Cloud side end equipment firmware verification system and method based on quantum key, electronic equipment and readable medium

Abstract

The invention belongs to the technical field of cloud side end equipment firmware verification, and discloses a cloud side end equipment firmware verification system and method based on a quantum key, electronic equipment and a readable medium so as to guarantee deep security and integrity of firmware. The system comprises a quantum security service platform, a signature end and cloud side end equipment, the cloud side end device comprises a signature verification tool and a quantum security module. The method comprises the following steps: a quantum security service platform pre-charges a quantum key to a quantum security module; the signature tool reads the firmware of the cloud side end equipment and executes an SM3 algorithm to obtain a signature abstract; the signature tool obtains the quantum key and executes an SM2 algorithm on the signature abstract to obtain a signature result; the detection tool reads the to-be-verified cloud side end equipment firmware and executes an SM3 algorithm to obtain a verification abstract; and the quantum security module calls a corresponding quantum key and executes an SM2 algorithm to generate a corresponding public key to verify the signature verification abstract. According to the method and the device, deep verification of the firmware is realized, so that the firmware is effectively prevented from being tampered or maliciously injected.

Description

Technical Field

[0001] The present invention belongs to the technical field of cloud-edge device firmware verification, and specifically relates to a cloud-edge device firmware verification system and method based on quantum key, an electronic device, and a readable medium. Background Art

[0002] In the electric power cloud-edge system, ensuring the security and integrity of the cloud-edge device firmware and preventing malicious tampering are the key to maintaining the stable operation of the system. At present, the verification strategy for cloud-edge device firmware mainly relies on the anti-disassembly mechanism at the hardware level, such as placing the device firmware package inside the device and strengthening physical protection. However, at the software verification level, the existing methods appear to be relatively weak, and most of them remain at the simple comparison at the surface level. The defense capabilities against firmware tampering are limited, and it is difficult to provide solid verification and security guarantees. Especially in the key link of firmware integrity verification, the existing means mostly focus on the comparison of basic information such as version numbers. This method seems to be powerless in the face of complex security threats, and it is difficult to deeply guarantee the deep security and integrity of the firmware. Summary of the invention

[0003] Based on the above-mentioned shortcomings and deficiencies in the prior art, one of the objects of the present invention is to at least solve one or more of the above-mentioned problems in the prior art. In other words, one of the objects of the present invention is to provide a cloud-edge device firmware verification system and method based on quantum key that meets one or more of the aforementioned needs, so as to achieve in-depth verification of the firmware content, ensure the integrity and authenticity of the firmware during transmission, storage and execution, so as to effectively prevent the firmware from being tampered with or maliciously injected.

[0004] In order to achieve the above-mentioned object of the invention, the present invention adopts the following technical solutions:

[0005] In a first aspect, the present invention provides a cloud-edge device firmware verification system based on quantum keys, comprising a quantum security service platform, a signature end and a cloud-edge device that are linked to each other; the cloud-edge device comprises a signature verification tool and a quantum security module; the quantum security service platform is used to generate a quantum key and pre-charge it into the quantum security module, and is also used to approve the application of the signature end and send the quantum key to the signature end; the signature end is used to read the cloud-edge device firmware and execute the SM3 algorithm to obtain a signature summary, and is also used to apply for the quantum key from the quantum security service platform and sign the signature summary based on the quantum key to obtain a signature result and send it to the quantum security module; the signature verification tool is used to read the firmware of the cloud-edge device to be verified and execute the SM3 algorithm to obtain a signature verification summary and send it to the quantum security module; the quantum security module is used to receive the signature result and the signature verification summary, and is also used to call the quantum key corresponding to the signature verification summary to execute the SM2 algorithm to generate a corresponding public key to verify the signature verification summary, thereby completing the cloud-edge device firmware verification.

[0006] As a preferred solution, the cloud-edge device also includes a processor; the quantum security module is provided with an SPI interface and / or a USB interface and / or a UART interface to link with the processor.

[0007] As a preferred solution, the cloud-edge device also includes charging software; the quantum security module is linked to the quantum security service platform through the charging software.

[0008] As a preferred solution, the signature end is provided with a quantum private protocol; the signature end is linked to the quantum security service platform based on the quantum private protocol.

[0009] In the second aspect, the present invention provides a cloud-edge device firmware verification method based on quantum key, which is based on a cloud-edge device firmware verification system based on quantum key described in the first aspect, and includes the following steps: S1, a quantum security service platform pre-fills a quantum key into a quantum security module; S2, a signature tool reads the cloud-edge device firmware and executes an SM3 algorithm to obtain a signature summary; S3, the signature tool obtains the quantum key and based on this, executes an SM2 algorithm on the signature summary to obtain a signature result and sends it to the quantum security module; S4, a detection tool reads the cloud-edge device firmware to be verified and executes an SM3 algorithm to obtain a signature verification summary and sends it to the quantum security module; S5, the quantum security module calls the quantum key corresponding to the signature verification summary and executes the SM2 algorithm to generate a corresponding public key to verify the signature verification summary to obtain a verification result, thereby completing the cloud-edge device firmware verification.

[0010] As a preferred solution, step S5 also includes the following steps: the quantum security module sends the verification result to the cloud edge device; the cloud edge device starts the corresponding firmware based on the verification result, or does not start the corresponding firmware based on the verification result and marks it for maintenance.

[0011] As a preferred solution, in step S1, the quantum security service platform pre-injects quantum keys into the quantum security module, including the following steps: the quantum security module is connected to the cloud-edge device processor via an SPI interface and / or a USB interface and / or a UART interface; the quantum security module is connected to the quantum security service platform via injection software; the quantum security service platform injects a number of quantum keys into the quantum security module, and after successful injection, the quantum security module stores the quantum keys.

[0012] As a preferred solution, the signature tool in step S3 obtains the quantum key, including the following steps: the signature tool is linked to the quantum security service platform through a quantum private protocol; the signature tool sends a quantum key acquisition application to the quantum security service platform; the quantum security service platform approves the quantum key acquisition application, and sends the quantum key to the signature tool based on the quantum key acquisition application.

[0013] In a third aspect, the present invention provides an electronic device comprising a processor and a memory, wherein the processor is connected to the memory; the memory is used to store executable program code; the processor reads the executable program code stored in the memory to run a program corresponding to the executable program code, thereby executing the cloud-edge device firmware verification method based on quantum key as described in the second aspect.

[0014] In a fourth aspect, the present invention provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the cloud-edge device firmware verification method based on quantum key as described in the second aspect.

[0015] Compared with the prior art, the present invention has the following beneficial effects:

[0016] 1. Using the unbreakable and random nature of quantum keys, an extremely solid security barrier is built for the firmware signing process. The unique properties of quantum keys make any cracking attempts based on classical computing power almost impossible, thereby effectively preventing the risk of firmware being maliciously tampered with during transmission, storage or execution. This highly secure signature mechanism provides a solid foundation for the stable operation of the power cloud-edge system.

[0017] 2. A quantum security module with commercial secret qualification is used. The module integrates quantum key management technology, so that the storage and use of SM2 private keys are protected by quantum security. At the same time, the firmware is signed and verified in combination with the national secret algorithm (SM2 is used for signatures, and SM3 is used for hash calculations), achieving a perfect integration of hardware (quantum security module) and software (national secret algorithm). This integrated hardware and software protection solution combined with quantum keys greatly improves the security and integrity of the device firmware, and effectively avoids the risk of attacks on the cloud-edge devices of the power system due to firmware defects.

[0018] 3. Through a strict firmware verification process, the present invention can not only compare the basic information of the firmware, but also conduct in-depth verification at the level of the firmware content. This comprehensive verification mechanism effectively prevents system failures and safety hazards caused by firmware tampering or damage, thereby significantly improving the overall stability and reliability of the power cloud-edge system. The stable operation of the system not only ensures the continuity and reliability of power supply, but also reduces the economic losses and social impacts caused by system failures.

[0019] 4. It has strong adaptability and scalability, and can be applied to different types and specifications of power cloud edge devices. At the same time, with the continuous development of quantum computing technology and cryptography research, the solution of the present invention also has good upgrade and expansion capabilities, and can continue to provide users with efficient and secure services.

[0020] Further or more detailed beneficial effects will be described in detail in conjunction with specific examples in the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 It is a schematic diagram of an application scenario of the verification system and method described in an embodiment of the present invention.

[0023] Figure 2 It is a schematic diagram of the linking method of the quantum security module, cloud-edge device and processor described in an embodiment of the present invention.

[0024] Figure 3 It is a schematic diagram of the filling process of pre-filling quantum keys into a quantum security module based on the quantum security service platform in an embodiment of the present invention.

[0025] Figure 4It is a schematic diagram of the signature process based on the signature tool in an embodiment of the present invention.

[0026] Figure 5 It is a schematic diagram of the signature verification process based on the signature verification tool and the quantum security module in an embodiment of the present invention.

[0027] Figure 6 is a structural diagram of the electronic device provided in an embodiment of the present invention.

[0028] Figure Number:

[0029] 600. Electronic equipment;

[0030] 601, processor; 602, communication bus; 603, user interface; 604, network interface; 605, memory. DETAILED DESCRIPTION

[0031] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0032] In the following description, multiple embodiments of the present invention are provided, and different embodiments may be replaced or combined, so the present invention may also be considered to include all possible combinations of the same and / or different embodiments described. Therefore, if one embodiment includes features A, B, and C, and another embodiment includes features B and D, then the present invention should also be considered to include embodiments containing one or more of A, B, C, and D, all other possible combinations, even though the embodiment may not be clearly described in the following text.

[0033] The following description provides examples and does not limit the scope, applicability or examples set forth in the claims. Changes may be made to the functions and arrangements of the elements described without departing from the scope of the present invention. Various processes or components may be appropriately omitted, substituted or added to each example. For example, the described method may be performed in an order different from the described order, and various steps may be added, omitted or combined. In addition, the features described in some examples may be combined in other examples.

[0034] In order to facilitate a better understanding of the embodiments of the present invention, before explaining the specific implementation modes of the present invention in detail, its application scenarios are first described.

[0035] See also Figure 1 , Figure 1 A schematic diagram of the cloud-edge device firmware verification system and method in an application scenario is shown. Figure 1In the process, the firmware to be run on the cloud-edge device is signed by the SM2 signing tool deployed on the signing end (it should be noted that the signing end can be implemented by at least a smart phone, tablet computer, laptop computer, and desktop computer). During the signing process, the quantum key distributed by the quantum security service platform is used as the SM2 private key for signing; then the signature verification operation is completed on the cloud-edge device. The signature verification process also uses the quantum key distributed by the quantum security service platform as the SM2 private key to generate the corresponding public key, and then the public key is used to complete the signature verification operation. After the cloud-edge device passes the signature verification, the cloud-edge device business function can be run. Otherwise, if the signature verification fails, the cloud-edge device will not run.

[0036] The cloud-edge device firmware verification system and method described in the embodiments of this specification are applied to the cloud-edge device firmware detection process. In these scenarios, the application of the cloud-edge device firmware verification system and method is intended to ensure the integrity and security of the cloud-edge device firmware, thereby preventing the firmware from being tampered with or maliciously injected, protecting the device from the threat of unauthorized access and data leakage, and providing high-quality user experience and reliable performance.

[0037] The following is a brief explanation of the cloud-edge device, cloud-edge device firmware, quantum key, SM2 algorithm, and SM3 algorithm involved in multiple embodiments of this specification:

[0038] Cloud edge devices refer to those devices or systems located at the edge of the network (i.e. close to the data source) that have the ability to process, store, analyze and make preliminary decisions. As an extension of cloud computing services, they can quickly respond to and process data locally, while exchanging data and working collaboratively with the cloud as needed.

[0039] Cloud-edge device firmware refers to software programs installed on cloud-edge devices. These programs are the interface between the device hardware and the operating system, responsible for controlling the hardware functions of the device and ensuring that the device can operate as expected.

[0040] Quantum keys refer to keys generated using the principles of quantum mechanics, which are theoretically impossible to crack. Quantum key distribution (QKD) technology uses the uncertainty principle and the no-cloning theorem in quantum mechanics to ensure the security and confidentiality of keys during transmission. In the cloud-edge device firmware verification system, quantum keys are used as the private key of the SM2 algorithm to sign the firmware, thereby enhancing the security and credibility of the signature.

[0041] The SM2 algorithm is a public key cryptographic algorithm based on elliptic curve cryptography, issued by the China National Cryptography Administration. It is mainly used for security operations such as digital signatures, key exchange, encryption and decryption. In the cloud-edge device firmware verification system, the SM2 algorithm is used to sign and verify the firmware to ensure the integrity of the firmware and the credibility of the source. Using the quantum key as the private key of the SM2 algorithm further improves the security of the signing process.

[0042] The SM3 algorithm is a cryptographic hashing algorithm, also issued by the China National Cryptography Administration. It is mainly used to generate summary information of a message, that is, a hash value. In the cloud-edge device firmware verification system, the SM3 algorithm is used to hash the firmware and generate summary information of the firmware. During the signature verification process, the cloud-edge device will use the public key to verify the received signature, and recalculate the summary information of the firmware and compare it with the summary information in the signature to confirm whether the firmware has been tampered with. The high security and efficiency of the SM3 algorithm provide reliable technical support for the firmware verification process.

[0043] Embodiment 1:

[0044] The present embodiment provides a cloud-edge device firmware verification system based on quantum keys, including a quantum security service platform, a signature terminal and a cloud-edge device that are linked to each other; the cloud-edge device includes a signature verification tool and a quantum security module; the quantum security service platform is used to generate a quantum key and pre-charge it into the quantum security module, and is also used to approve the application of the signature terminal and send the quantum key to the signature terminal; the signature terminal is used to read the cloud-edge device firmware and execute the SM3 algorithm to obtain a signature summary, and is also used to apply for a quantum key from the quantum security service platform and sign the signature summary based on the quantum key to obtain a signature result and send it to the quantum security module; the signature verification tool is used to read the cloud-edge device firmware to be verified and execute the SM3 algorithm to obtain a signature verification summary and send it to the quantum security module; the quantum security module is used to receive the signature result and the signature verification summary, and is also used to call the quantum key corresponding to the signature verification summary to execute the SM2 algorithm to generate a corresponding public key to verify the signature verification summary, thereby completing the cloud-edge device firmware verification.

[0045] It can be understood that this embodiment integrates a quantum security module certified by the National Security Administration, injects a quantum key as the SM2 private key, uses the national security algorithm integrated inside the quantum security module, and uses the signature tool to perform SM3 calculation on the cloud-edge device firmware to obtain a hash value (signature summary), and then uses the quantum key as the SM2 private key to sign the hash to obtain the signature result. On the cloud-edge device, the SM3 algorithm is also used to calculate the hash value of the device firmware, and the quantum key is used as the SM2 private key to generate the corresponding public key, and then the public key is used to verify the signature. The signature is verified and the decision on whether the device firmware should continue to be used is made based on the verification result, which effectively improves the integrity and security of the cloud-edge device firmware as a whole.

[0046] Specifically, this embodiment provides a preferred implementation, wherein the cloud-edge device also includes a processor; the quantum security module is provided with an SPI interface and / or a USB interface and / or a UART interface to link with the processor.

[0047] More specifically, if Figure 2 As shown, this embodiment performs hardware transformation on the traditional cloud-edge device, adds a quantum security module, and links it to the control MCU (processor) through an SPI interface and / or a USB interface and / or a UART interface.

[0048] Specifically, this embodiment provides a preferred implementation, wherein the cloud-edge device also includes charging software; the quantum security module is linked to the quantum security service platform through the charging software.

[0049] More specifically, this embodiment provides Figure 3 As shown in the charging operation process, the quantum security module built into the cloud-edge device is connected to the quantum security service platform through the charging software to charge the quantum security key. After the charging is successful, the quantum key remains in the quantum security module.

[0050] Specifically, this embodiment provides a preferred implementation method, wherein the signature end is provided with a quantum private protocol; the signature end is linked to the quantum security service platform based on the quantum private protocol.

[0051] More specifically, Figure 4 As shown, the specific process of executing the signature operation based on the system of this embodiment is as follows: the signature tool connects to the quantum security service platform through a dedicated quantum private protocol to obtain the quantum key. After successful acquisition, it reads the cloud-edge device firmware, executes the SM3 algorithm on the device firmware, and obtains a 32-byte hash value (signature summary). Then the signature tool uses the quantum key as the SM2 private key to sign the hash value (signature summary), obtains the signature result, and burns the signature result into the quantum security module. Figure 5As shown, the specific process of executing signature verification based on the system of this embodiment is as follows: the compliance detection software (signature verification tool) is deployed inside the cloud edge device, and after it is started, it performs SM3 operation on the device firmware to be protected to obtain a 32-byte hash value (signature verification summary), which sends the hash value (signature verification summary) to the quantum security module, and the quantum security module reads the quantum key from its own internal, uses the quantum key as the SM2 private key to generate a public key, and performs a signature verification operation on the hash value (signature verification summary). The quantum security module returns the signature verification result to the compliance detection software (signature verification tool). If the signature verification is successful, the cloud edge device side will run the normal business program and start it; if the signature verification fails, the cloud edge device will not start the firmware and enter the manual maintenance state.

[0052] Embodiment 2:

[0053] The present embodiment provides a cloud-edge device firmware verification method based on quantum key, based on a cloud-edge device firmware verification system based on quantum key described in the first aspect, comprising the following steps: S1, a quantum security service platform pre-fills a quantum key into a quantum security module; S2, a signature tool reads the cloud-edge device firmware and executes the SM3 algorithm to obtain a signature summary; S3, a signature tool obtains the quantum key and executes the SM2 algorithm on the signature summary based on the quantum key to obtain a signature result and send it to the quantum security module; S4, a detection tool reads the cloud-edge device firmware to be verified and executes the SM3 algorithm to obtain a signature verification summary and send it to the quantum security module;

[0054] S5. The quantum security module calls the quantum key corresponding to the signature verification digest and executes the SM2 algorithm to generate the corresponding public key to verify the signature verification digest to obtain the verification result, thereby completing the firmware verification of the cloud-edge device.

[0055] Specifically, this embodiment provides a preferred implementation method, which includes the following steps after step S5: the quantum security module sends the verification result to the cloud edge device; the cloud edge device starts the corresponding firmware based on the verification result, or does not start the corresponding firmware based on the verification result and marks it for maintenance.

[0056] Specifically, this embodiment provides a preferred implementation of step S1, wherein the quantum security service platform pre-injects quantum keys into the quantum security module, including the steps of: the quantum security module is connected to the cloud-edge device processor via an SPI interface and / or a USB interface and / or a UART interface; the quantum security module is connected to the quantum security service platform via injection software; the quantum security service platform injects a number of quantum keys into the quantum security module, and after successful injection, the quantum security module stores the quantum keys.

[0057] Specifically, this embodiment provides a preferred implementation of step S3, wherein the signature tool obtains a quantum key, including the following steps: the signature tool is linked to the quantum security service platform through a quantum private protocol; the signature tool sends a quantum key acquisition application to the quantum security service platform; the quantum security service platform approves the quantum key acquisition application, and sends the quantum key to the signature tool based on the quantum key acquisition application.

[0058] It can be understood that this embodiment first performs hardware transformation on the traditional cloud-edge device and adds a quantum security module. After the transformation is completed, it connects to the quantum security service platform through the charging software to perform quantum key charging; then uses the signature end to connect to the quantum security service platform, applies for the quantum key online, calculates the hash value of the cloud-edge device firmware, and uses the quantum key as the SM2 private key to complete the signature of the hash value to obtain the signature result; imports the signature result into the quantum security module of the cloud-edge device, and then uses the charged quantum key as the private key to generate a public key, and uses the public key to verify the hash value. Only after the verification is passed can the power-related services be operated.

[0059] Embodiment three:

[0060] like Figure 6 As shown, this embodiment provides an electronic device, which may include: at least one processor, at least one network interface, a user interface, a memory, and at least one communication bus.

[0061] The communication bus can be used to realize the connection and communication among the above-mentioned components.

[0062] The user interface may include buttons, and the optional user interface may also include a standard wired interface or a wireless interface.

[0063] The network interface may include but is not limited to a Bluetooth module, an NFC module, a Wi-Fi module, etc.

[0064] Among them, the processor may include one or more processing cores. The processor uses various interfaces and lines to connect the various parts of the entire electronic device, and executes various functions of the electronic device and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory, and calling data stored in the memory. Optionally, the processor can be implemented in at least one hardware form of DSP, FPGA, and PLA. The processor can integrate one or a combination of CPU, GPU, modem, etc. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display; the modem is used to handle wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor, but may be implemented separately through a chip.

[0065] Among them, the memory may include RAM or ROM. Optionally, the memory includes a non-transient computer-readable medium. The memory can be used to store instructions, programs, codes, code sets or instruction sets. The memory may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above various method embodiments, etc. The memory may also be at least one storage device located away from the aforementioned processor. The memory as a computer storage medium may include an operating system, a network communication module, a user interface module and a verification application. The processor can be used to call the verification application stored in the memory and perform the verification steps mentioned in the aforementioned embodiments.

[0066] Embodiment 4:

[0067] This embodiment provides a computer-readable storage medium, which stores instructions. When the computer-readable storage medium is executed on a computer or a processor, the computer or the processor executes the above-mentioned Figure 3-Figure 5 One or more steps in the illustrated embodiment. If the components of the electronic device described above are implemented in the form of software functional units and sold or used as independent products, they can be stored in the computer-readable storage medium.

[0068] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of this specification is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0069] Those skilled in the art can understand that all or part of the process in the method of the above-mentioned embodiment 2 can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the process of the embodiments of the above-mentioned methods. The aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes. In the absence of conflict, the technical features in this embodiment and the implementation scheme can be combined arbitrarily.

[0070] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0071] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0072] The above is only an exemplary embodiment of the present disclosure, and the scope of the present disclosure cannot be limited thereto. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the specification and practicing the disclosure here, those skilled in the art will easily think of the implementation scheme of the present disclosure. The present invention is intended to cover any variation, use or adaptive change of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field not recorded in the present disclosure. The description and examples are regarded as exemplary only, and the scope and spirit of the present disclosure are defined by the claims.

Claims

1. A cloud-edge device firmware verification system based on quantum key, characterized by: Includes interconnected quantum security service platform, signature end and cloud-edge devices; The cloud-edge device includes a signature verification tool and a quantum security module; The quantum security service platform is used to generate quantum keys and pre-charge them into quantum security modules, and is also used to review and approve applications from signature terminals and send quantum keys to signature terminals; The signature end is used to read the cloud-edge device firmware and execute the SM3 algorithm to obtain a signature summary, and is also used to apply for a quantum key from the quantum security service platform and sign the signature summary based on the quantum key to obtain a signature result and send it to the quantum security module; The signature verification tool is used to read the firmware of the cloud-edge device to be verified and execute the SM3 algorithm to obtain the signature verification summary and send it to the quantum security module; The quantum security module is used to receive the signature result and the verification summary, and is also used to call the quantum key corresponding to the verification summary to execute the SM2 algorithm to generate a corresponding public key to verify the verification summary, thereby completing the cloud-edge device firmware verification.

2. According to claim 1, a cloud-edge device firmware verification system based on quantum key is characterized in that: The cloud edge device also includes a processor; The quantum security module is provided with an SPI interface and / or a USB interface and / or a UART interface to link with the processor.

3. According to claim 2, a cloud-edge device firmware verification system based on quantum key is characterized in that: The cloud-edge device also includes charging software; The quantum security module is linked to the quantum security service platform via charging software.

4. According to claim 3, a cloud-edge device firmware verification system based on quantum key is characterized in that: The signing end is provided with a quantum private protocol; The signing end is linked to the quantum security service platform based on a quantum private protocol.

5. A method for verifying cloud-edge device firmware based on quantum key, based on a cloud-edge device firmware verification system based on quantum key according to claim 4, characterized in that: Includes steps: S1. The quantum security service platform pre-injects quantum keys into the quantum security module; S2. The signature tool reads the cloud-edge device firmware and executes the SM3 algorithm to obtain the signature digest; S3, the signature tool obtains the quantum key and executes the SM2 algorithm on the signature summary based on it to obtain the signature result and send it to the quantum security module; S4. The detection tool reads the firmware of the cloud-edge device to be verified and executes the SM3 algorithm to obtain the verification summary and send it to the quantum security module; S5. The quantum security module calls the quantum key corresponding to the signature verification digest and executes the SM2 algorithm to generate the corresponding public key to verify the signature verification digest to obtain the verification result, thereby completing the firmware verification of the cloud-edge device.

6. According to a method for verifying cloud-edge device firmware based on quantum key according to claim 5, it is characterized in that: Step S5 is followed by the following steps: The quantum security module sends the verification results to the cloud-edge device; The cloud-edge device starts the corresponding firmware based on the verification results, or does not start the corresponding firmware based on the verification results and marks it for maintenance.

7. According to claim 5, a method for verifying cloud-edge device firmware based on quantum key is characterized in that: Step S1: The quantum security service platform pre-injects the quantum key into the quantum security module, including the following steps: The quantum security module is connected to the cloud-edge device processor via an SPI interface and / or a USB interface and / or a UART interface; The quantum security module is connected to the quantum security service platform through the charging software; The quantum security service platform injects a number of quantum keys into the quantum security module. After the injection is successful, the quantum security module stores the quantum keys.

8. According to a method for verifying cloud-edge device firmware based on quantum key according to claim 5, it is characterized in that: The signing tool in step S3 obtains the quantum key, including the following steps: The signature tool is linked to the quantum security service platform via a quantum private protocol; The signature tool sends a quantum key acquisition application to the quantum security service platform; The quantum security service platform examines and approves the application for obtaining the quantum key, and sends the quantum key to the signature tool according to the application for obtaining the quantum key.

9. A computer device, characterized in that: The computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the cloud-edge device firmware verification method based on quantum key is implemented as described in any one of claims 5 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the cloud-edge device firmware verification method based on quantum key as described in any one of claims 5 to 8.

Images