Encryption method and system for Ceph block storage based on quantum key

Abstract

The invention provides a quantum key-based Ceph block storage encryption method and system, and belongs to the technical field of storage. A cryptographic phrase management system is arranged to provide a quantum random number password-based data encryption correlation operation function for a Ceph RBD client, so that a quantum security technology is applied to Ceph encrypted storage, and the encryption efficiency of the Ceph block storage is improved. The long-term security of the stored data can be ensured; and the architecture that the Ceph RBD client and the cryptographic phrase management system are separately deployed is adopted, so that the control capability on the data leakage risk can be improved, and the maintenance cost can be reduced.

Description

Technical Field

[0001] The present application relates to the field of storage technology, and in particular to an encryption method and system for national secret Ceph block storage based on quantum key. Background Art

[0002] Ceph is a distributed storage system that is widely used in cloud environments, big data analysis, and various enterprise-level applications. It is often used to store large amounts of sensitive or long-term valuable data.

[0003] In related technologies, Ceph mainly uses traditional encryption algorithms such as RSA encryption algorithm or Elliptic Curve Cryptography (ECC) to encrypt and store data. With the rapid development of quantum computing technology, these traditional encryption algorithms face the risk of being cracked by quantum computers, making it difficult to ensure the security of data stored in Ceph. Summary of the invention

[0004] In view of the above problems, an embodiment of the present application provides an encryption method and system for national secret Ceph block storage based on quantum key, so as to overcome the above problems or at least partially solve the above problems.

[0005] In a first aspect of an embodiment of the present application, there is provided an encryption system for Ceph block storage based on quantum key, including a passphrase management system, a Ceph RBD client, and a Ceph cloud storage service client, wherein:

[0006] The Ceph RBD client is used to send an identity authentication request and an encryption request to the passphrase management system;

[0007] The pass phrase management system is used to obtain a quantum random number password when the Ceph RBD client passes the identity authentication associated with the encryption request, and create a data encryption key and a pass phrase according to the quantum random number password;

[0008] The pass phrase management system is further used to generate a key encapsulation key according to the pass phrase and a key derivation function corresponding to the pass phrase, and to generate a pass phrase identifier corresponding to the pass phrase;

[0009] The pass phrase management system is further configured to use the key encapsulation key to encrypt the data encryption key through a national secret algorithm to obtain a data encryption key ciphertext, and use the data encryption key to encrypt the write data corresponding to the encryption request through a national secret algorithm to obtain a data ciphertext;

[0010] The pass phrase management system is further used to use the data encryption key ciphertext, the key derivation function corresponding to the pass phrase and the pass phrase identifier as metadata corresponding to the data ciphertext, and send the data ciphertext and the metadata corresponding to the data ciphertext to the Ceph RBD client;

[0011] The Ceph RBD client is also used to perform data encapsulation processing and data striping processing on the data ciphertext and the metadata corresponding to the data ciphertext in sequence, and send the processed data to the Ceph cloud storage service client for storage.

[0012] Optionally, the Ceph RBD client is further used to read target encapsulated data from the Ceph cloud storage service client, and send an identity authentication request and a decryption request to the passphrase management system, wherein the target encapsulated data includes: target data ciphertext and target metadata corresponding to the target data ciphertext;

[0013] The pass phrase management system is further configured to receive the target encapsulated data sent by the Ceph RBD client when the Ceph RBD client passes the identity authentication associated with the decryption request;

[0014] The passphrase management system is further used to obtain the target metadata and the target data ciphertext from the target encapsulated data, and query the corresponding target passphrase according to the target passphrase identifier in the target metadata;

[0015] The pass phrase management system is further used to generate a target key encapsulation key according to the target pass phrase and the target key derivation function in the target metadata, and use the target key encapsulation key to decrypt the target data encryption key ciphertext in the target metadata through the national secret algorithm to obtain the target data encryption key;

[0016] The passphrase management system is also used to use the target data encryption key to decrypt the target data ciphertext through a national secret algorithm to obtain the target data, and return the target data to the Ceph RBD client.

[0017] Optionally, the Ceph RBD client is further used to send an identity authentication request and a read request to the Ceph cloud storage service client;

[0018] The Ceph cloud storage service client is used to return the identity authentication pass information associated with the read request and the target encapsulated data to the Ceph RBD client when the Ceph RBD client passes the identity authentication associated with the read request.

[0019] Optionally, the system further comprises: a quantum cryptography service platform, configured to distribute symmetric keys to the Ceph RBD client and the passphrase management system; wherein:

[0020] The Ceph RBD client is further configured to, before sending read-write related data to the passphrase management system so that the passphrase management system performs encryption and decryption processing on the read-write related data, send a system authentication request to the passphrase management system as an initiator of establishing a quantum secure channel;

[0021] The Ceph RBD client is further configured to, upon receiving the information indicating that the system authentication is passed returned by the passphrase management system, send a quantum key negotiation request to the passphrase management system, and generate a corresponding first symmetric key identifier according to the symmetric key distributed by the quantum cryptography service platform;

[0022] The pass phrase management system is further configured to generate a corresponding second symmetric key identifier according to the symmetric key upon receiving the quantum key negotiation request, and return the second symmetric key identifier to the CephRBD client;

[0023] The Ceph RBD client is further used to encrypt the read-write related data by using a national encryption algorithm according to the first symmetric key identifier, and send the second symmetric key identifier and the encrypted read-write related data to the passphrase management system;

[0024] The pass phrase management system is further configured to, upon receiving the second symmetric key identifier and the encrypted read-write related data, decrypt the encrypted read-write related data using a national secret algorithm according to the second symmetric key identifier to obtain the read-write related data;

[0025] The pass phrase management system is further used to, after encrypting and decrypting the read-write related data, use the encrypted and decrypted data as return data, encrypt the return data by using the national secret algorithm according to the second symmetric key identifier, and send the encrypted return data to the Ceph RBD client;

[0026] The Ceph RBD client is also used to decrypt the encrypted return data using a national encryption algorithm according to the first symmetric key identifier to obtain the return data.

[0027] Optionally, the quantum cryptography service platform is also used to perform routing calculations between subnets, and to collect availability data of quantum networks and cryptographic systems.

[0028] Optionally, the Ceph RBD client is further used to send an identity authentication request and a write request to the Ceph cloud storage service client;

[0029] The Ceph RBD client is further used to generate the write data upon receiving the identity authentication pass information associated with the write request returned by the Ceph cloud storage service client, and send the identity authentication request and the encryption request corresponding to the write data to the passphrase management system.

[0030] Optionally, the Ceph RBD client includes:

[0031] Ceph RBD client service, used to mount and use RBD devices, and to set and query metadata corresponding to data ciphertext;

[0032] A first quantum security service, configured to provide the Ceph RBD client service with a function of interacting with the first quantum cryptographic machine device in the form of an SDK toolkit;

[0033] The first quantum cryptographic machine device is used for quantum key management and quantum cryptographic operations.

[0034] Optionally, the passphrase management system comprises:

[0035] Passphrase management service, used to perform encryption and decryption processing of data, and to perform life cycle management of passphrases and keys associated with the encryption and decryption processing;

[0036] A second quantum security service, configured to provide the passphrase management service with a function of interacting with the second quantum cryptographic machine device in the form of an SDK toolkit;

[0037] The second quantum cryptographic machine is used for quantum key management and quantum cryptographic operations.

[0038] A second aspect of the embodiments of the present application provides an encryption method for Ceph block storage based on quantum key, which is applied to a passphrase management system, and the method includes:

[0039] Receive authentication requests and encryption requests sent by Ceph RBD clients;

[0040] When the Ceph RBD client passes the identity authentication associated with the encryption request, obtaining a quantum random number password, and creating a data encryption key and a passphrase according to the quantum random number password;

[0041] generating a key encapsulation key according to the passphrase and a key derivation function corresponding to the passphrase, and generating a passphrase identifier corresponding to the passphrase;

[0042] Using the key encapsulation key, encrypting the data encryption key through a national secret algorithm to obtain a data encryption key ciphertext, and using the data encryption key, encrypting the write data corresponding to the encryption request through a national secret algorithm to obtain a data ciphertext;

[0043] The data encryption key ciphertext, the key derivation function corresponding to the passphrase, and the passphrase identifier are used as metadata corresponding to the data ciphertext, and the data ciphertext and the metadata corresponding to the data ciphertext are sent to the Ceph RBD client, so that the Ceph RBD client performs data encapsulation processing and data striping processing on the data ciphertext and the metadata corresponding to the data ciphertext in sequence, and sends the processed data to the Ceph cloud storage service client for storage.

[0044] A third aspect of the embodiment of the present application provides an encryption method for Ceph block storage based on quantum key, which is applied to Ceph RBD client, and the method includes:

[0045] Sending an authentication request and an encryption request to a passphrase management system;

[0046] Upon receiving identity authentication passing information associated with the encryption request sent by the pass phrase management system, sending write data corresponding to the encryption request to the pass phrase management system;

[0047] Receiving a data ciphertext and metadata corresponding to the data ciphertext sent by the passphrase management system;

[0048] The data ciphertext and the metadata corresponding to the data ciphertext are sequentially encapsulated and striped, and the processed data is sent to the Ceph cloud storage service client for storage;

[0049] Among them, the data ciphertext is obtained by the passphrase management system using a data encryption key to encrypt the written data through a national secret algorithm; the metadata corresponding to the data ciphertext includes a data encryption key ciphertext, a key derivation function corresponding to the passphrase and a passphrase identifier, the data encryption key and the passphrase are created by the passphrase management system according to a quantum random number password, the data encryption key ciphertext is obtained by the passphrase management system using a key encapsulation key to encrypt the data encryption key through a national secret algorithm, and the key encapsulation key is generated by the passphrase management system according to the passphrase and the key derivation function corresponding to the passphrase.

[0050] The embodiments of the present application include the following advantages:

[0051] By setting up a passphrase management system, the Ceph RBD client is provided with data encryption related operation functions based on quantum random number cryptography, thereby applying quantum security technology to Ceph's encrypted storage, so that the data stored in Ceph can resist the risk of being cracked by quantum computers, thereby ensuring the long-term security of the stored data; and the Ceph RBD client and the passphrase management system are separately deployed. That is, the related operation functions based on quantum random number cryptography are independently encapsulated in the passphrase management system for implementation, which can avoid the complex business logic in the Ceph RBD client from introducing security vulnerabilities to the related operation functions, thereby increasing the control capability of data leakage risks, and when the related operation functions are adjusted or updated, there is no need to change the business logic in the Ceph RBD client, which can reduce maintenance costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0053] Figure 1 It is a structural diagram of an encryption system of a national secret Ceph block storage based on quantum key in an embodiment of the present application;

[0054] Figure 2 It is a flow chart of secure interaction between a passphrase management system and a Ceph RBD client in an embodiment of the present application;

[0055] Figure 3 It is an implementation flow chart of an encryption method of national secret Ceph block storage based on quantum key in an embodiment of the present application;

[0056] Figure 4 It is an implementation flow chart of another encryption method of national secret Ceph block storage based on quantum key in the embodiment of the present application;

[0057] Figure 5 It is a schematic diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0058] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0059] Ceph is a distributed storage system. Ceph storage (or Ceph block storage) has become a popular choice in data centers and cloud environments due to its flexibility, high performance, strong scalability, and close integration with Internet Technology (IT) infrastructure. It is widely used in enterprises and cloud service providers of all sizes to store large amounts of sensitive or long-term valuable data.

[0060] In related technologies, Ceph mainly uses traditional encryption algorithms such as RSA encryption algorithm or ECC to encrypt and store data. For example, the Ceph RBD client uses a traditional encryption algorithm to encrypt data and then writes it to the Ceph cloud storage service for storage.

[0061] With the rapid development of quantum computing technology, these traditional encryption algorithms are at risk of being cracked by quantum computers, making it difficult to ensure the security of data stored in Ceph Dynamic Block Device Dynamic Mirror (RBD mirror) volumes, that is, the storage data in Ceph. Therefore, how to use quantum security technology in practical applications to ensure data storage security and enable Ceph storage systems to resist quantum attacks has become a key issue that needs to be solved urgently.

[0062] In response to the problems existing in the above-mentioned related technologies, the embodiments of the present application propose an encryption method and system for Ceph block storage based on quantum keys. By setting up a passphrase management system, quantum security technology is applied to Ceph's encrypted storage, which can resist the cracking risks brought about by the rapid development of quantum computing, thereby ensuring the long-term security of stored data.

[0063] In combination with the accompanying drawings, the encryption method and system of the national secret Ceph block storage based on quantum key provided by the embodiments of the present application are described in detail through some embodiments and their application scenarios.

[0064] First, refer to Figure 1 As shown, it is a schematic diagram of the structure of an encryption system of a quantum key-based national secret Ceph block storage provided in an embodiment of the present application, wherein the system includes a passphrase management system, a Ceph RBD client and a Ceph cloud storage service client, wherein:

[0065] The Ceph RBD client is used to send an identity authentication request and an encryption request to the passphrase management system;

[0066] The pass phrase management system is used to obtain a quantum random number password when the Ceph RBD client passes the identity authentication associated with the encryption request, and create a data encryption key and a pass phrase according to the quantum random number password;

[0067] The pass phrase management system is further used to generate a key encapsulation key according to the pass phrase and a key derivation function corresponding to the pass phrase, and to generate a pass phrase identifier corresponding to the pass phrase;

[0068] The pass phrase management system is further configured to use the key encapsulation key to encrypt the data encryption key through a national secret algorithm to obtain a data encryption key ciphertext, and use the data encryption key to encrypt the write data corresponding to the encryption request through a national secret algorithm to obtain a data ciphertext;

[0069] The pass phrase management system is further used to use the data encryption key ciphertext, the key derivation function corresponding to the pass phrase and the pass phrase identifier as metadata corresponding to the data ciphertext, and send the data ciphertext and the metadata corresponding to the data ciphertext to the Ceph RBD client;

[0070] The Ceph RBD client is also used to perform data encapsulation processing and data striping processing on the data ciphertext and the metadata corresponding to the data ciphertext in sequence, and send the processed data to the Ceph cloud storage service client for storage.

[0071] Among them, the national secret algorithm can adopt SM4, etc. With the help of the high security, high performance, compliance and easy integration of the national secret algorithm, the passphrase management system can realize data encryption and decryption related operations more safely and reliably.

[0072] In a specific implementation, the identity authentication request may include a user account corresponding to the Ceph RBD client, and the passphrase management system queries whether there is a user account carried in the identity authentication request in pre-stored authorized user accounts.

[0073] If the user account carried in the authentication request exists in the pre-stored authorized user accounts, the passphrase management system determines that the Ceph RBD client passes the authentication (ie, the authentication is successful), and performs data encryption-related operations based on the encryption request.

[0074] If the user account carried in the authentication request does not exist in the pre-stored authorized user accounts, the passphrase management system determines that the Ceph RBD client has not passed the authentication (i.e., the authentication fails), and the passphrase management system does not provide data encryption related computing services to the Ceph RBD client.

[0075] Optionally, the Ceph RBD client includes:

[0076] Ceph RBD client service, used to mount and use RBD devices, and to set and query metadata corresponding to data ciphertext;

[0077] A first quantum security service is used to provide the Ceph RBD client service with a function of interacting with the first quantum cryptographic machine device in the form of an SDK toolkit, such as providing the ability to interact with encryption and decryption operation results;

[0078] The first quantum cryptographic machine device is used to perform quantum key management and quantum cryptographic operations. It is a device that provides quantum key management and quantum cryptographic operations functions, and may include modules such as a quantum key management module and a quantum cryptographic service module, so that the quantum cryptographic machine device provides quantum cryptographic service capabilities for the Ceph RBD client service.

[0079] Optionally, the passphrase management system comprises:

[0080] Passphrase management service, used for data encryption and decryption, and lifecycle management of passphrases and keys associated with the encryption and decryption. For example, it can provide lifecycle management of keys such as Data Encryption Key (DEK), passphrase, Key Derivation Function (KDF), Key Encryption Key (KEK) used for data encryption and decryption. The lifecycle management includes the generation, rotation, revocation and destruction of related keys, as well as the secure storage function of passphrases.

[0081] A second quantum security service is used to provide the passphrase management service with a function of interacting with the second quantum cryptographic machine device in the form of an SDK toolkit, such as providing the ability to interact with encryption and decryption operation results;

[0082] The second quantum cryptographic machine device is used to perform quantum key management and quantum cryptographic operations. It is a device that provides quantum key management and quantum cryptographic operations functions, and may include modules such as a quantum key management module and a quantum cryptographic service module, so that the quantum cryptographic machine device provides quantum cryptographic service capabilities for the pass phrase management service.

[0083] Optionally, the Ceph cloud storage service client includes one or more object storage devices (Object StorageDevice, OSD), on which an OSD storage service is deployed. The OSD storage service is responsible for key operations such as actual data storage, retrieval, replication, recovery and distribution, and can perform heartbeat checks with other OSD storage services.

[0084] Exemplarily, when the Ceph RBD client needs to write data to the Ceph cloud storage service client for storage, it first initiates an identity authentication request and an encryption request to the passphrase management system through the Ceph RBD client service.

[0085] After the passphrase management system determines that the Ceph RBD client identity authentication is successful, it applies for a quantum random number password from the second quantum cryptographic machine device through the passphrase management service to create a data encryption key DEK and a passphrase passphrase, and generates an ID corresponding to the passphrase passphrase (i.e., a passphrase ID, corresponding to the passphrase identifier); and selects a key derivation function KDF according to the passphrase passphrase, and generates a key encapsulation key KEK according to the key derivation function KDF and the passphrase passphrase. The passphrase management service stores the DEK, KEK, passphrase and passphrase ID in its own configured storage area for subsequent use.

[0086] The passphrase management system uses the key encapsulation key KEK and the SM4 algorithm through the passphrase management service to encrypt the data encryption key DEK to obtain the DEK ciphertext DEK_EncByKEK (ie, the data encryption key ciphertext); and uses the data encryption key DEK and the SM4 algorithm to encrypt the write data data to obtain the data ciphertext data_EncByDEK.

[0087] The passphrase management system uses the DEK_EncByKEK, KDF and passphrase ID as metadata corresponding to data_EncByDEK through the passphrase management service, and returns data_EncByDEK and metadata to the Ceph RBD client.

[0088] The Ceph RBD client encapsulates the returned data, such as encapsulating it into data_EncByDEK|metadata, where | is a string connector.

[0089] The Ceph RBD client uploads the encapsulated data to the OSD storage service in the Ceph cloud storage service client after data striping, such as mapping the encapsulated data into a Reliable Autonomic Distributed Object Store (RADOS) object of a specified size to implement striping processing, and saves it to the OSD storage service.

[0090] Therefore, the embodiment of the present application implements a Ceph block storage encryption mechanism based on quantum keys and national secret algorithms, which can ensure the security of data stored in Ceph RBD mirror volumes, and during the data writing process, the Ceph RBD client returns the data ciphertext and the metadata corresponding to the data ciphertext to the Ceph cloud storage service client, which can resist threats such as quantum eavesdropping attacks, thereby ensuring the transmission security of written data.

[0091] Among them, the Ceph RBD client can send the write data to the passphrase management system through an encryption request; or, when the passphrase management system returns information that the identity authentication is passed, the Ceph RBD client sends the write data to the passphrase management system. The embodiment of the present application does not impose specific restrictions on this.

[0092] Optionally, the Ceph RBD client is further used to send an identity authentication request and a write request to the Ceph cloud storage service client;

[0093] The Ceph RBD client is also used to create a new image (i.e. generate the write data) upon receiving the identity authentication pass information associated with the write request returned by the Ceph cloud storage service client, and send the identity authentication request and the encryption request corresponding to the write data to the passphrase management system.

[0094] It should be noted that the identity authentication described in this application (such as the identity authentication between the Ceph RBD client and the passphrase management system, and the identity authentication between the Ceph RBD client and the Ceph cloud storage service client, etc.) can be flexibly set according to actual needs. For example, the identity authentication request may also include a user login password, and the Ceph cloud storage service client determines that the Ceph RBD client has passed the identity authentication if the user login password carried in the identity authentication request is correct.

[0095] By adopting the technical solution of the embodiment of the present application, a passphrase management system is set up to provide the Ceph RBD client with data encryption related operation functions based on quantum random number cryptography, thereby applying quantum security technology to Ceph's encrypted storage, so that the data stored in Ceph can resist the risk of being cracked by quantum computers, thereby ensuring the long-term security of the stored data; and adopting an architecture in which the Ceph RBD client and the passphrase management system are separately deployed, that is, the related operation functions based on quantum random number cryptography are independently encapsulated in the passphrase management system for implementation, which can avoid the complex business logic in the Ceph RBD client from introducing security vulnerabilities to the related operation functions, thereby increasing the control ability of data leakage risks, and when the related operation functions are adjusted or updated, there is no need to change the business logic in the Ceph RBD client, which can reduce maintenance costs.

[0096] Optionally, in one embodiment, the Ceph RBD client is further used to read target encapsulated data from the Ceph cloud storage service client, and send an authentication request and a decryption request to the passphrase management system, wherein the target encapsulated data includes: target data ciphertext and target metadata corresponding to the target data ciphertext;

[0097] The pass phrase management system is further configured to receive the target encapsulated data sent by the Ceph RBD client when the Ceph RBD client passes the identity authentication associated with the decryption request;

[0098] The passphrase management system is further used to obtain the target metadata and the target data ciphertext from the target encapsulated data, and query the corresponding target passphrase according to the target passphrase identifier in the target metadata;

[0099] The pass phrase management system is further used to generate a target key encapsulation key according to the target pass phrase and the target key derivation function in the target metadata, and use the target key encapsulation key to decrypt the target data encryption key ciphertext in the target metadata through the national secret algorithm to obtain the target data encryption key;

[0100] The passphrase management system is also used to use the target data encryption key to decrypt the target data ciphertext through a national secret algorithm to obtain the target data, and return the target data to the Ceph RBD client.

[0101] In a specific implementation, after the Ceph RBD client reads the target encapsulated data data_EncByDEK|metadata from the Ceph cloud storage service, it initiates an identity authentication request and a decryption request to the passphrase management system through the Ceph RBD client service.

[0102] After receiving the identity authentication passed information returned by the passphrase management system, the Ceph RBD client sends data_EncByDEK|metadata to the passphrase management system through the Ceph RBD client service.

[0103] The passphrase management system reads the target data encryption key ciphertext DEK_EncByKEK, the target key derivation function KDF, and the target passphrase identifier passphrase ID in the target metadata through the passphrase management service; finds the corresponding target passphrase passphrase according to the target passphrase identifier passphrase ID, and calculates the target key encapsulation key KEK used to encrypt the target data encryption key DEK according to the target passphrase passphrase and the target key derivation function KDF.

[0104] Subsequently, the passphrase management service uses the target KEK and SM4 algorithm to decrypt the target DEK_EncByKEK to obtain the target DEK, and uses the target DEK to decrypt the target data ciphertext data_EncByDEK through the SM4 algorithm to obtain the data plaintext (i.e., target data), and returns the target data to the initiator of the decryption application (i.e., Ceph RBD client service). At this point, the reading and decryption process of Ceph storage data is completed.

[0105] It should be noted that considering that Ceph block storage is often used to dynamically allocate volumes to virtual machines and other applications, that is, the data stored in Ceph needs to be frequently transmitted in the network and between different nodes, it is particularly important to ensure the security of Ceph data transmission.

[0106] In order to improve the data transmission security of Ceph, in the data reading and writing process described in the above embodiment, a passphrase management system is set to encrypt and decrypt the data transmitted by the Ceph RBD client using quantum keys and national secret algorithms, so that the data transmitted between the Ceph RBD client and the Ceph cloud storage service client are all encrypted using quantum keys and national secret algorithms. This can not only ensure the data transmission security between the Ceph RBD client and the Ceph cloud storage service client, but also reduce the changes to the original architecture of the Ceph storage system and the original data reading and writing process between the Ceph RBD client and the Ceph cloud storage service client, thereby reducing the implementation cost.

[0107] Optionally, the Ceph RBD client is further used to send an identity authentication request and a read request to the Ceph cloud storage service client;

[0108] The Ceph cloud storage service client is used to return the identity authentication pass information associated with the read request and the target encapsulated data to the Ceph RBD client when the Ceph RBD client passes the identity authentication associated with the read request.

[0109] Optionally, in one embodiment, referring to Figure 2 The schematic diagram of the process of secure interaction between the passphrase management system and the Ceph RBD client shown in the figure, the system further includes: a quantum cryptography service platform, which is used to distribute symmetric keys to the Ceph RBD client and the passphrase management system; wherein:

[0110] The Ceph RBD client is further configured to, before sending read-write related data to the passphrase management system so that the passphrase management system performs encryption and decryption processing on the read-write related data, send a system authentication request to the passphrase management system as an initiator of establishing a quantum secure channel;

[0111] The Ceph RBD client is further configured to, upon receiving the information indicating that the system authentication is passed returned by the passphrase management system, send a quantum key negotiation request to the passphrase management system, and generate a corresponding first symmetric key identifier according to the symmetric key distributed by the quantum cryptography service platform;

[0112] The pass phrase management system is further configured to generate a corresponding second symmetric key identifier according to the symmetric key upon receiving the quantum key negotiation request, and return the second symmetric key identifier to the CephRBD client;

[0113] The Ceph RBD client is further used to encrypt the read-write related data by using a national encryption algorithm according to the first symmetric key identifier, and send the second symmetric key identifier and the encrypted read-write related data to the passphrase management system;

[0114] The pass phrase management system is further configured to, upon receiving the second symmetric key identifier and the encrypted read-write related data, decrypt the encrypted read-write related data using a national secret algorithm according to the second symmetric key identifier to obtain the read-write related data;

[0115] The pass phrase management system is further used to, after encrypting and decrypting the read-write related data, use the encrypted and decrypted data as return data, encrypt the return data by using the national secret algorithm according to the second symmetric key identifier, and send the encrypted return data to the Ceph RBD client;

[0116] The Ceph RBD client is also used to decrypt the encrypted return data using a national encryption algorithm according to the first symmetric key identifier to obtain the return data.

[0117] In a specific implementation, when the Ceph RBD client needs to send read-write related data (such as the above-mentioned write data or target encapsulation data) to the passphrase management system, as the initiator of establishing a quantum secure channel, the Ceph RBD client sends a request to establish a quantum secure channel with the passphrase management system to its own quantum security service (Quantum Security Service Module, QSSM) through the Ceph RBD client service.

[0118] After receiving the request to establish a quantum secure channel with the passphrase management system, the QSSM (i.e., the first quantum security service) of the Ceph RBD client service initiates a system authentication request to the QSSM (i.e., the second quantum security service) of the passphrase management system. The system authentication request can carry system-related information such as user name or password for the second quantum security service to perform system authentication.

[0119] After receiving the information that the system authentication is passed returned by the second quantum security service, the first quantum security service sends a quantum key negotiation request to the second quantum security service to perform quantum key negotiation with the second quantum security service.

[0120] Specifically, the first quantum security service and the second quantum security service respectively send key applications to the quantum hardware security module (QHSM) on this side. Among them, the keys in the QHSM on the first quantum security service side (i.e., the first quantum cryptographic device) and the QHSM on the second quantum security service side (i.e., the second quantum cryptographic device) are the symmetric keys QKD_key pre-distributed and charged by the quantum cryptographic service platform.

[0121] The first quantum cryptographic device generates a first symmetric key identifier QKD_keyID_A corresponding to QKD_key, and the second quantum cryptographic device generates a second symmetric key identifier QKD_keyID_B corresponding to QKD_key.

[0122] The first quantum cryptographic device returns QKD_keyID_A to the first quantum security service, the second quantum cryptographic device returns QKD_keyID_B to the second quantum security service, and the second quantum security service returns QKD_keyID_B to the first quantum security service. Thus, the key negotiation between the Ceph RBD client and the passphrase management system is completed.

[0123] The first quantum security service returns the key IDs of both parties, namely QKD_keyID_A and QKD_keyID_B, to the Ceph RBD client service. The Ceph RBD client service then uses the first quantum cryptographic machine device to encrypt the read-write related data using QKD_keyID_A (or its corresponding QKD_key) and the SM4 national encryption algorithm to obtain the encrypted read-write related data request_EncByQKD. In the data writing process, the request_EncByQKD is the encrypted write data data; in the data reading process, the request_EncByQKD is the encrypted target encapsulation data.

[0124] The Ceph RBD client service transmits request_EncByQKD and QKD_keyID_B to the passphrase management service. The passphrase management service then decrypts request_EncByQKD according to QKD_keyID_B through the second quantum cryptographic machine device, and the decrypted data plaintext is encrypted or decrypted by the passphrase management service to generate the return data respond. In the data writing process, the respond is: the data ciphertext data_EncByDEK obtained after encrypting the written data, and the metadata metadata corresponding to the written data ciphertext; in the data reading process, the respond is: the target data obtained after decrypting the target data ciphertext.

[0125] The second quantum cryptographic machine encrypts the response according to the SM4 national encryption algorithm and QKD_keyID_B to obtain the encrypted return data. The passphrase management service returns the encrypted return data to the Ceph RBD client service, and the first quantum cryptographic machine then decrypts the encrypted return data according to QKD_keyID_A to obtain the respond plaintext.

[0126] As a result, data transmission based on quantum secure channels is realized between Ceph RBD clients and the passphrase management system, that is, data transmission based on national secret algorithms and symmetric keys distributed by quantum cryptography service platforms is realized, thereby ensuring the security of data transmission between Ceph RBD clients and the passphrase management system.

[0127] Optionally, the quantum cryptography service platform is also used to perform routing calculations between subnets, and to collect availability data of quantum networks and cryptographic systems.

[0128] In the specific implementation, the quantum key generated by the quantum network is processed by the cryptographic system and then transmitted to the quantum cryptographic service platform. The quantum cryptographic platform collects the availability data of the quantum network and the cryptographic system to determine whether the quantum key transmitted by the cryptographic system is available. After obtaining the available quantum key, the quantum cryptographic service platform transmits the quantum key to the quantum cryptographic machine equipment on the passphrase management system side and the Ceph RBD client side through routing calculation between subnets, so that the passphrase management system and the Ceph RBD client side can perform key negotiation when establishing a quantum secure channel.

[0129] Based on the above embodiments, the present application applies national secret algorithms and quantum security technologies (such as quantum key distribution and quantum-safe symmetric encryption algorithms, etc.) to the Ceph storage system, so that the data stored in the Ceph RBD volume can resist the cracking risks brought by quantum computing, thereby ensuring the long-term security of data storage, and can effectively resist threats such as quantum eavesdropping attacks during data transmission, and ensure the security of data frequently transmitted in different nodes or networks (such as data frequently transmitted between a passphrase management system, a Ceph RBD client, and a Ceph cloud storage service client), thereby achieving data privacy protection; and adopting an architecture in which the Ceph RBD client and the passphrase management system are separately deployed, and quantum security technology-related functions such as key and passphrase management and cryptographic operations are encapsulated in the passphrase management system for implementation, which can reduce security vulnerabilities introduced by the complexity of the business logic of the Ceph RBD client, thereby increasing the risk control capability of data leakage, and making it easier to upgrade the encryption algorithm or add new security features to the functions related to quantum security technology without changing the overall business logic, thereby reducing maintenance costs.

[0130] Second, refer to Figure 3 As shown, it is an implementation flow chart of an encryption method for national secret Ceph block storage based on quantum key provided in an embodiment of the present application. The encryption method for national secret Ceph block storage based on quantum key is applied to a passphrase management system. The method may include the following steps:

[0131] Step S11: receiving an identity authentication request and an encryption request sent by a Ceph RBD client;

[0132] Step S12: when the Ceph RBD client passes the identity authentication associated with the encryption request, obtain a quantum random number password, and create a data encryption key and a passphrase according to the quantum random number password;

[0133] Step S13: generating a key encapsulation key according to the passphrase and a key derivation function corresponding to the passphrase, and generating a passphrase identifier corresponding to the passphrase;

[0134] Step S14: using the key encapsulation key, encrypting the data encryption key through the national secret algorithm to obtain data encryption key ciphertext, and using the data encryption key, encrypting the write data corresponding to the encryption request through the national secret algorithm to obtain data ciphertext;

[0135] Step S15: Use the data encryption key ciphertext, the key derivation function corresponding to the passphrase, and the passphrase identifier as metadata corresponding to the data ciphertext, and send the data ciphertext and the metadata corresponding to the data ciphertext to the Ceph RBD client, so that the Ceph RBD client performs data encapsulation processing and data striping processing on the data ciphertext and the metadata corresponding to the data ciphertext in sequence, and sends the processed data to the Ceph cloud storage service client for storage.

[0136] By adopting the technical solution of the embodiment of the present application, a passphrase management system is set up to provide the Ceph RBD client with data encryption related operation functions based on quantum random number cryptography, thereby applying quantum security technology to Ceph's encrypted storage, so that the data stored in Ceph can resist the risk of being cracked by quantum computers, thereby ensuring the long-term security of the stored data; and adopting an architecture in which the Ceph RBD client and the passphrase management system are separately deployed, that is, the related operation functions based on quantum random number cryptography are independently encapsulated in the passphrase management system for implementation, which can avoid the complex business logic in the Ceph RBD client from introducing security vulnerabilities to the related operation functions, thereby increasing the control ability of data leakage risks, and when the related operation functions are adjusted or updated, there is no need to change the business logic in the Ceph RBD client, which can reduce maintenance costs.

[0137] As a possible implementation, the method further includes:

[0138] Receive an authentication request and a decryption request sent by the Ceph RBD client;

[0139] When the Ceph RBD client passes the identity authentication associated with the decryption request, receiving target encapsulated data sent by the Ceph RBD client, the target encapsulated data is read by the Ceph RBD client from the Ceph cloud storage service client, and the target encapsulated data includes: target data ciphertext and target metadata corresponding to the target data ciphertext;

[0140] Acquire the target metadata and the target data ciphertext from the target encapsulated data, and query the corresponding target password phrase according to the target password phrase identifier in the target metadata;

[0141] Generate a target key encapsulation key according to the target passphrase and the target key derivation function in the target metadata, and use the target key encapsulation key to decrypt the target data encryption key ciphertext in the target metadata through the national secret algorithm to obtain the target data encryption key;

[0142] The target data encryption key is used to decrypt the target data ciphertext through the national secret algorithm to obtain the target data, and the target data is returned to the Ceph RBD client.

[0143] As a possible implementation, the method further includes:

[0144] Receive a system authentication request sent by the Ceph RBD client;

[0145] When the Ceph RBD client passes the system authentication, returning the information that the system authentication is passed to the Ceph RBD client;

[0146] Receiving a quantum key agreement request sent by the Ceph RBD client;

[0147] Generate a corresponding second symmetric key identifier according to the symmetric key pre-distributed by the quantum cryptography service platform, and return the second symmetric key identifier to the Ceph RBD client;

[0148] Receive the second symmetric key identifier and the encrypted read-write related data sent by the Ceph RBD client, where the encrypted read-write related data is encrypted by the Ceph RBD client according to the first symmetric key identifier and the national encryption algorithm, and the first symmetric key identifier is generated by the Ceph RBD client according to the symmetric key;

[0149] According to the second symmetric key identifier, the encrypted read-write related data is decrypted by using a national secret algorithm to obtain the read-write related data;

[0150] After the read-write related data is encrypted and decrypted, the encrypted and decrypted data is used as the return data, and the return data is encrypted by the national encryption algorithm according to the second symmetric key identifier, and the encrypted return data is sent to the Ceph RBD client, so that

[0151] The Ceph RBD client decrypts the encrypted return data using a national encryption algorithm according to the first symmetric key identifier to obtain the return data.

[0152] Optionally, the passphrase management system comprises:

[0153] Passphrase management service, used to perform encryption and decryption processing of data, and to perform life cycle management of passphrases and keys associated with the encryption and decryption processing;

[0154] A second quantum security service, configured to provide the passphrase management service with a function of interacting with the second quantum cryptographic machine device in the form of an SDK toolkit;

[0155] The second quantum cryptographic machine is used for quantum key management and quantum cryptographic operations.

[0156] It should be noted that the encryption method embodiment of the national secret Ceph block storage based on quantum key provided in the embodiment of the present application corresponds to the relevant embodiment of the passphrase management system in the encryption system of the national secret Ceph block storage based on quantum key described in the first aspect. To avoid repetition, it will not be repeated here.

[0157] Thirdly, refer to Figure 4 As shown, it is an implementation flow chart of another encryption method for national secret Ceph block storage based on quantum key provided in an embodiment of the present application. The encryption method for national secret Ceph block storage based on quantum key is applied to Ceph RBD client. The method may include the following steps:

[0158] Step S21: sending an identity authentication request and an encryption request to a passphrase management system;

[0159] Step S22: upon receiving the identity authentication pass information associated with the encryption request sent by the pass phrase management system, sending the write data corresponding to the encryption request to the pass phrase management system;

[0160] Step S23: receiving the data ciphertext and metadata corresponding to the data ciphertext sent by the passphrase management system;

[0161] Step S24: perform data encapsulation processing and data striping processing on the data ciphertext and the metadata corresponding to the data ciphertext in sequence, and send the processed data to the Ceph cloud storage service client for storage.

[0162] Among them, the data ciphertext is obtained by the passphrase management system using a data encryption key to encrypt the written data through a national secret algorithm; the metadata corresponding to the data ciphertext includes a data encryption key ciphertext, a key derivation function corresponding to the passphrase and a passphrase identifier, the data encryption key and the passphrase are created by the passphrase management system according to a quantum random number password, the data encryption key ciphertext is obtained by the passphrase management system using a key encapsulation key to encrypt the data encryption key through a national secret algorithm, and the key encapsulation key is generated by the passphrase management system according to the passphrase and the key derivation function corresponding to the passphrase.

[0163] By adopting the technical solution of the embodiment of the present application, a passphrase management system is set up to provide the Ceph RBD client with data encryption related operation functions based on quantum random number cryptography, thereby applying quantum security technology to Ceph's encrypted storage, so that the data stored in Ceph can resist the risk of being cracked by quantum computers, thereby ensuring the long-term security of the stored data; and adopting an architecture in which the Ceph RBD client and the passphrase management system are separately deployed, that is, the related operation functions based on quantum random number cryptography are independently encapsulated in the passphrase management system for implementation, which can avoid the complex business logic in the Ceph RBD client from introducing security vulnerabilities to the related operation functions, thereby increasing the control ability of data leakage risks, and when the related operation functions are adjusted or updated, there is no need to change the business logic in the Ceph RBD client, which can reduce maintenance costs.

[0164] As a possible implementation, the method further includes:

[0165] Reading target encapsulated data from the Ceph cloud storage service client, and sending an identity authentication request and a decryption request to the passphrase management system, the target encapsulated data including: target data ciphertext and target metadata corresponding to the target data ciphertext;

[0166] In the case where the Ceph RBD client passes the identity authentication associated with the decryption request, the target encapsulated data is sent to the passphrase management system so that

[0167] The passphrase management system obtains the target metadata and the target data ciphertext from the target encapsulated data, and queries the corresponding target passphrase according to the target passphrase identifier in the target metadata, generates a target key encapsulation key according to the target passphrase and the target key derivation function in the target metadata, and uses the target key encapsulation key to decrypt the target data encryption key ciphertext in the target metadata through the national secret algorithm to obtain the target data encryption key, uses the target data encryption key to decrypt the target data ciphertext through the national secret algorithm to obtain the target data, and returns the target data to the Ceph RBD client.

[0168] As a possible implementation, the method further includes:

[0169] Send an authentication request and a read request to the Ceph cloud storage service client to enable

[0170] When the Ceph RBD client passes the identity authentication associated with the read request, the Ceph cloud storage service client returns the identity authentication pass information associated with the read request and the target encapsulated data to the Ceph RBD client.

[0171] As a possible implementation, the method further includes:

[0172] Before sending the read-write related data to the passphrase management system so that the passphrase management system performs encryption and decryption processing on the read-write related data, as the initiator of establishing the quantum secure channel, sending a system authentication request to the passphrase management system;

[0173] Upon receiving the information indicating that the system authentication is passed returned by the pass phrase management system, sending a quantum key agreement request to the pass phrase management system, and generating a corresponding first symmetric key identifier according to the symmetric key distributed by the quantum cryptography service platform;

[0174] receiving a second symmetric key identifier sent by the passphrase management system, where the second symmetric key identifier is generated by the passphrase management system according to the symmetric key;

[0175] According to the first symmetric key identifier, the read-write related data is encrypted by a national secret algorithm, and the second symmetric key identifier and the encrypted read-write related data are sent to the passphrase management system, so that

[0176] The pass phrase management system decrypts the encrypted read-write related data by using the national secret algorithm according to the second symmetric key identifier to obtain the read-write related data, and after encrypting and decrypting the read-write related data, uses the obtained encrypted and decrypted data as return data, encrypts the return data by using the national secret algorithm according to the second symmetric key identifier, and sends the encrypted return data to the Ceph RBD client;

[0177] When the encrypted return data returned by the passphrase management system is received, the encrypted return data is decrypted by using a national encryption algorithm according to the first symmetric key identifier to obtain the return data.

[0178] As a possible implementation, the method further includes:

[0179] Send an authentication request and a write request to the Ceph cloud storage service client;

[0180] Upon receiving the identity authentication pass information associated with the write request returned by the Ceph cloud storage service client, the write data is generated, and the identity authentication request and the encryption request corresponding to the write data are sent to the passphrase management system.

[0181] Optionally, the Ceph RBD client includes:

[0182] Ceph RBD client service, used to mount and use RBD devices, and to set and query metadata corresponding to data ciphertext;

[0183] A first quantum security service, configured to provide the Ceph RBD client service with a function of interacting with the first quantum cryptographic machine device in the form of an SDK toolkit;

[0184] The first quantum cryptographic machine device is used for quantum key management and quantum cryptographic operations.

[0185] It should be noted that the encryption method embodiment of the national secret Ceph block storage based on quantum key provided in the embodiment of the present application corresponds to the relevant embodiment of the Ceph RBD client in the encryption system of the national secret Ceph block storage based on quantum key described in the first aspect. To avoid repetition, it will not be repeated here.

[0186] For the method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the order of the actions described, because according to the embodiments of the present application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0187] The present application also provides an electronic device, referring to Figure 5 , Figure 5 Schematic diagram of an electronic device proposed in an embodiment of the present application. Figure 5 As shown, the electronic device 100 includes: a memory 110 and a processor 120. The memory 110 and the processor 120 are connected via a bus communication. A computer program is stored in the memory 110. The computer program can be run on the processor 120 to implement the steps in the encryption method of the national secret Ceph block storage based on quantum key disclosed in the embodiment of the present application.

[0188] The embodiment of the present application also provides a computer-readable storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the encryption method of the national secret Ceph block storage based on quantum key as disclosed in the embodiment of the present application is implemented.

[0189] The embodiment of the present application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the encryption method of the national secret Ceph block storage based on quantum key as disclosed in the embodiment of the present application.

[0190] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0191] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0192] The above is a detailed introduction to the encryption method and system of the national secret Ceph block storage based on quantum key provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An encryption system for Ceph block storage based on quantum key, characterized in that: It includes the passphrase management system, Ceph RBD client, and Ceph cloud storage service client, including: The Ceph RBD client is used to send an identity authentication request and an encryption request to the passphrase management system; The pass phrase management system is used to obtain a quantum random number password when the Ceph RBD client passes the identity authentication associated with the encryption request, and create a data encryption key and a pass phrase according to the quantum random number password; The pass phrase management system is further used to generate a key encapsulation key according to the pass phrase and a key derivation function corresponding to the pass phrase, and to generate a pass phrase identifier corresponding to the pass phrase; The pass phrase management system is further configured to use the key encapsulation key to encrypt the data encryption key through a national secret algorithm to obtain a data encryption key ciphertext, and use the data encryption key to encrypt the write data corresponding to the encryption request through a national secret algorithm to obtain a data ciphertext; The pass phrase management system is further used to use the data encryption key ciphertext, the key derivation function corresponding to the pass phrase and the pass phrase identifier as metadata corresponding to the data ciphertext, and send the data ciphertext and the metadata corresponding to the data ciphertext to the Ceph RBD client; The Ceph RBD client is also used to perform data encapsulation processing and data striping processing on the data ciphertext and the metadata corresponding to the data ciphertext in sequence, and send the processed data to the Ceph cloud storage service client for storage.

2. The system according to claim 1, characterized in that The Ceph RBD client is further used to read target encapsulated data from the Ceph cloud storage service client and send an identity authentication request and a decryption request to the passphrase management system, wherein the target encapsulated data includes: target data ciphertext and target metadata corresponding to the target data ciphertext; The pass phrase management system is further configured to receive the target encapsulated data sent by the Ceph RBD client when the Ceph RBD client passes the identity authentication associated with the decryption request; The passphrase management system is further used to obtain the target metadata and the target data ciphertext from the target encapsulated data, and query the corresponding target passphrase according to the target passphrase identifier in the target metadata; The pass phrase management system is further used to generate a target key encapsulation key according to the target pass phrase and the target key derivation function in the target metadata, and use the target key encapsulation key to decrypt the target data encryption key ciphertext in the target metadata through the national secret algorithm to obtain the target data encryption key; The passphrase management system is also used to use the target data encryption key to decrypt the target data ciphertext through a national secret algorithm to obtain the target data, and return the target data to the Ceph RBD client.

3. The system according to claim 2, characterized in that The Ceph RBD client is also used to send an identity authentication request and a read request to the Ceph cloud storage service client; The Ceph cloud storage service client is used to return the identity authentication pass information associated with the read request and the target encapsulated data to the Ceph RBD client when the Ceph RBD client passes the identity authentication associated with the read request.

4. The system according to claim 1, characterized in that The system further comprises: a quantum cryptography service platform, configured to distribute symmetric keys to the Ceph RBD client and the passphrase management system; wherein: The Ceph RBD client is further configured to, before sending read-write related data to the passphrase management system so that the passphrase management system performs encryption and decryption processing on the read-write related data, send a system authentication request to the passphrase management system as an initiator of establishing a quantum secure channel; The Ceph RBD client is further configured to, upon receiving the information indicating that the system authentication is passed returned by the passphrase management system, send a quantum key negotiation request to the passphrase management system, and generate a corresponding first symmetric key identifier according to the symmetric key distributed by the quantum cryptography service platform; The pass phrase management system is further configured to, upon receiving the quantum key negotiation request, generate a corresponding second symmetric key identifier according to the symmetric key, and return the second symmetric key identifier to the Ceph RBD client; The Ceph RBD client is further used to encrypt the read-write related data by using a national encryption algorithm according to the first symmetric key identifier, and send the second symmetric key identifier and the encrypted read-write related data to the passphrase management system; The pass phrase management system is further configured to, upon receiving the second symmetric key identifier and the encrypted read-write related data, decrypt the encrypted read-write related data using a national secret algorithm according to the second symmetric key identifier to obtain the read-write related data; The pass phrase management system is further used to, after encrypting and decrypting the read-write related data, use the encrypted and decrypted data as return data, encrypt the return data by using the national secret algorithm according to the second symmetric key identifier, and send the encrypted return data to the Ceph RBD client; The Ceph RBD client is also used to decrypt the encrypted return data using a national encryption algorithm according to the first symmetric key identifier to obtain the return data.

5. The system according to claim 4, characterized in that The quantum cryptography service platform is also used to perform routing calculations between subnets and to collect availability data of quantum networks and cryptographic systems.

6. The system according to claim 1, characterized in that The Ceph RBD client is also used to send an identity authentication request and a write request to the Ceph cloud storage service client; The Ceph RBD client is further used to generate the write data upon receiving the identity authentication pass information associated with the write request returned by the Ceph cloud storage service client, and send the identity authentication request and the encryption request corresponding to the write data to the passphrase management system.

7. The system according to any one of claims 1 to 6, characterized in that: The Ceph RBD client includes: Ceph RBD client service, used to mount and use RBD devices, and to set and query metadata corresponding to data ciphertext; A first quantum security service, configured to provide the Ceph RBD client service with a function of interacting with the first quantum cryptographic machine device in the form of an SDK toolkit; The first quantum cryptographic machine device is used for quantum key management and quantum cryptographic operations.

8. The system according to any one of claims 1 to 6, characterized in that: The passphrase management system includes: Passphrase management service, used to perform encryption and decryption processing of data, and to perform life cycle management of passphrases and keys associated with the encryption and decryption processing; A second quantum security service, configured to provide the passphrase management service with a function of interacting with the second quantum cryptographic machine device in the form of an SDK toolkit; The second quantum cryptographic machine is used for quantum key management and quantum cryptographic operations.

9. An encryption method for Ceph block storage based on quantum key, characterized in that: Applied to a passphrase management system, the method comprises: Receive authentication requests and encryption requests sent by Ceph RBD clients; When the Ceph RBD client passes the identity authentication associated with the encryption request, obtaining a quantum random number password, and creating a data encryption key and a passphrase according to the quantum random number password; generating a key encapsulation key according to the passphrase and a key derivation function corresponding to the passphrase, and generating a passphrase identifier corresponding to the passphrase; Using the key encapsulation key, encrypting the data encryption key through a national secret algorithm to obtain a data encryption key ciphertext, and using the data encryption key, encrypting the write data corresponding to the encryption request through a national secret algorithm to obtain a data ciphertext; The data encryption key ciphertext, the key derivation function corresponding to the passphrase, and the passphrase identifier are used as metadata corresponding to the data ciphertext, and the data ciphertext and the metadata corresponding to the data ciphertext are sent to the Ceph RBD client, so that the Ceph RBD client performs data encapsulation processing and data striping processing on the data ciphertext and the metadata corresponding to the data ciphertext in sequence, and sends the processed data to the Ceph cloud storage service client for storage.

10. An encryption method for Ceph block storage based on quantum key, characterized in that: Applied to a Ceph RBD client, the method includes: Sending an authentication request and an encryption request to a passphrase management system; Upon receiving identity authentication passing information associated with the encryption request sent by the pass phrase management system, sending write data corresponding to the encryption request to the pass phrase management system; Receiving a data ciphertext and metadata corresponding to the data ciphertext sent by the passphrase management system; The data ciphertext and the metadata corresponding to the data ciphertext are sequentially encapsulated and striped, and the processed data is sent to the Ceph cloud storage service client for storage; Among them, the data ciphertext is obtained by the passphrase management system using a data encryption key to encrypt the written data through a national secret algorithm; the metadata corresponding to the data ciphertext includes a data encryption key ciphertext, a key derivation function corresponding to the passphrase and a passphrase identifier, the data encryption key and the passphrase are created by the passphrase management system according to a quantum random number password, the data encryption key ciphertext is obtained by the passphrase management system using a key encapsulation key to encrypt the data encryption key through a national secret algorithm, and the key encapsulation key is generated by the passphrase management system according to the passphrase and the key derivation function corresponding to the passphrase.

Images