Virtual cloud desktop identity authentication quantum security enhancement method

Abstract

The invention relates to the technical field of cloud desktops, in particular to a virtual cloud desktop identity authentication quantum security enhancement method, which comprises the following steps of: connecting a USB key containing key information with a client to obtain the key information; entering a virtual cloud desktop system client through a cloud desktop server pre-installed on the client, and sending a login application and communication data to a cloud center through a security isolation area; the cloud center generates identity verification request information according to the login application and the communication data, and sends the identity verification request information to the client through the security isolation region; the client verifies the identity verification request information according to the key information, generates verification information according to the identity verification request information and the key information, and sends the verification information to the cloud center through the security isolation region; and the cloud center verifies the verification information according to the authentication certificate public key, and logs in the virtual cloud desktop system client according to the user account and the initial password so as to solve the problem of insufficient security in virtual cloud desktop identity authentication.

Description

Technical Field

[0001] The present application relates to the field of cloud desktop technology, and in particular to a method for enhancing quantum security of virtual cloud desktop identity authentication. Background Art

[0002] With the rapid development of cloud computing technology, enterprises and individuals have enjoyed the convenience and efficiency brought by cloud services. Low-cost cloud services have brought great convenience to corporate business and office work. Among them, virtual cloud desktops are one of the most common application methods in corporate office work, allowing employees to log in to the company's virtual cloud desktop server at any place and time to meet office needs anytime and anywhere.

[0003] By transforming the terminal host into a virtual cloud desktop, the user's operating system is concentrated on the server host of the cloud computing center, thereby achieving efficient use of hardware infrastructure resources. However, with the widespread application of virtual cloud desktops, the internal network of enterprises faces new security challenges. Users connect to their virtual cloud desktops through the network on thin clients, similar to using a physical host to perform various network operations. In the cloud computing center, users register and authenticate with the cloud computing center through thin clients to enter their cloud desktops. The cloud desktops of multiple users share network and virtual switch resources. Usually, data transmission is carried out in plain text, which brings huge risks to the data and information security of enterprises. Therefore, it is necessary to ensure the security of data transmission and identity authentication between the user's virtual cloud desktop and the application server. Summary of the invention

[0004] The present application provides a quantum security enhancement method for virtual cloud desktop identity authentication to solve the problem of insufficient security in virtual cloud desktop identity authentication.

[0005] The present application provides a method for enhancing quantum security of virtual cloud desktop identity authentication, which is applied to a virtual cloud desktop system based on quantum security, wherein the system includes a cloud center, a secure isolation zone, a quantum key terminal, and a client; the secure isolation zone is respectively connected to the cloud center, the quantum key terminal, and the client in communication; the method includes: Connecting the USB shield containing key information to the client so that the client obtains the key information; the key information includes the user account, initial password, authentication certificate, authentication certificate private key, authentication service module public key and quantum key; Entering the virtual cloud desktop system client through the cloud desktop server pre-installed on the client, and sending a login application and communication data to the cloud center through the secure isolation area; the communication data includes: user name, SSL protocol version number, encryption algorithm and key exchange strategy; The cloud center generates identity authentication request information according to the login application and the communication data, and sends it to the client through the security isolation area; the identity authentication request information includes a client authentication certificate request, a cloud desktop feature value and a random number; The client verifies the identity authentication request information according to the key information to verify the authenticity of the cloud center; The client also generates verification information according to the identity authentication request information and the key information, and sends the verification information to the cloud center through the secure isolation area; The cloud center verifies the verification information according to the public key of the authentication certificate to verify the authenticity of the client; Log in to the virtual cloud desktop system client according to the user account and the initial password to complete user identity authentication.

[0006] This application uses quantum keys to enhance the establishment of SSL session channels, which can provide unconditionally secure information protection and improve the security of SSL session channels; and through the two-factor authentication formed by combining the first element and the second element, it provides quantum security technology support capabilities from the perspectives of cloud desktop identity authentication and information security protection, solving the problem of insufficient security in current virtual cloud desktop identity authentication.

[0007] Optionally, after the cloud center verifies the verification information according to the public key of the authentication certificate, the method further includes: The cloud center negotiates the quantum key of the cloud center according to the communication data to generate a session key and a cloud center MAC value; The cloud center sends the cloud center MAC value to the client; The client negotiates the quantum key of the client according to the communication data to generate a session key and a client MAC value; The client sends the client MAC value to the cloud center.

[0008] The session key generated by the cloud center and the client through quantum key negotiation has higher security. By exchanging MAC values ​​with each other, the identity of the other party can be confirmed to prevent security threats such as man-in-the-middle attacks, thereby enhancing the security of the system and protecting the confidentiality of sensitive data.

[0009] Optionally, before connecting the USB shield containing the key information to the client, the method further includes: The quantum key terminal sends a registration request to the cloud center through the secure isolation area to apply for permission to use the virtual cloud desktop; After verifying the legitimacy of the quantum key terminal, the cloud center generates key information according to the registration request and sends it to the quantum key terminal through the secure isolation area; The quantum key terminal downloads the key information to the U shield.

[0010] Communicating through the secure isolation zone can ensure that the registration request and key information transmission process are protected from external attacks and eavesdropping. At the same time, the cloud center verifies the legitimacy of the quantum key terminal to further ensure the security of the system. In addition, downloading the key information to the U shield can also increase the security and confidentiality of the key information.

[0011] Optionally, the quantum key terminal downloads the key information to the USB shield by offline charging.

[0012] The offline charging method can ensure the security and integrity of the key information when the network environment is untrustworthy or cannot be guaranteed to be secure.

[0013] Optionally, the method further includes: When the authentication certificate expires or the quantum key is consumed, the quantum key terminal sends a certificate update request or a key injection request to the cloud center through the secure isolation area to request an authentication certificate update or a key injection.

[0014] The quantum key terminal can immediately send a request to the cloud center through the secure isolation area when the authentication certificate expires or the quantum key is consumed. This can not only achieve real-time update and recharge, but also avoid service interruption caused by certificate expiration or key exhaustion, so as to ensure the continuity and stability of the system.

[0015] Optionally, the cloud center includes a business module, a quantum security module, and an authentication service module; After the cloud center verifies the legitimacy of the quantum key terminal, the step of generating key information according to the registration request includes: The business module verifies the legitimacy of the quantum key terminal according to the registration request; When the legitimacy verification of the quantum key terminal is passed, the quantum security module issues the quantum key, the authentication certificate private key and the authentication service module public key; The authentication service module issues a user account, an initial password and an authentication certificate.

[0016] The business module verifies the legitimacy of the quantum key terminal to ensure that only authorized terminals can access the system, effectively preventing illegal access and attacks. The quantum key, authentication certificate private key, authentication service module public key, user account, initial password and authentication certificate issued all use encryption technology to ensure the security of information and effectively protect the data security of the system.

[0017] Optionally, the step of the cloud center generating identity authentication request information according to the login application and the communication data includes: The authentication service module selects a suitable encryption method according to the login application and communication data to determine the encryption capability of the client; When the encryption capability of the client is judged to be qualified, the business module sends a virtual cloud desktop feature value corresponding to the user name; the quantum security module sends a random number; and the authentication service module generates a client authentication certificate request; Authentication request information is generated according to the client authentication certificate request, the virtual cloud desktop characteristic value and the random number.

[0018] The authentication service module determines the encryption capability of the client by selecting a suitable encryption method, ensuring that only the client with sufficient encryption capability can access the system, effectively preventing illegal access and attacks. After the encryption capability of the client is determined to be qualified, the identity authentication request information generated according to the client authentication certificate request, the virtual cloud desktop feature value and the random number has high security, further protecting the data security of the system.

[0019] Optionally, the step of the client further generating verification information according to the identity authentication request information and the key information includes: The client encrypts the authentication certificate based on the quantum key to generate an encryption certificate; Encrypting the random number and the cloud desktop feature value by using the authentication service module public key; The encryption certificate, the encrypted random number and the cloud desktop characteristic value are combined into the verification information.

[0020] By using quantum keys to encrypt authentication certificates, the security of authentication certificates during transmission and storage can be ensured. The public key of the authentication module is used to encrypt random numbers and cloud desktop feature values ​​to further enhance the security of these sensitive information. This double encryption mechanism effectively prevents data leakage and tampering.

[0021] It can be seen from the above technical solution that the present application provides a method for quantum security enhancement of virtual cloud desktop identity authentication, the method comprising: connecting a U shield containing key information to a client so that the client obtains the key information; the key information comprises a user account, an initial password, an authentication certificate, an authentication certificate private key, an authentication service module public key and a quantum key; entering the virtual cloud desktop system client through a cloud desktop server pre-installed on the client, and sending a login application and communication data to the cloud center through the security isolation area; the communication data comprises: a user name, an SSL protocol version number, an encryption algorithm and a key exchange strategy; the cloud center sends a key according to the login application. and the communication data to generate identity authentication request information, and send it to the client through the secure isolation area; the identity authentication request information includes a client authentication certificate request, a cloud desktop characteristic value and a random number; the client verifies the identity authentication request information according to the key information to verify the authenticity of the cloud center; the client also generates verification information according to the identity authentication request information and the key information, and sends the verification information to the cloud center through the secure isolation area; the cloud center verifies the verification information according to the authentication certificate public key to verify the authenticity of the client, thereby solving the problem of insufficient security in virtual cloud desktop identity authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0023] Figure 1 This is a schematic diagram of the structural connection of a quantum-secure virtual cloud desktop system according to an embodiment of the present application; Figure 2 This is a flow chart of the quantum security enhancement method for virtual cloud desktop identity authentication described in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The embodiments will be described in detail below, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementation methods described in the following embodiments do not represent all implementation methods consistent with the present application. They are only examples of systems and methods consistent with some aspects of the present application.

[0025] To solve the problem of insufficient security in virtual cloud desktop identity authentication, see Figure 1 and Figure 2An embodiment of the present application provides a quantum security enhancement method for virtual cloud desktop identity authentication, which is applied to a virtual cloud desktop system based on quantum security. The system includes a cloud center, a secure isolation zone, a quantum key terminal, and a client; the secure isolation zone is respectively connected to the cloud center, the quantum key terminal, and the client.

[0026] It should be understood that the client may be a thin client, which is a low-cost, centrally maintained computer terminal, usually used in a virtualized desktop environment. The cloud center is the core of the virtual cloud desktop system. The secure isolation zone is a system for securely isolating users and business data before authentication. Before the user completes device and identity authentication, he can only interact and authenticate with the cloud desktop server. Only after authentication can he access business and data through the secure isolation zone.

[0027] The virtual cloud desktop identity authentication includes three elements, the first element can be an initial password, the second element can be a quantum key and an authentication certificate, and the third element can be a feature. The present application forms a two-factor authentication by combining the first element and the second element, which can greatly improve the authentication strength.

[0028] The method comprises: S210: Connecting the USB shield containing key information to the client so that the client obtains the key information; the key information includes a user account, an initial password, an authentication certificate, an authentication certificate private key, an authentication service module public key, and a quantum key.

[0029] S220: Enter the virtual cloud desktop system client through the cloud desktop server pre-installed on the client, and send a login application and communication data to the cloud center through the security isolation area; the communication data includes: user name, SSL protocol version number, encryption algorithm and key exchange strategy.

[0030] S230: The cloud center generates identity authentication request information according to the login application and the communication data, and sends it to the client through the security isolation area; the identity authentication request information includes a client authentication certificate request, a cloud desktop feature value and a random number.

[0031] S240: The client verifies the identity authentication request information according to the key information to verify the authenticity of the cloud center.

[0032] S250: The client also generates verification information according to the identity authentication request information and the key information, and sends the verification information to the cloud center through the secure isolation area.

[0033] S260: The cloud center verifies the verification information according to the public key of the authentication certificate to verify the authenticity of the client.

[0034] S270: Log in to the virtual cloud desktop system client according to the user account and the initial password to complete user identity authentication.

[0035] It should be understood that a quantum security gateway is provided inside the secure isolation area. The quantum security gateway is a security device based on quantum key distribution technology, which is used to achieve unconditionally secure confidential communication.

[0036] The above-mentioned two-factor identity authentication based on quantum keys can not only provide unconditionally secure information protection and improve the security of SSL session channels by enhancing the establishment of SSL session channels through the use of quantum keys; it also provides quantum security technology support capabilities in cloud desktop identity authentication and information security protection through two-factor authentication formed by combining the first and second factors, thereby solving the problem of insufficient security in the current virtual cloud desktop identity authentication.

[0037] In some embodiments, after the cloud center verifies the verification information according to the authentication certificate public key, the method further includes: The cloud center negotiates the quantum key of the cloud center according to the communication data to generate a session key and a cloud center MAC value; The cloud center sends the cloud center MAC value to the client; The client negotiates the quantum key of the client according to the communication data to generate a session key and a client MAC value; The client sends the client MAC value to the cloud center.

[0038] It should be understood that since quantum keys are generated based on the principles of quantum mechanics and are difficult to crack or predict, session keys generated through quantum key negotiation have higher security. The MAC value is a message authentication code. The cloud center and the client can confirm each other's identity by exchanging MAC values, preventing security threats such as man-in-the-middle attacks, thereby enhancing the security of the system and protecting the confidentiality of sensitive data.

[0039] In some embodiments, before connecting the USB shield containing the key information to the client, the method further includes: The quantum key terminal sends a registration request to the cloud center through the secure isolation area to apply for permission to use the virtual cloud desktop.

[0040] After verifying the legitimacy of the quantum key terminal, the cloud center generates key information according to the registration request and sends it to the quantum key terminal through the secure isolation area.

[0041] The quantum key terminal downloads the key information to the U shield.

[0042] It should be understood that the quantum key terminal includes a quantum key charging terminal, a quantum key management system (KMS) and a quantum key distribution system (QKD); the quantum key management system is communicatively connected to the key charging terminal and the quantum key distribution system respectively, and the key charging terminal is communicatively connected to the U shield to complete the quantum security distribution of authentication certificates and keys, and realize the quantum encryption transmission of authentication certificates, keys and sensitive information through the quantum encryption channel to ensure the security of sensitive information.

[0043] Communicating through the secure isolation zone can ensure that the registration request and key information transmission process are protected from external attacks and eavesdropping. At the same time, the cloud center verifies the legitimacy of the quantum key terminal to further ensure the security of the system. In addition, downloading the key information to the U shield can also increase the security and confidentiality of the key information.

[0044] In some embodiments, the quantum key terminal downloads the key information to the USB shield by offline charging.

[0045] It should be understood that offline recharge refers to the process of downloading key information to the USB Key without relying on a network connection. Since the terminal device logged in by the user is random, the offline recharge method can ensure the security and integrity of the key information when the network environment is untrustworthy or cannot be guaranteed to be secure.

[0046] In some embodiments, the method further comprises: When the authentication certificate expires or the quantum key is consumed, the quantum key terminal sends a certificate update request or a key injection request to the cloud center through the secure isolation area to request an authentication certificate update or a key injection.

[0047] The quantum key terminal can immediately send a request to the cloud center through the secure isolation area when the authentication certificate expires or the quantum key is consumed. This can not only achieve real-time update and recharge, but also avoid service interruption caused by certificate expiration or key exhaustion, so as to ensure the continuity and stability of the system.

[0048] In some embodiments, the cloud center includes a business module, a quantum security module, and an authentication service module; After the cloud center verifies the legitimacy of the quantum key terminal, the step of generating key information according to the registration request includes: The business module verifies the legitimacy of the quantum key terminal according to the registration request; When the legitimacy verification of the quantum key terminal is passed, the quantum security module issues the quantum key, the authentication certificate private key and the authentication service module public key; The authentication service module issues a user account, an initial password and an authentication certificate.

[0049] It should be understood that the business module includes an application server and a data server for providing specific business services. The quantum security module includes a quantum key distribution system (QKD), a quantum key management system (KMS) and a quantum key center system; the quantum key management system is respectively connected to the quantum key distribution system and the quantum key center system, and the quantum key center system is connected to the secure isolation area to realize quantum encryption transmission of the authentication certificate and distribution of quantum keys in the establishment of the system authentication channel.

[0050] The business module verifies the legitimacy of the quantum key terminal to ensure that only authorized terminals can access the system, effectively preventing illegal access and attacks. The quantum key, authentication certificate private key, authentication service module public key, user account, initial password and authentication certificate issued all use encryption technology to ensure the security of information and effectively protect the data security of the system.

[0051] In some embodiments, the step of the cloud center generating identity authentication request information according to the login application and the communication data includes: The authentication service module selects a suitable encryption method according to the login application and communication data to determine the encryption capability of the client; When the encryption capability of the client is judged to be qualified, the business module sends a virtual cloud desktop feature value corresponding to the user name; the quantum security module sends a random number; and the authentication service module generates a client authentication certificate request; Authentication request information is generated according to the client authentication certificate request, the virtual cloud desktop characteristic value and the random number.

[0052] The authentication service module determines the encryption capability of the client by selecting a suitable encryption method, ensuring that only the client with sufficient encryption capability can access the system, effectively preventing illegal access and attacks. After the encryption capability of the client is determined to be qualified, the identity authentication request information generated according to the client authentication certificate request, the virtual cloud desktop feature value and the random number has high security, further protecting the data security of the system.

[0053] In some embodiments, the step of the client further generating verification information according to the identity authentication request information and the key information includes: The client encrypts the authentication certificate based on the quantum key to generate an encryption certificate; Encrypting the random number and the cloud desktop feature value by using the authentication service module public key; The encryption certificate, the encrypted random number and the cloud desktop characteristic value are combined into the verification information.

[0054] By using quantum keys to encrypt authentication certificates, the security of authentication certificates during transmission and storage can be ensured. The public key of the authentication module is used to encrypt random numbers and cloud desktop feature values ​​to further enhance the security of these sensitive information. This double encryption mechanism effectively prevents data leakage and tampering.

[0055] It can be seen from the above technical solution that the embodiment of the present application provides a method for quantum security enhancement of virtual cloud desktop identity authentication, the method comprising: connecting a U shield containing key information to a client so that the client obtains the key information; the key information includes a user account, an initial password, an authentication certificate, an authentication certificate private key, an authentication service module public key, and a quantum key; entering the virtual cloud desktop system client through a cloud desktop server pre-installed on the client, and sending a login application and communication data to the cloud center through the secure isolation area; the communication data includes: a user name, an SSL protocol version number, an encryption algorithm, and a key exchange strategy; the cloud center sends a key exchange strategy based on the login application. Please generate identity authentication request information with the communication data, and send it to the client through the security isolation area; the identity authentication request information includes a client authentication certificate request, a cloud desktop characteristic value and a random number; the client verifies the identity authentication request information according to the key information to verify the authenticity of the cloud center; the client also generates verification information based on the identity authentication request information and the key information, and sends the verification information to the cloud center through the security isolation area; the cloud center verifies the verification information according to the authentication certificate public key to verify the authenticity of the client, thereby solving the problem of insufficient security in virtual cloud desktop identity authentication.

[0056] Similar parts between the embodiments provided in this application can be referenced to each other. The specific implementation methods provided above are only a few examples under the general concept of this application and do not constitute a limitation on the protection scope of this application. For those skilled in the art, any other implementation methods expanded based on the scheme of this application without creative work belong to the protection scope of this application.

Claims

1. A quantum security enhancement method for virtual cloud desktop identity authentication, characterized in that: Applied to a virtual cloud desktop system based on quantum security, the system includes a cloud center, a secure isolation zone, a quantum key terminal, and a client; the secure isolation zone is respectively connected to the cloud center, the quantum key terminal, and the client in communication; the method includes: Connecting the USB shield containing key information to the client so that the client obtains the key information; the key information includes the user account, initial password, authentication certificate, authentication certificate private key, authentication service module public key and quantum key; Entering the virtual cloud desktop system client through the cloud desktop server pre-installed on the client, and sending a login application and communication data to the cloud center through the secure isolation area; the communication data includes: user name, SSL protocol version number, encryption algorithm and key exchange strategy; The cloud center generates identity authentication request information according to the login application and the communication data, and sends it to the client through the security isolation area; the identity authentication request information includes a client authentication certificate request, a cloud desktop feature value and a random number; The client verifies the identity authentication request information according to the key information to verify the authenticity of the cloud center; The client also generates verification information according to the identity authentication request information and the key information, and sends the verification information to the cloud center through the secure isolation area; The cloud center verifies the verification information according to the public key of the authentication certificate to verify the authenticity of the client; Log in to the virtual cloud desktop system client according to the user account and the initial password to complete user identity authentication.

2. The method for quantum security enhancement of virtual cloud desktop identity authentication according to claim 1 is characterized in that: After the cloud center verifies the verification information according to the public key of the authentication certificate, the method further includes: The cloud center negotiates the quantum key of the cloud center according to the communication data to generate a session key and a cloud center MAC value; The cloud center sends the cloud center MAC value to the client; The client negotiates the quantum key of the client according to the communication data to generate a session key and a client MAC value; The client sends the client MAC value to the cloud center.

3. The method for quantum security enhancement of virtual cloud desktop identity authentication according to claim 1 is characterized in that: Before connecting the USB shield containing the key information to the client, the method further includes: The quantum key terminal sends a registration request to the cloud center through the secure isolation area to apply for permission to use the virtual cloud desktop; After verifying the legitimacy of the quantum key terminal, the cloud center generates key information according to the registration request and sends it to the quantum key terminal through the secure isolation area; The quantum key terminal downloads the key information to the U shield.

4. The method for quantum security enhancement of virtual cloud desktop identity authentication according to claim 3 is characterized in that: The quantum key terminal downloads the key information to the USB shield by offline charging.

5. The method for quantum security enhancement of virtual cloud desktop identity authentication according to claim 3 is characterized in that: The method further comprises: When the authentication certificate expires or the quantum key is consumed, the quantum key terminal sends a certificate update request or a key injection request to the cloud center through the secure isolation area to request an authentication certificate update or a key injection.

6. The method for quantum security enhancement of virtual cloud desktop identity authentication according to claim 3 is characterized in that: The cloud center includes a business module, a quantum security module, and an authentication service module; After the cloud center verifies the legitimacy of the quantum key terminal, the step of generating key information according to the registration request includes: The business module verifies the legitimacy of the quantum key terminal according to the registration request; When the legitimacy verification of the quantum key terminal is passed, the quantum security module issues the quantum key, the authentication certificate private key and the authentication service module public key; The authentication service module issues a user account, an initial password and an authentication certificate.

7. The method for quantum security enhancement of virtual cloud desktop identity authentication according to claim 6 is characterized in that: The step of the cloud center generating identity authentication request information according to the login application and the communication data includes: The authentication service module selects a suitable encryption method according to the login application and communication data to determine the encryption capability of the client; When the encryption capability of the client is judged to be qualified, the business module sends a virtual cloud desktop feature value corresponding to the user name; the quantum security module sends a random number; and the authentication service module generates a client authentication certificate request; Authentication request information is generated according to the client authentication certificate request, the virtual cloud desktop characteristic value and the random number.

8. The method for quantum security enhancement of virtual cloud desktop identity authentication according to claim 1 is characterized in that: The step of the client further generating verification information according to the identity authentication request information and the key information includes: The client encrypts the authentication certificate based on the quantum key to generate an encryption certificate; Encrypting the random number and the cloud desktop feature value by using the authentication service module public key; The encryption certificate, the encrypted random number and the cloud desktop characteristic value are combined into the verification information.

Images