the first control instruction being attacked and tampered can be avoided, thereby improving the security of the application data. The implementation details of the application control method based on the quantum network of the embodiment of the present invention are specifically described below. The following content is only the implementation details provided for the convenience of understanding and is not necessary for the implementation of this solution.

[0051] In step 501, a first quantum key pushed by a quantum network is received, wherein the first quantum key is used to generate a first session key. In one example, the quantum network includes a first QKD device (local QKD device) located on the side of the fusion security management platform and a second QKD device (opposite QKD device) located on the side of the IDC data center. After the first SEM applies for quantum key Index1 from the local QKD device through the quantum key service SDK interface, the local QKD device not only needs to return the applied quantum key to the first SEM, but also needs to distribute the allocated quantum key to the opposite QKD device through the quantum channel, and the opposite QKD device pushes the quantum key Index1 applied by the first SEM to the second SEM.

[0052] Optionally, after step S501, the present application further includes step 502, generating a first session key based on the first quantum key. In one example, the second SEM generates the first session key as the decryption key K1:128b by intercepting a preset length (such as 128b length) of the first quantum key Index1. In another example, the second SEM can obtain multiple key components through multiple channels, and generate a session key based on the multiple key components, that is, generate a session key by using the knowledge splitting of the key. For example, the second SEM uses the quantum key Index1 applied by the first SEM pushed by the peer QKD device as the first key component, obtains the second key component through the consistency verification interface of the peer QKD device, obtains the third key component through the management channel between the second SEM and the HSCM, and generates the first session key based on the first key component, the second key component and the third key component. The way in which the second SEM generates a session key by using the knowledge splitting of the key is the same as the way in which the first SEM generates a session key by using the knowledge splitting of the key, and will not be repeated here.

[0053] In step 503, a first control instruction encrypted by a first session key is received through the quantum network, and the received encrypted first control instruction is decrypted according to the first session key, wherein the first control instruction is used to instruct the deactivation of the first working key of the application. In one example, the first SEM sends the encrypted first control instruction to the local QKD device through the consistency verification interface, and the local QKD device transparently transmits the first control instruction to the opposite QKD device through the consistency verification interface, and the opposite QKD device sends the first control instruction to the second SEM. After receiving the encrypted first control instruction, the second SEM uses the first session key generated in step 502 as the decryption key K1 to decrypt the first control instruction.

[0054] In an example, the control command controlCmd is composed as follows Figure 4As shown, it includes: quantum key update type field (2 bytes), component ID serial number field (20 bytes), control operation type field (4 bytes), key operation type field (1 byte, N is transmitted for key update, U is transmitted for only changing key status) and extended parameter field (5 bytes, all 0s can be filled). The meaning of each field has been described in detail in the above embodiments and will not be repeated here.

[0055] Optionally, after step S503, the present application further includes step S504, which performs data control on the application based on the first control instruction after decryption. In one example, the second SEM performs data control on the application by disabling the first working key of the application. Specifically, after the second SEM uses the decryption key K1 to decrypt the first control instruction and obtains the instruction information of disabling the first working key of the application, it enters the control state: stops providing external cryptographic application services for the controlled target API interface and outputs an alarm; in this control state, it is necessary to change the key state of the first working key, disable the encryption and decryption of the first working key, and the second SEM pushes the key state synchronization information to the application, and stops using the first working key for data encryption and decryption operations; the business system of the application needs to provide an interface to receive the key state change notification of the current key (i.e., the first working key), and the business system provides the following content for receiving the key state change:

[0056] Current key ID pointer: KeyID[in]; Current key ID length: KeyIDLen[in]; If it is an update, a new keyId needs to be sent: NewKeyID[in]; New key ID length: NewKeyIDLen[in]; Current status: Status[in]; Change operation (1: Update, 2: Expiration, 3: Cancellation, 4: Deactivation, 5: Restore to use): EventType[in]: Whether the business system needs to respond (0: Not required, 1: Required): FeedBack[in]; Component ID, length limit: no more than 512 bytes: ComponentID[in]; Component ID length: ComponentIDLen[in]; Whether changes are allowed (0: Not allowed, 1: Allowed): Permit[out]; Return value: 0 for success, non-0 for failure, and an error business return code is returned.

[0057] In addition, the second SEM needs to update the first working key of the application, and after completing the update of the first working key of the application, call the KMS interface through KMIP to import the new key (such as the second working key) into KMS to obtain the new key ID (newKeyId), and write the corresponding operation into the database. In other words, the second SEM also needs to report the updated application key (such as the second working key) to the HSCM, where the second working key can be derived based on the first quantum key, such as Figure 3 shown.

[0058] In one example, the key update performed by the second SEM may include: decrypting the old key of the data, canceling the old key, and entering the historical key library; generating a new key: for symmetric and asymmetric keys, different methods are used to generate new keys. Among them, the new usage key (such as the second working key) can be derived based on the first quantum key obtained by push mode. The updated usage key is used to encrypt the application data after the management and control are restored, and the new key is entered into the in-use key library.

[0059] When the control is over, step S505 is entered, and the second working key is used to update and replace the first working key to realize the control of the application. In one example, the first SEM continues to derive the second session key based on the first quantum key, uses the second session key as the encryption key K2, uses SM4 to encrypt the second control instruction, and sends the encrypted second control instruction to the local QKD device through the consistency verification interface, and the local QKD device transmits the encrypted second control instruction to the opposite QKD device through the consistency verification interface, and the opposite QKD device sends the encrypted second control instruction to the second SEM, and the second SEM uses the decryption key K2 to decrypt the second control instruction, and obtains the indication information of restoring the first working key of the application and using the second working key to update and replace the first working key. The second SEM resumes providing cryptographic application services and outputs the status for the controlled target API interface, that is, restoring the key state of the first working key, notifying the application to update the key, using the old key (first working key) to decrypt the original data, and using the new key (second working key) to update and replace the old key for subsequent cryptographic operations, thereby realizing the control of data access and application operation through the control of the key.

[0060] Here, the second SEM can obtain the new key ID (newKeyId) according to the component code componentCode query table, and push the new key ID to the application. The serviceapi interface provided to the outside world must support the use of the old key to decrypt data, but the old key can no longer be used to perform encryption and signing operations. Through the control of keys, data access and application operation can be controlled.

[0061] In the embodiment of the present invention, the management and control requirements support five scenarios and eight items, including: (1) virtualization scenario: virtual machine trusted startup, virtual machine runtime protection; (2) data storage scenario: virtual machine image file encryption, distributed storage encryption; (3) cloud management platform scenario: identity authentication; (4) cloud platform software scenario: cloud platform service process trusted startup, cloud platform sensitive parameter protection; (5) cloud security resource pool scenario: security policy access.

[0062] The following application scenario is distributed storage encryption as an example. The cloud platform uses the Cinder component of OpenStack to call the interface of the distributed storage librbd and access the underlying storage resources using the block storage protocol. Distributed storage uses osd as the basic storage application unit. osd manages physical storage devices (HDD, SSD, NVME, etc.). Monitor, as a monitor of the distributed cluster, manages the cluster system metadata. The client obtains some basic information about the cluster through interaction with Monitor. At the same time, SEM is deployed in the physical environment where librbd is located (or an accessible node). The data flow is encrypted and decrypted at the librbd layer, and finally distributed to the rados underlying osd through the network for data storage.

[0063] When the application is distributed storage, under normal procedures, the cloud platform calls the distributed storage librbd interface through the cinder component to initiate a data write request and write the data. At this time, the distributed storage librbd sends the data to the SEM (i.e., the second SEM mentioned above) for encryption. The distributed storage librbd sends the encrypted data to the rados underlying osd through the network for data storage. If the data is written successfully, the distributed storage librbd returns the write success information to the cinder component.

[0064] When a security incident occurs and the distributed storage needs to be controlled, for example, when the HSCM receives a cloud management / supervision terminal service locking instruction, the HSCM issues a key-controlled locking instruction (i.e., the above-mentioned first control instruction) to the first SEM, and the service is suspended. In one example, the HSCM encapsulates the control instruction transmitted by the large screen backend as follows: according to the incoming hashId (hash identifier), the component ID serial number (20 bytes) is searched, and the control instruction controlCmd with a length of 32 bits is assembled. The HSCM reads the local configuration controlMod and calls the specified SEM module secret service interface to issue a key-controlled locking instruction to the first SEM. Through the four-control and first-class KPI interactive channel, the control indicators of the cloud management and HSCM system including SEM can be presented on the large screen, thereby reflecting the system's control logic and ability to intervene in the service.

[0065] The first SEM encrypts the key-controlled locking instruction and sends it to the second SEM via the quantum network, wherein the encryption key of the key-controlled locking instruction is generated based on the quantum key requested from the quantum network.

[0066] The second SEM (i.e., the SEM that provides encryption and decryption services for the distributed storage librbd) executes the key-controlled locking instruction after decrypting the key-controlled locking instruction, wherein the decryption key is generated based on the quantum key pushed by the quantum network. In the control state, when the cloud platform calls the distributed storage librbd interface through the cinder component to initiate a data read and write request, the distributed storage librbd sends a data encryption and decryption request to the second SEM, the SEM encryption and decryption fails, and returns a key-controlled exception error message to the distributed storage librbd. The distributed storage librbd receives the SEM exception return and returns the key-controlled exception error message to the cinder component. The cloud platform reads and writes storage data abnormally, and prompts "data is controlled, reading and writing failed".

[0067] After confirming that the security incident has been resolved, the cloud administrator sends a key controlled release instruction (i.e., the second control instruction mentioned above) to the first SEM through HSCM. The first SEM encrypts the key controlled release instruction through the quantum network and sends it to the second SEM. After decrypting the key controlled release instruction, the second SEM resumes the encryption and decryption services provided to the distributed storage librbd, and the business is restored.

[0068] In one example, HSCM searches for the component ID serial number (20 bytes) according to the hashId passed in, assembles a 32-bit control instruction controlCmd, and HSCM calls the specified SEM (reads the local configuration controlMod) module secret service interface to issue the control instruction with the parameter controlCmd, and issues the fully encapsulated key controlled release instruction to the first SEM. The first SEM transmits the encrypted key controlled release instruction to the second SEM through the quantum network. After the second SEM decrypts the key controlled release instruction, it executes the key controlled release instruction. When the cloud platform initiates a data read and write request again, it calls the distributed storage librbd interface through the cinder component to initiate a data read and write request. The distributed storage librbd sends a data encryption and decryption request to the SEM. The second SEM encrypts and decrypts successfully, that is, the cloud platform successfully reads and writes distributed storage data.

[0069] Through the above-mentioned embodiments, when it is necessary to control the data of the application, the present application transmits the first control instruction to the opposite SEM through the quantum network. Compared with the method of transmitting the first control instruction through the management channel from HSCM to SEM, the transmission security of the first control instruction can be effectively guaranteed. Moreover, since the session key used to encrypt the first control instruction is generated based on the quantum key, the possibility of the first control instruction being attacked and tampered with can be avoided, thereby improving the security of the application data.

[0070] The step division of the above methods is only for the purpose of clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this patent.

[0071] Another embodiment of the present application further provides a secure execution module, such as Figure 6 As shown, it includes: at least one processor 601; and a memory 602 that is communicatively connected to the at least one processor 601; wherein the memory 602 stores instructions that can be executed by the at least one processor 601, and the instructions are executed by the at least one processor 601, so that the at least one processor 601 can execute the application control method based on the quantum network applied to the first security execution module on the integrated security management platform side described in any of the above method embodiments, or the application control method based on the quantum network applied to the second security execution module on the data center side.

[0072] The memory 602 and the processor 601 are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors 601 and the memory 602 together. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The processor 601 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. The memory 602 can be used to store data used by the processor 601 when performing operations.

[0073] In one example, the security execution module may also include underlying hardware, operating system, functional components and cryptographic service interface. The underlying hardware includes: CPU, memory, hard disk, network card and at least one cryptographic unit (for high-speed cryptographic operation and key storage); the operating system may adopt a tailored Linux operating system; the functional components include: cryptographic calculation module, key management module and other modules. The above processor 601 is equivalent to the CPU, the memory 602 may be a memory or a hard disk, and the CPU implements timing, peripheral interface, voltage regulation, power management and other control functions by executing the program in the memory 602.

[0074] In addition, the examples mentioned in the above embodiments can be freely combined, and any combination can be understood as an embodiment. The "embodiment" or "example" appearing in various positions in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It can be understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0075] Another embodiment of the present invention relates to a computer-readable storage medium storing a computer program. The computer program is executed by a processor to implement the above method embodiment. That is, those skilled in the art can understand that all or part of the steps in the above method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

[0076] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present invention, and that in actual applications, various changes may be made in form and detail without departing from the spirit and scope of the present invention.

Claims

1. A quantum network-based application management and control method, applied to a first security execution module on a fusion security management platform side, wherein the first security execution module negotiates with a second security execution module on the other end to share a quantum key through a quantum network, and the second security execution module is deployed on the application side, characterized in that: include: Applying for a first quantum key from a quantum network, wherein the first quantum key is used to generate a first session key; The first control instruction encrypted based on the first session key is sent to the second security execution module through the quantum network, wherein the first control instruction carries a quantum key update type and a control operation type, the quantum key update type includes control, and the control operation type includes an application type; if the first control instruction indicates to control the application, the second security execution module decrypts the received encrypted first control instruction according to the first session key to obtain the first control instruction, and deactivates the first working key used by the application to achieve control of the application.

2. The application management method according to claim 1, characterized in that: Applying for the first quantum key to the quantum network includes: Through the quantum key service SDK interface, a first quantum key is obtained from a first quantum key distribution device located on the fusion security management platform side in the quantum network, wherein the first quantum key is generated by quantum key negotiation between the first quantum key distribution device and the second quantum key distribution device, and the second quantum key distribution device is used to push the first quantum key to the second security execution module.

3. The application management method according to claim 2, characterized in that: Obtaining the first quantum key from the first quantum key distribution device located on the fusion security management platform side in the quantum network through the quantum key service SDK interface includes: Obtaining a first key component from a first quantum key distribution device located on the fusion security management platform side in the quantum network through a quantum key service SDK interface; Obtaining a second key component from a first quantum key distribution device located on the fusion security management platform side in the quantum network through a consistency check interface; Acquire a third key component through a management channel between the first security execution module and the converged security management platform; The first session key is generated based on the first key component, the second key component and the third key component.

4. The application management method according to claim 1, characterized in that: Sending the first control instruction encrypted based on the first session key to the second secure execution module through the quantum network includes: Sending a first control instruction encrypted based on the first session key to a first quantum key distribution device, wherein the first quantum key distribution device transparently transmits the encrypted first control instruction to a second quantum key distribution device through a consistency verification interface, and the second quantum key distribution device sends the encrypted first control instruction to the second security execution module; Receive a second control instruction from the integrated security management platform, and send the second control instruction encrypted based on the second session key to the second security execution module, wherein the second session key is generated based on the first quantum key, and the second control instruction is used to instruct the recovery of the first working key of the application and use the second working key to update and replace the first working key.

5. The application management method according to claim 4, characterized in that: Sending the second control instruction encrypted based on the second session key to the second security execution module includes: Sending a second control instruction encrypted based on the second session key to the first quantum key distribution device, wherein the first quantum key distribution device transparently transmits the encrypted second control instruction to the second quantum key distribution device through a consistency verification interface, and the second quantum key distribution device is further used to send the encrypted second control instruction to the second security execution module; After receiving the second control success response transmitted by the second security execution module through the quantum network, the second control success response is sent to the integrated security management platform.

6. The application management method according to claim 4, characterized in that: Both the first control instruction and the second control instruction include: a quantum key update type field, a component ID serial number field, a control operation type field, a key operation type field and an extended parameter field, wherein the quantum key update type field is used to indicate control of the application or recovery of the application, the component ID serial number field is used to obtain the ID information of the updated new key, the control operation type field is used to indicate the target application type of control, and the key operation type field is used to indicate a key update or only a change in the key state.

7. The application management method according to any one of claims 1 to 6, characterized in that: Also includes: Before applying for the first quantum key from the quantum network, receiving the first control instruction from the fusion security management platform; After receiving the first control success response transmitted by the second security execution module through the quantum network, the first control success response is sent to the integrated security management platform.

8. A quantum network-based application management and control method, applied to a second security execution module on the application side, wherein the second security execution module negotiates with a first security execution module on the other end to share a quantum key through a quantum network, and the first security execution module is deployed on a converged security management platform side, characterized in that: include: Receiving a first quantum key pushed by a quantum network, wherein the first quantum key is used to generate a first session key; receiving, through the quantum network, a first control instruction encrypted by the first session key, and decrypting the received encrypted first control instruction according to the first session key, wherein the first control instruction carries a quantum key update type and a control operation type, the quantum key update type includes control, and the control operation type includes an application type; If the first control instruction indicates to control the application, the second working key is used to update the first working key used by the replacement application to deactivate the first working key, thereby achieving control over the application.

9. The application management method according to claim 8, characterized in that: Using the second working key to update and replace the first working key to implement the control of the application includes: disabling the first working key according to the first control instruction, and pushing key state synchronization information of the first working key to the application; Receiving a second control instruction encrypted by a second session key through the quantum network, and decrypting the received encrypted second control instruction according to the second session key to obtain the second control instruction, wherein the second control instruction instructs to restore the first working key of the application and to update and replace the first working key with the second working key; The first working key is updated and replaced with the second working key, and the second working key used by the application is reported to the converged security management platform.

10. A secure execution module, characterized in that: At least one cryptographic unit for high-speed cryptographic operations and key storage; at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the quantum network-based application management and control method as described in any one of claims 1 to 9.

11. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the application management and control method based on a quantum network described in any one of claims 1 to 9 is implemented.

Images