Quantum fusion cryptographic card and data processing method

Abstract

The embodiment of the present invention relates to the field of quantum communication technology, and discloses a quantum fusion cryptographic card and a data processing method. In the present invention, the quantum fusion cryptographic card includes: a main control chip carrying a real-time operating system, a first PCI-E interface, a second PCI-E interface and a cryptographic chip, the main control chip obtains a quantum key from a quantum key distribution network through a quantum key interface, and receives and responds to a cryptographic service request of an upper-layer application through the second PCI-E interface, the cryptographic chip is connected to the main control chip through the first PCI-E interface, obtains a quantum key from the main control chip to perform cryptographic operations and / or key operations, so as to realize the quantum security capability of the cryptographic card and the processing of cryptographic service requests, and meet the basic requirements of the enterprise's data value-added services.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of quantum communication technology, and in particular to a quantum fusion cryptographic card and a data processing method. Background Art

[0002] PCI cryptographic cards are divided into two types of implementation: software implementation and hardware implementation. Software implementation refers to the implementation of cryptographic algorithms through FPGA or DSP chips; hardware implementation refers to the implementation of cryptographic algorithms using dedicated cryptographic algorithm chips. PCI cryptographic cards play a key role in data encryption and decryption in computer systems, and mainly include the following functions:

[0003] Cryptographic operations: Implement a variety of cryptographic algorithms, including symmetric cryptographic algorithms, asymmetric cryptographic algorithms, and hash algorithms. Encrypt sensitive data to protect the confidentiality of data during transmission and storage, and prevent unauthorized users from accessing and stealing sensitive information. At the same time, it can also decrypt encrypted data to ensure that the data can be correctly decrypted and used by legitimate users when needed.

[0004] Key management: Generate, store and manage the keys required for various cryptographic algorithms. It can generate high-strength random keys, store keys, and import and export keys to ensure the security and reliability of keys.

[0005] Key storage: PCI cryptographic cards usually have a secure storage area inside the cryptographic card chip for storing sensitive data, keys, certificates, etc. This storage area is usually protected at the hardware level and is highly secure against illegal external access.

[0006] However, the inventors found that quantum computing may weaken the security of multiple cryptographic algorithms in the current related technologies of PCI cryptographic cards, exposing information systems to potential security risks. Moreover, PCI cryptographic cards implement specific encryption and decryption operations and key storage, and cannot process upper-level cryptographic service requests such as identity authentication and data security transmission. In the context of digital transformation, it is unable to meet the data value-added service needs of enterprises. Summary of the invention

[0007] The purpose of the embodiments of the present invention is to provide a quantum fusion cryptographic card and a data processing method to achieve quantum security capabilities, and to provide cryptographic services without the participation of a host to meet the data value-added service needs of an enterprise.

[0008] To solve the above technical problems, an embodiment of the present invention provides a quantum fusion cryptographic card, comprising: a first PCI-E interface; a main control chip carrying a real-time operating system, wherein the main control chip obtains a quantum key from a quantum key distribution network through a quantum key interface, receives and responds to a cryptographic service request of an upper-layer application through a cryptographic service interface, and the cryptographic service interface is a second PCI-E interface; a cryptographic chip connected to the main control chip through the first PCI-E interface, wherein the cryptographic chip obtains a quantum key from the main control chip to perform cryptographic operations and / or key operations.

[0009] An embodiment of the present invention also provides a data processing method, which is applied to the above-mentioned quantum fusion cryptographic card, and the method includes: a main control chip receives a cryptographic service request from an upper-layer application, and converts the cryptographic service request into a cryptographic operation instruction and transmits it to a cryptographic chip, wherein the cryptographic chip executes the cryptographic operation instruction and feeds back the execution result to the main control chip; the main control chip responds to the cryptographic service request according to the execution result.

[0010] In an embodiment of the present invention, a quantum fusion cryptographic card including a first PCI-E interface, a second PCI-E interface, a main control chip and a cryptographic chip is provided, wherein the main control chip carries a real-time operating system, obtains a quantum key from a quantum key distribution network through a quantum key interface, receives and responds to a cryptographic service request of an upper-layer application through a cryptographic service interface, and the cryptographic chip is connected to the main control chip through the first PCI-E interface, and obtains a quantum key from the main control chip to perform cryptographic operations and / or key operations. Due to the addition of a real-time operating system, a general cryptographic service interface (i.e., a second PCI-E interface) is used to provide general cryptographic services to a typical cryptographic service layer and an application layer, and the cryptographic service request of the upper-layer application is converted into a specific basic cryptographic operation request. Moreover, since cryptographic operations and / or key operations are implemented based on quantum keys obtained from a quantum key distribution network, the quantum security capability of the cryptographic card and the processing of cryptographic service requests can be realized, and the basic requirements of the enterprise's data value-added services can be met. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0012] Figure 1 is a schematic diagram of the structure of a quantum fusion cryptographic card according to an embodiment of the present invention;

[0013] Figure 2 is a flow chart of a data processing method according to an embodiment of the present invention;

[0014] Figure 3 It is a schematic diagram of virtualizing a quantum fusion cryptographic card into multiple virtual cryptographic cards according to an embodiment of the present invention;

[0015] Figure 4 2. It is a schematic diagram of the operation set comparison management function of the quantum fusion cryptographic card according to an embodiment of the present invention;

[0016] Figure 5 is a schematic diagram of identity authentication and encrypted transmission by a quantum fusion cryptographic card according to an embodiment of the present invention;

[0017] Figure 6 This is a flow chart of identity authentication and encrypted transmission performed by a quantum fusion cryptographic card according to an embodiment of the present invention;

[0018] Figure 7 is a schematic diagram of using a quantum fusion cryptographic card to encrypt a file according to an embodiment of the present invention;

[0019] Figure 8 is a schematic diagram of an application of a quantum fusion cryptographic card in a distributed storage system according to an embodiment of the present invention;

[0020] Fig. 9 It is a schematic diagram of a quantum fusion cryptographic card according to an embodiment of the present invention using a network card to achieve secure mutual control. DETAILED DESCRIPTION

[0021] In the context of digital transformation, it has become a basic requirement for value-added data services to combine new business data of enterprises with cloud services to realize distributed multi-cloud, multi-point and cross-domain flow. How to effectively solve the corresponding security management responsibilities, data abuse, data leakage and other issues has become more and more urgent. Data must flow across different security domains securely and be safe and controllable. Large groups have the need to realize interoperable security management and control of data in each security domain, cross-domain remote control command issuance, and operation set management; at the same time, enterprises have the need to create integrated and fully integrated applications, which requires combining security and high-sensitivity business solutions to solve the isolation and interoperability of policy issuance, policy triggering, control information flow and business data flow in the domain and cross-domain scenarios combined with the virtualized operating environment.

[0022] To make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present invention, many technical details are proposed in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented. The division of the following embodiments is for the convenience of description, and should not constitute any limitation on the specific implementation of the present invention. The various embodiments can be combined and referenced with each other without contradiction.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] One embodiment of the present invention relates to a quantum fusion cryptographic card. In this embodiment, the quantum fusion cryptographic card includes: a first PCI-E interface; a main control chip carrying a real-time operating system, wherein the main control chip can also be understood as a main processor, obtains a quantum key from a quantum key distribution network through a quantum key interface, receives and responds to a cryptographic service request of an upper-layer application through a cryptographic service interface, and the cryptographic service interface is a second PCI-E interface; a cryptographic chip connected to the main control chip through the first PCI-E interface, wherein the cryptographic chip can also be understood as a cryptographic coprocessor, obtains a quantum key from the main control chip to perform cryptographic operations and / or key operations to achieve quantum security capabilities, and can provide cryptographic services without the participation of a host to meet the data value-added service needs of an enterprise. The implementation details of the quantum fusion cryptographic card of this embodiment are specifically described below. The following content is only for the convenience of understanding the implementation details provided, and is not necessary for the implementation of this solution.

[0025] like Figure 1As shown, the quantum fusion cryptographic card of this embodiment includes: a first PCI-E interface 101, a main control chip 102, a cryptographic chip 103, a second PCI-E interface 104 and a quantum key interface 105. Among them, the main control chip 102 carries a real-time operating system (RTOS), which is also called an instant operating system. It runs and manages system resources in a sequence and provides a consistent basis for developing applications. The main control chip 102 obtains the quantum key from the quantum key distribution network through the quantum key interface 105, and receives and responds to the cryptographic service request of the upper application through the cryptographic service interface (i.e., the second PCI-E interface 104). The cryptographic chip 103 is connected to the main control chip through the first PCI-E interface 101, and obtains the quantum key from the main control chip to perform cryptographic operations and / or key operations.

[0026] In an example, Figure 1 The quantum fusion cryptographic card shown also includes: a synchronous dynamic random access memory 106 (SDRAM) connected to the main control chip 102, wherein SDRAM 106 provides dynamic data storage for the main control chip. An embedded MultiMediaCard 107 (eMMC) connected to the main control chip 102, wherein eMMC 107 provides persistent data storage for the main control chip. A quantum random number chip 108 (QRNG) connected to the main control chip 102, wherein QRNG 108 generates quantum random numbers and provides the generated quantum random numbers to the main control chip, and low-speed chips such as QRNG are connected to the main control chip 102 via a serial bus. A USB authentication interface 109 connected to the main control chip 102, wherein the USB authentication interface 109 provides a channel for the main control chip 102 to authenticate the device identity, and the device includes a smart password key.

[0027] In addition, if Figure 1 The quantum fusion cryptographic card shown may also include: an algorithm chip 110 connected to the cryptographic chip 103, wherein the algorithm chip 110 provides a preset cryptographic algorithm for performing cryptographic operations and key operations; the algorithm chip 110 can be understood as a cryptographic chip for implementing an algorithm such as SM1, which is only responsible for a single algorithm operation. A random number generator 111 connected to the cryptographic chip 103, wherein the random number generator 111 generates random numbers and provides random numbers to the cryptographic chip 103. A key memory 112 connected to the cryptographic chip 103, wherein the key memory 112 stores quantum keys.

[0028] The main control chip 102 provides general cryptographic services such as certificate parsing, certificate authentication, confidentiality, integrity and non-repudiation of information to upper-layer applications through the unified second PCIE interface 104. The real-time operating system running on the main control chip 102 converts the cryptographic service request of the upper-layer application into a specific basic cryptographic operation request, and calls the cryptographic chip 103 through the first PCI-E interface 101 to implement specific cryptographic operations and key operations. In other words, the first PCI-E interface 101 connects to the cryptographic chip 103 for data encryption and decryption, and the second PCIE interface 104 provides cryptographic services to the outside. The main control chip 102 can respond to the potential threat of quantum computing and increase the entropy value of random numbers by integrating a real-time operating system and a quantum random number chip, and supporting the rapid access of the post-quantum cryptography algorithm (Post Quantum Cryptography, referred to as "PQC") and quantum key distribution (Quantum key distribution, referred to as "QKD") system.

[0029] The quantum fusion cryptographic card of this embodiment is based on the quantum key negotiation network (QKDN) technology, integrates the classical cryptographic application technology, and plans to use the cryptographic card as a carrier to build a new type of management and control system with data security as the core, which focuses on solving the unified collaborative security supervision mechanism and operating environment problems when data flows or operates in multiple clouds and multiple points, and is suitable for new business to achieve data isolation, data intercommunication and data processing logic collaborative management in the cloud service environment. The carrier should realize the needs of miniaturization and flexible deployment of quantum cryptographic application equipment. As a quantum fusion cryptographic card with an integrated real-time operating system, it realizes the flexible deployment of quantum security capabilities. In addition, since the quantum fusion cryptographic card has an embedded operating system and can have general computing capabilities, applications can be deployed in it to realize custom applications in cryptographic devices. The quantum fusion cryptographic card can also retain a limited management interface so that trusted applications can be flexibly imported into the cryptographic card, and custom applications can run in the card, call cryptographic resources internally, and provide services externally through the cryptographic card. Therefore, quantum security capabilities can be realized, and cryptographic services can be provided without the participation of the host to meet the data value-added service needs of the enterprise.

[0030] Another embodiment of the present invention relates to a data processing method, which is applied to the above-mentioned quantum fusion cryptographic card. The specific method is as follows: Figure 2 shown.

[0031] In step 201, the main control chip receives a cryptographic service request from an upper layer application, and converts the cryptographic service request into a cryptographic operation instruction and transmits it to the cryptographic chip, wherein the cryptographic chip executes the cryptographic operation instruction and feeds back the execution result to the main control chip.

[0032] In step 202, the main control chip responds to the cryptographic service request according to the execution result.

[0033] In one example, compared to the current related technology, the password card usually only has three different permissions: administrator, operator, and super administrator. There is generally no fine-grained permission control for password operations, and no distinction is made between users. In this embodiment, it is necessary to isolate internal resources to achieve isolation of multiple services and multiple users. Since resource isolation is achieved between users and services, user security can be guaranteed; user services should have independent identifiers to distinguish users and services. In this embodiment, if Figure 3 As shown, the quantum fusion cryptographic card is virtualized into multiple virtual cryptographic cards, and the multiple virtual cryptographic cards correspond one-to-one to multiple user virtual machines of the upper-layer application. Each of the virtual cryptographic cards includes a virtual master control chip and a virtual cryptographic chip. In other words, user and business isolation is achieved through cryptographic card hardware virtualization, and it is based on SR-IOV technology to directly access the cryptographic card through the hardware I / O channel (DMA) in the virtual machine. Using SR-IOV technology, a physical quantum fusion cryptographic card can be virtualized into multiple virtual cryptographic cards and allocated to multiple users. Each user has an independent key storage space and I / O channel, which can achieve secure key isolation. As Figure 3 As shown in the figure, the quantum fusion cryptographic card is registered as a device on the host in the form of SR-IOV virtualization. On the host, SR-IOV technology allows the hardware resources on the PCI Express (PCIe) device to be partitioned into one or more virtual interfaces, called virtual functions (VFs). One of the VFs can be used for key import and key management related operations. This interface also serves as a quantum key interface. With the help of the host driver to connect the quantum device, quantum keys can be imported; the other VF can be used for cryptographic operations. In this way, the cryptographic card can separate external keys and traffic. Inside the cryptographic card, the cryptographic chip is still registered in the embedded operating system in the form of SR-IOV virtualization, and the isolation of cryptographic resources is realized at the bottom layer.

[0034] For the above-mentioned quantum fusion cryptographic card, each virtual cryptographic card is allocated to the user virtual machine in a PCIE direct pass-through manner, and a driver is deployed in the virtual machine to implement the cloud platform business scenario of the corresponding cryptographic application function. Step 201 specifically includes: the virtual main control chip receives the cryptographic service request sent by the corresponding user virtual machine, and converts the cryptographic service request into a cryptographic operation instruction and transmits it to the virtual cryptographic chip belonging to the same virtual cryptographic card, wherein the virtual cryptographic chip executes the cryptographic operation instruction and feeds back the execution result to the virtual main control chip. Step 202 specifically includes: the virtual main control chip responds to the cryptographic service request to the corresponding user virtual machine according to the execution result. By using the real-time operating system carried by the main control chip, the quantum fusion cryptographic card of this embodiment can achieve internal resource isolation and multi-service multi-user isolation. Due to the enhanced general computing capability, it has the ability to provide customized interfaces for applications. The customized interface can be implemented through firmware upgrades, and the upgrade difficulty of some firmware can be simplified by grading and classifying the firmware of the device. Through fine-grained permission control of the embedded operating system, distributed system scenarios are supported.

[0035] In addition, this embodiment can also implement operation set comparison management, divide the security policy execution code and the security policy decision code into two components, and provide an enhanced security mechanism for the system. Specifically, the quantum fusion cryptographic card has an operation set comparison function and a policy security storage function, wherein the operation set includes at least one security policy, and at least one security policy is securely stored via the policy security storage function, and the cryptographic service request includes an execution policy query request. In this business scenario, the virtual master chip receives the cryptographic service request sent by the corresponding user virtual machine, specifically including: the virtual master chip receives the execution policy query request sent by the corresponding user virtual machine, wherein the execution policy query request carries execution policy information. The virtual master chip compares the carried execution policy with at least one stored security policy, obtains decision information for allowing or prohibiting the execution of the policy, and feeds back the decision information for allowing or prohibiting the execution of the execution policy to the corresponding user virtual machine.

[0036] That is to say, the quantum fusion cryptographic card of this embodiment has operation set comparison management, which divides the security policy execution code and the security policy decision code into two components, providing the system with an enhanced security mechanism: Mandatory Access Control (MAC). The characteristic of the MAC mechanism is that the owner of the resource cannot decide who can access the resource, but the security policy specifically determines whether the resource can be accessed. The security policy is composed of a series of access rules, and only users with specific permissions have the authority to operate the security policy. All system calls executed by user programs must be checked according to the security policy. If the security policy allows the operation, continue; otherwise, an error message will be thrown to the application, such as Figure 4 shown.

[0037] In another business scenario, the quantum fusion cryptographic card provides the application with an identity authentication service based on the PQC algorithm. Specifically, the main control chip implements the PQC algorithm to digitally sign / verify the authentication message, and the cryptographic chip provides QRNG and random numbers generated by RNG for this purpose. Among them, the random number can be obtained by the XOR of the results generated by QRNG (quantum random number generator) and RNG (such as the classic white noise-based random number generator). After completing the authentication, QKD performs quantum key distribution and directly transmits the quantum key encryption to the quantum fusion cryptographic card, which is then stored in the key memory by the cryptographic chip. In addition, in the subsequent transmission process, the quantum key is used to symmetrically encrypt the data that needs to be transmitted securely to achieve secure data transmission, such as Figure 5 In this application scenario, the cryptographic service request includes a data encryption and decryption request. The implementation steps of the main control chip receiving the cryptographic service request from the upper layer application are as follows: Figure 6 As shown:

[0038] In step 601, the main control chip receives a data encryption and decryption request from an upper layer application, wherein the data encryption and decryption request carries data that needs to be securely transmitted.

[0039] In step 602, the main control chip performs identity authentication on the upper layer application based on the PQC algorithm. In one example, the main control chip digitally signs the authentication message using the PQC algorithm. The random number used to generate the quantum key required for the digital signature includes the quantum random number provided by the QRNG and / or the random number generated by the RNG provided by the cryptographic chip.

[0040] In step 603, after the identity authentication is passed, the main control chip obtains the quantum key from the quantum key distribution network and transmits it to the cryptographic chip.

[0041] In step 604, the main control chip performs one-time one-key data transmission by calling the cryptographic chip. Specifically, the main control chip converts the data encryption and decryption request into a cryptographic operation instruction and transmits it to the cryptographic chip, wherein the cryptographic operation instruction instructs to digitally sign and / or symmetrically encrypt the data to be securely transmitted. Under the protection of the quantum key, one-time one-key data transmission is realized.

[0042] In other words, the quantum fusion cryptographic card, through its embedded operating system, combines the specific cryptographic operations and key operations of symmetric algorithms, asymmetric algorithms, and hash algorithms, converts the cryptographic service requests of upper-level applications into specific basic cryptographic operation requests, and encrypts and digitally signs the transmitted information by calling the cryptographic chip, ensuring the confidentiality, authenticity, integrity, and non-repudiation of information transmission.

[0043] The following uses file encryption as an example to compare the traditional implementation process and the implementation process of this embodiment:

[0044] In the traditional process, the confidentiality of the file content is ensured through the following steps: a) obtain the symmetric algorithm and asymmetric algorithm identifier; b) call the general cryptographic service to generate a symmetric key; c) call the symmetric encryption service to use the symmetric key to encrypt the file content; d) call the asymmetric encryption service to use the electronic file recipient or application system to encrypt the symmetric key using the public key; e) encapsulate the encrypted symmetric key and the file content encrypted by the symmetric key in a digital envelope format to form the encrypted file content; f) store the algorithm identifier, algorithm mode, and feedback bit number in the security attribute. In the traditional process, the integrity and non-repudiation of the file content are ensured through the following steps: a) obtain the signature algorithm and hash algorithm identifier; b) call the hash algorithm service to calculate the summary of the plain text of the file content; c) use the signature private key of the business operator or application system to digitally sign the summary value; d) fill the signature value, algorithm identifier, and signature certificate into the security attribute in sequence.

[0045] In this embodiment, quantum key distribution is used to replace the digital envelope, and a real-time operating system is used in the main control chip to complete the combination of the above operations, so that the application can complete the above-mentioned entire process through a single call, which facilitates the promotion of cryptographic applications.

[0046] Specifically, if Figure 7 As shown, after receiving the data encryption and decryption request from the upper-layer application, the main control chip calls the cryptographic chip to perform a summary operation on the data that needs to be securely transmitted and is carried in the data encryption and decryption request, that is, to calculate the summary of the plaintext file content. Then, the cryptographic chip is called to digitally sign the summary value using the signature private key of the business operator or application system, and the main control chip splices the signed information with the plaintext information (that is, the data that needs to be securely transmitted) to obtain the spliced ​​information. The main control chip transmits the quantum key obtained from the quantum key distribution network to the cryptographic chip, which uses the quantum key as a symmetric key to symmetrically encrypt the spliced ​​information, obtain the ciphertext information and transmit it to the receiving end. The inverse operation of the sending end is performed on the receiving end, where the symmetric key required for decryption is the quantum key distributed by the quantum key distribution network. By Figure 7 The file encryption process shown converts the cryptographic service request of the upper-layer application into a specific basic cryptographic operation request. The transmitted information is encrypted and digitally signed, ensuring the confidentiality, authenticity, integrity and non-repudiation of the quantum security level of the transmitted information.

[0047] In another business scenario of a distributed storage system, a cryptographic service request includes a data access request for the distributed storage system. Figure 8As shown, the quantum fusion cryptographic card is divided into master-slave mode, and the key synchronization between devices is realized by deploying the driver on the host machine. In addition, the driver needs to be deployed on the client to realize the function, and the client driver is responsible for file sharding. The client driver first accesses the metadata of the monitoring device (monitor), and then accesses the osd (object storage device) to access the data. The quantum fusion cryptographic card at the monitoring device is the first quantum fusion cryptographic card in the master mode, which undertakes the key management function. The monitoring device stores the metadata of the slices, and the mapping relationship will be recorded in the monitoring device. The first quantum fusion cryptographic card in the master mode stores all the keys and the corresponding table of the keys and osd. Osd stores data, and the quantum fusion cryptographic card at Osd is the second quantum fusion cryptographic card in the slave mode, which is used to store the keys of the Osd to which it belongs. The keys of each Osd are issued by the first quantum fusion cryptographic card at the monitoring device.

[0048] That is to say, when the quantum fusion cryptographic card is the first quantum fusion cryptographic card in the master mode, the quantum key for accessing data is sent to the second quantum fusion cryptographic card in the slave mode; when the quantum fusion cryptographic card is the second quantum fusion cryptographic card in the slave mode, the quantum key for accessing data is received from the first quantum fusion cryptographic card in the master mode.

[0049] In one example, the quantum fusion cryptographic card supports secure mutual control with the card, and interacts with each other's status, key and other information in a secure mutual control manner. The quantum fusion cryptographic card supports master-slave mode. During secure mutual control, the master cryptographic card (i.e., the first quantum fusion cryptographic card in master mode) can be selected manually or according to the policy to assume part of the key management function and manage the second quantum fusion cryptographic card in slave mode. The master cryptographic card can issue keys to the slave cryptographic card and control the key status and monitor the usage through the secure mutual control function, thereby realizing secure collaboration between multiple points through key protection. In other words, there is secure mutual control between the first quantum fusion cryptographic card and the second quantum fusion cryptographic card, and the mutual control parameters of the secure mutual control include status information, user information and key information. The first quantum fusion cryptographic card supports the encrypted issuance of control instructions and security policies, where the control instructions include cryptographic operation instructions.

[0050] In addition, since the quantum fusion cryptographic card itself does not have data communication function, the quantum fusion cryptographic card communication between devices can be realized by the host driver calling the network card to assist in forwarding traffic, and the driver acts as a relay, such as Fig. 9 The quantum key transmission process from the quantum key distribution device to the quantum fusion cryptographic card is also protected by cryptographic technology, such as using the SM4 algorithm for confidentiality protection and the SM3 algorithm for integrity protection.

[0051] In this embodiment, through the cryptographic service provided by the quantum fusion cryptographic card, functions such as device identity authentication and operation set comparison management can be realized. The preset strategy of quantum key migration from QKD to quantum fusion cryptographic card can trigger operations such as IO locking, policy issuance and update, data and important parameter protection, protocol protection, key process startup, and basic cryptographic operations. Moreover, by virtualizing the quantum fusion cryptographic card into multiple virtual cryptographic cards, corresponding one-to-one with multiple user virtual machines, user and / or business isolation can be achieved to achieve fine-grained permission control.

[0052] The steps of the above method are divided only for the purpose of clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this patent.

[0053] Those skilled in the art will appreciate that the above-mentioned embodiments are specific examples for implementing the present invention, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present invention.

Claims

1. A quantum fusion cryptographic card, characterized in that: include: The first PCI-E interface; A main control chip carrying a real-time operating system, wherein the main control chip obtains a quantum key from a quantum key distribution network through a quantum key interface, receives and responds to a cryptographic service request carrying execution policy information from an upper-layer application through a cryptographic service interface, the cryptographic service interface is a second PCI-E interface, and the cryptographic service request includes an execution policy query request; A cryptographic chip connected to the main control chip via the first PCI-E interface, wherein the cryptographic chip obtains a quantum key from the main control chip to perform cryptographic calculations and / or key operations; Among them, the quantum fusion cryptographic card has an operation set comparison function and a policy security storage function. The operation set includes at least one security policy. The at least one security policy is securely stored by the cryptographic chip through the policy security storage function. The main control chip makes a decision on the execution strategy based on the at least one security policy stored in the cryptographic chip.

2. The quantum fusion cryptographic card according to claim 1, characterized in that: Also includes: A synchronous dynamic random access memory SDRAM connected to the main control chip, wherein the SDRAM provides dynamic data storage for the main control chip; An embedded multimedia card eMMC connected to the main control chip, wherein the eMMC provides persistent storage of data for the main control chip; A quantum random number chip connected to the main control chip, wherein the quantum random number chip generates quantum random numbers and provides the quantum random numbers to the main control chip; A USB authentication interface connected to the main control chip, wherein the USB authentication interface provides a channel for the main control chip to authenticate the identity of the device, and the device includes an intelligent password key.

3. The quantum fusion cryptographic card according to claim 1, characterized in that: Also includes: An algorithm chip connected to the cryptographic chip, wherein the algorithm chip provides a cryptographic algorithm for performing cryptographic operations and the key operation preset; A random number generator connected to the cryptographic chip, wherein the random number generator generates a random number and provides the random number to the cryptographic chip; A key memory connected to the cryptographic chip, wherein the key memory stores the quantum key.

4. A data processing method, applied to the quantum fusion cryptographic card as claimed in any one of claims 1 to 3, characterized in that: The method comprises: The main control chip receives the cryptographic service request from the upper layer application, and converts the cryptographic service request into a cryptographic operation instruction and transmits it to the cryptographic chip, wherein the cryptographic chip executes the cryptographic operation instruction and feeds back the execution result to the main control chip; The main control chip responds to the cryptographic service request according to the execution result.

5. The data processing method according to claim 4, characterized in that: The quantum fusion cryptographic card is virtualized into multiple virtual cryptographic cards, and the multiple virtual cryptographic cards correspond one-to-one to multiple user virtual machines of the upper-layer application. Each of the virtual cryptographic cards includes a virtual main control chip and a virtual cryptographic chip. The main control chip receives the cryptographic service request of the upper-layer application, and converts the cryptographic service request into a cryptographic operation instruction and transmits it to the cryptographic chip, including: The virtual main control chip receives the cryptographic service request sent by the corresponding user virtual machine, and converts the cryptographic service request into a cryptographic operation instruction and transmits it to the virtual cryptographic chip belonging to the same virtual cryptographic card, wherein the virtual cryptographic chip executes the cryptographic operation instruction and feeds back the execution result to the virtual main control chip.

6. The data processing method according to claim 5, characterized in that: The virtual main control chip receives a cryptographic service request sent by a corresponding user virtual machine, including: The virtual master control chip receives the execution policy query request sent by the corresponding user virtual machine; The virtual master control chip compares the execution policy with the at least one security policy to obtain decision information of allowing or prohibiting the execution policy; The virtual master control chip feeds back decision information of allowing or prohibiting execution of the execution policy to the user virtual machine.

7. The data processing method according to claim 4, wherein the cryptographic service request comprises a data encryption and decryption request, characterized in that: The main control chip receives a cryptographic service request from an upper layer application, including: The main control chip receives a data encryption and decryption request from an upper layer application, wherein the data encryption and decryption request carries data that needs to be securely transmitted; The main control chip provides identity authentication services for the upper-layer application, and after the identity authentication is passed, the main control chip converts the data encryption and decryption request into a cryptographic operation instruction and transmits it to the cryptographic chip. The main control chip obtains the quantum key from the quantum key distribution network and transmits it to the cryptographic chip, wherein the cryptographic operation instruction instructs the data that needs to be securely transmitted to be digitally signed and / or symmetrically encrypted, and the digital signature includes a digital signature based on the post-quantum cryptography algorithm PQC.

8. The data processing method according to claim 4, wherein the cryptographic service request comprises a data access request of a distributed storage system, characterized in that: Also includes: When the quantum fusion cryptographic card is a first quantum fusion cryptographic card in a master mode, a quantum key for accessing data is issued to a second quantum fusion cryptographic card in a slave mode; When the quantum fusion cryptographic card is a second quantum fusion cryptographic card in a slave mode, it receives a quantum key for accessing data from a first quantum fusion cryptographic card in a master mode.

9. The data processing method according to claim 8, characterized in that: Also includes: There is a secure mutual control between the first quantum fusion cryptographic card and the second quantum fusion cryptographic card, and the mutual control parameters of the secure mutual control include state information, user information and key information; The first quantum fusion cryptographic card supports encrypted issuance of control instructions and security policies, wherein the control instructions include the cryptographic operation instructions and / or key operation instructions.

10. The data processing method according to claim 5, characterized in that: The main control chip responds to the cryptographic service request according to the execution result, including: The virtual master control chip responds to the cryptographic service request to the corresponding user virtual machine according to the execution result.

Images