An encryption method and system for Ceph block storage based on quantum key

Abstract

The present application provides an encryption method and system for national secret Ceph block storage based on quantum keys, belonging to the field of storage technology. The present application provides Ceph RBD clients with data encryption-related operation functions based on quantum random number cryptography by setting up a passphrase management system, thereby applying quantum security technology to Ceph's encrypted storage, which can ensure the long-term security of stored data; and adopts an architecture in which the Ceph RBD client and the passphrase management system are deployed separately, which can increase the control capability of data leakage risks and reduce maintenance costs.

Description

Technical Field

[0001] The present application relates to the field of storage technology, and in particular to an encryption method and system for quantum key-based national secret Ceph block storage. Background Art

[0002] Ceph is a distributed storage system that is widely used in cloud environments, big data analysis, and various enterprise-level applications. It is often used to store large amounts of sensitive or long-term valuable data.

[0003] Ceph primarily uses traditional encryption algorithms, such as RSA and Elliptic Curve Cryptography (ECC), to encrypt and store data. With the rapid development of quantum computing, these traditional encryption algorithms are at risk of being cracked by quantum computers, making it difficult to guarantee the security of data stored in Ceph. Summary of the Invention

[0004] In view of the above problems, the embodiments of the present application provide an encryption method and system for national secret Ceph block storage based on quantum keys, so as to overcome the above problems or at least partially solve the above problems.

[0005] In a first aspect of an embodiment of the present application, a quantum key-based encryption system for Ceph block storage is provided, comprising a passphrase management system, a Ceph RBD client, and a Ceph cloud storage service client, wherein:

[0006] The Ceph RBD client is used to send an identity authentication request and an encryption request to the passphrase management system;

[0007] The passphrase management system is configured to obtain a quantum random number password when the Ceph RBD client passes the identity authentication associated with the encryption request, and create a data encryption key and a passphrase based on the quantum random number password;

[0008] The passphrase management system is further configured to generate a key encapsulation key based on the passphrase and a key derivation function corresponding to the passphrase, and to generate a passphrase identifier corresponding to the passphrase;

[0009] The passphrase management system is further configured to use the key encapsulation key to encrypt the data encryption key using a national secret algorithm to obtain a data encryption key ciphertext, and use the data encryption key to encrypt the write data corresponding to the encryption request using a national secret algorithm to obtain a data ciphertext;

[0010] The passphrase management system is further configured to use the data encryption key ciphertext, the key derivation function corresponding to the passphrase, and the passphrase identifier as metadata corresponding to the data ciphertext, and send the data ciphertext and the metadata corresponding to the data ciphertext to the Ceph RBD client;

[0011] The Ceph RBD client is further used to perform data encapsulation processing and data striping processing on the data ciphertext and the metadata corresponding to the data ciphertext, and send the processed data to the Ceph cloud storage service client for storage.

[0012] Optionally, the Ceph RBD client is further configured to read target encapsulated data from the Ceph cloud storage service client and send an identity authentication request and a decryption request to the passphrase management system, wherein the target encapsulated data includes: target data ciphertext and target metadata corresponding to the target data ciphertext;

[0013] The passphrase management system is further configured to receive the target encapsulated data sent by the Ceph RBD client if the Ceph RBD client passes the identity authentication associated with the decryption request;

[0014] The passphrase management system is further configured to obtain the target metadata and the target data ciphertext from the target encapsulated data, and query the corresponding target passphrase based on the target passphrase identifier in the target metadata;

[0015] The passphrase management system is further configured to generate a target key encapsulation key based on the target passphrase and the target key derivation function in the target metadata, and use the target key encapsulation key to decrypt the target data encryption key ciphertext in the target metadata using a national secret algorithm to obtain the target data encryption key;

[0016] The passphrase management system is further configured to use the target data encryption key to decrypt the target data ciphertext using a national secret algorithm to obtain target data, and return the target data to the Ceph RBD client.

[0017] Optionally, the Ceph RBD client is further configured to send an identity authentication request and a read request to the Ceph cloud storage service client;

[0018] The Ceph cloud storage service client is used to return the identity authentication pass information associated with the read request and the target encapsulated data to the Ceph RBD client when the Ceph RBD client passes the identity authentication associated with the read request.

[0019] Optionally, the system further comprises: a quantum cryptography service platform, configured to distribute symmetric keys to the Ceph RBD client and the passphrase management system; wherein:

[0020] The Ceph RBD client is further configured to, before sending read-write related data to the passphrase management system so that the passphrase management system performs encryption and decryption processing on the read-write related data, send a system authentication request to the passphrase management system as an initiator of establishing a quantum secure channel;

[0021] The Ceph RBD client is further configured to, upon receiving information indicating that the system authentication is passed returned by the passphrase management system, send a quantum key agreement request to the passphrase management system, and generate a corresponding first symmetric key identifier based on the symmetric key distributed by the quantum cryptography service platform;

[0022] The passphrase management system is further configured to, upon receiving the quantum key agreement request, generate a corresponding second symmetric key identifier based on the symmetric key, and return the second symmetric key identifier to the CephRBD client;

[0023] The Ceph RBD client is further configured to encrypt the read-write related data using a national encryption algorithm according to the first symmetric key identifier, and send the second symmetric key identifier and the encrypted read-write related data to the passphrase management system;

[0024] The passphrase management system is further configured to, upon receiving the second symmetric key identifier and the encrypted read-write related data, decrypt the encrypted read-write related data using a national secret algorithm according to the second symmetric key identifier to obtain the read-write related data;

[0025] The passphrase management system is further configured to, after encrypting and decrypting the read-write related data, use the encrypted and decrypted data obtained as return data, encrypt the return data using a national secret algorithm according to the second symmetric key identifier, and send the encrypted return data to the Ceph RBD client;

[0026] The Ceph RBD client is further used to decrypt the encrypted return data using a national encryption algorithm according to the first symmetric key identifier to obtain the return data.

[0027] Optionally, the quantum cryptography service platform is also used to perform routing calculations between subnets, and to collect availability data of quantum networks and cryptographic systems.

[0028] Optionally, the Ceph RBD client is further configured to send an identity authentication request and a write request to the Ceph cloud storage service client;

[0029] The Ceph RBD client is further configured to, upon receiving identity authentication success information associated with the write request returned by the Ceph cloud storage service client, generate the write data and send the identity authentication request and an encryption request corresponding to the write data to the passphrase management system.

[0030] Optionally, the Ceph RBD client includes:

[0031] Ceph RBD client service, used to mount and use RBD devices, and to set and query metadata corresponding to data ciphertext;

[0032] A first quantum security service is configured to provide the Ceph RBD client service with a function of interacting with the first quantum cryptography machine device in the form of an SDK toolkit;

[0033] The first quantum cryptography machine device is used for quantum key management and quantum cryptography operations.

[0034] Optionally, the passphrase management system includes:

[0035] Passphrase management service, used to perform encryption and decryption of data, and to manage the lifecycle of passphrases and keys associated with the encryption and decryption processes;

[0036] A second quantum security service is configured to provide the passphrase management service with a function of interacting with the second quantum cryptography machine device in the form of an SDK toolkit;

[0037] The second quantum cryptography machine is used for quantum key management and quantum cryptography operations.

[0038] A second aspect of the embodiments of the present application provides an encryption method for Ceph block storage based on quantum keys, which is applied to a passphrase management system. The method includes:

[0039] Receive authentication and encryption requests from Ceph RBD clients;

[0040] When the Ceph RBD client passes the identity authentication associated with the encryption request, obtaining a quantum random number password, and creating a data encryption key and a passphrase based on the quantum random number password;

[0041] generating a key encapsulation key according to the passphrase and a key derivation function corresponding to the passphrase, and generating a passphrase identifier corresponding to the passphrase;

[0042] Using the key encapsulation key, encrypting the data encryption key using a national secret algorithm to obtain a data encryption key ciphertext, and using the data encryption key, encrypting the write data corresponding to the encryption request using a national secret algorithm to obtain a data ciphertext;

[0043] The data encryption key ciphertext, the key derivation function corresponding to the passphrase, and the passphrase identifier are used as metadata corresponding to the data ciphertext, and the data ciphertext and the metadata corresponding to the data ciphertext are sent to the Ceph RBD client, so that the Ceph RBD client performs data encapsulation processing and data striping processing on the data ciphertext and the metadata corresponding to the data ciphertext in sequence, and sends the processed data to the Ceph cloud storage service client for storage.

[0044] A third aspect of the embodiments of the present application provides a quantum key-based encryption method for Ceph block storage, which is applied to a Ceph RBD client. The method includes:

[0045] Sending identity authentication and encryption requests to the passphrase management system;

[0046] Upon receiving identity authentication success information associated with the encryption request sent by the passphrase management system, sending write data corresponding to the encryption request to the passphrase management system;

[0047] receiving a data ciphertext and metadata corresponding to the data ciphertext sent by the passphrase management system;

[0048] The data ciphertext and the metadata corresponding to the data ciphertext are sequentially encapsulated and striped, and the processed data is sent to the Ceph cloud storage service for storage;

[0049] The data ciphertext is obtained by encrypting the written data using a data encryption key by the passphrase management system through a national secret algorithm; the metadata corresponding to the data ciphertext includes a data encryption key ciphertext, a key derivation function corresponding to the passphrase, and a passphrase identifier; the data encryption key and the passphrase are created by the passphrase management system based on a quantum random number cipher; the data encryption key ciphertext is obtained by encrypting the data encryption key using a key encapsulation key by the passphrase management system through a national secret algorithm; the key encapsulation key is generated by the passphrase management system based on the passphrase and the key derivation function corresponding to the passphrase.

[0050] The embodiments of the present application include the following advantages:

[0051] By setting up a passphrase management system to provide the Ceph RBD client with data encryption-related operation functions based on quantum random number cryptography, quantum security technology is applied to Ceph's encrypted storage, so that the data stored in Ceph can resist the risk of being cracked by quantum computers, thereby ensuring the long-term security of the stored data; and adopting an architecture in which the Ceph RBD client and the passphrase management system are deployed separately, that is, the related operation functions based on quantum random number cryptography are independently encapsulated in the passphrase management system for implementation, it can avoid the complex business logic in the Ceph RBD client from introducing security vulnerabilities into the related operation functions, thereby increasing the control capability of data leakage risks, and when the related operation functions are adjusted or updated, there is no need to change the business logic in the Ceph RBD client, which can reduce maintenance costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0053] Figure 1 This is a schematic diagram of the structure of an encryption system for national secret Ceph block storage based on quantum keys in an embodiment of the present application;

[0054] Figure 2 1 is a flow chart of secure interaction between a passphrase management system and a Ceph RBD client in an embodiment of the present application;

[0055] Figure 3 This is a flowchart of an implementation method of a quantum key-based national secret Ceph block storage encryption method in an embodiment of the present application;

[0056] Figure 4 This is a flowchart of another implementation method of the quantum key-based national secret Ceph block storage encryption method in the embodiment of the present application;

[0057] Figure 5 It is a schematic diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0058] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0059] Ceph is a distributed storage system. Ceph storage (also known as Ceph block storage) has become a popular choice in data centers and cloud environments due to its flexibility, high performance, strong scalability, and close integration with Internet Technology (IT) infrastructure. It is widely used by enterprises of all sizes and cloud service providers to store large amounts of sensitive or long-term valuable data.

[0060] In related technologies, Ceph mainly uses traditional encryption algorithms such as RSA encryption algorithm or ECC to encrypt and store data. For example, the Ceph RBD client uses a traditional encryption algorithm to encrypt data and then writes it to the Ceph cloud storage service for storage.

[0061] With the rapid development of quantum computing technology, these traditional encryption algorithms are at risk of being cracked by quantum computers. This makes it difficult to guarantee the security of data stored in Ceph Dynamic Block Device Dynamic Mirror (RBD) volumes, which is essentially the data stored in Ceph. Therefore, how to use quantum security technology in practical applications to ensure data storage security and make Ceph storage systems resilient to quantum attacks has become a key issue that needs to be addressed.

[0062] In response to the problems existing in the above-mentioned related technologies, the embodiments of the present application propose an encryption method and system for Ceph block storage based on quantum keys. By setting up a passphrase management system and applying quantum security technology to Ceph's encrypted storage, it can resist the cracking risks brought about by the rapid development of quantum computing, thereby ensuring the long-term security of stored data.

[0063] The following, in combination with the accompanying drawings, describes in detail the encryption method and system for the quantum key-based national secret Ceph block storage provided by the embodiments of the present application through some embodiments and their application scenarios.

[0064] First, refer to Figure 1 The figure shows a schematic diagram of the structure of an encryption system for quantum key-based Ceph block storage provided by an embodiment of the present application. The system includes a passphrase management system, a Ceph RBD client, and a Ceph cloud storage service client, wherein:

[0065] The Ceph RBD client is used to send an identity authentication request and an encryption request to the passphrase management system;

[0066] The passphrase management system is configured to obtain a quantum random number password when the Ceph RBD client passes the identity authentication associated with the encryption request, and create a data encryption key and a passphrase based on the quantum random number password;

[0067] The passphrase management system is further configured to generate a key encapsulation key based on the passphrase and a key derivation function corresponding to the passphrase, and to generate a passphrase identifier corresponding to the passphrase;

[0068] The passphrase management system is further configured to use the key encapsulation key to encrypt the data encryption key using a national secret algorithm to obtain a data encryption key ciphertext, and use the data encryption key to encrypt the write data corresponding to the encryption request using a national secret algorithm to obtain a data ciphertext;

[0069] The passphrase management system is further configured to use the data encryption key ciphertext, the key derivation function corresponding to the passphrase, and the passphrase identifier as metadata corresponding to the data ciphertext, and send the data ciphertext and the metadata corresponding to the data ciphertext to the Ceph RBD client;

[0070] The Ceph RBD client is further used to perform data encapsulation processing and data striping processing on the data ciphertext and the metadata corresponding to the data ciphertext, and send the processed data to the Ceph cloud storage service client for storage.

[0071] Among them, the national secret algorithm can adopt SM4, etc. With the help of the high security, high performance, compliance and easy integration of the national secret algorithm, the passphrase management system can realize data encryption and decryption related operations more safely and reliably.

[0072] In a specific implementation, the identity authentication request may include a user account corresponding to the Ceph RBD client, and the passphrase management system queries whether there is the user account carried in the identity authentication request among the pre-stored authorized user accounts.

[0073] If the user account carried in the authentication request exists in the pre-stored authorized user accounts, the passphrase management system determines that the Ceph RBD client passes the authentication (ie, the authentication is successful), and performs data encryption-related operations based on the encryption request.

[0074] If the user account carried in the authentication request does not exist in the pre-stored authorized user accounts, the passphrase management system determines that the Ceph RBD client has not passed the authentication (i.e., the authentication fails), and the passphrase management system does not provide data encryption-related computing services to the Ceph RBD client.

[0075] Optionally, the Ceph RBD client includes:

[0076] Ceph RBD client service, used to mount and use RBD devices, and to set and query metadata corresponding to data ciphertext;

[0077] A first quantum security service is configured to provide the Ceph RBD client service with a function of interacting with the first quantum cryptographic machine device in the form of an SDK toolkit, such as providing the ability to interact with encryption and decryption operation results;

[0078] The first quantum cryptographic machine device is used to perform quantum key management and quantum cryptographic operations. It is a device that provides quantum key management and quantum cryptographic operations functions and may include modules such as a quantum key management module and a quantum cryptographic service module, so that the quantum cryptographic machine device provides quantum cryptographic service capabilities for the Ceph RBD client service.

[0079] Optionally, the passphrase management system includes:

[0080] Passphrase management services, used to encrypt and decrypt data, and to manage the lifecycle of passphrases and keys associated with such encryption and decryption. For example, they can provide lifecycle management of keys such as the Data Encryption Key (DEK), passphrase, Key Derivation Function (KDF), and Key Encryption Key (KEK) used for data encryption and decryption. This lifecycle management includes the generation, rotation, revocation, and destruction of related keys, as well as secure storage of passphrases.

[0081] A second quantum security service is configured to provide the passphrase management service with a function for interacting with the second quantum cryptographic machine device in the form of an SDK toolkit, such as providing the ability to interact with encryption and decryption operation results;

[0082] The second quantum cryptographic machine device is used to perform quantum key management and quantum cryptographic operations. It is a device that provides quantum key management and quantum cryptographic operations functions and may include modules such as a quantum key management module and a quantum cryptographic service module, so that the quantum cryptographic machine device can provide quantum cryptographic service capabilities for the pass phrase management service.

[0083] Optionally, the Ceph cloud storage service client includes one or more object storage devices (OSD), on which an OSD storage service is deployed. The OSD storage service is responsible for key operations such as actual data storage, retrieval, replication, recovery and distribution, and can perform heartbeat checks with other OSD storage services.

[0084] Exemplarily, when the Ceph RBD client needs to write data to the Ceph cloud storage service for storage, it first initiates an identity authentication request and an encryption request to the passphrase management system through the Ceph RBD client service.

[0085] After the passphrase management system determines that the Ceph RBD client identity authentication is successful, it applies to the second quantum cryptographic machine device through the passphrase management service for a quantum random number password to create a data encryption key (DEK) and a passphrase (passphrase), and generates an ID corresponding to the passphrase (i.e., a passphrase ID, corresponding to the passphrase identifier). Furthermore, the passphrase management service selects a key derivation function (KDF) based on the passphrase, and generates a key encapsulation key (KEK) based on the key derivation function (KDF) and the passphrase (passphrase). The passphrase management service stores the DEK, KEK, passphrase, and passphrase ID in its own configured storage area for subsequent use.

[0086] The passphrase management system uses the passphrase management service to encrypt the data encryption key DEK using the key encapsulation key KEK and the SM4 algorithm to obtain the DEK ciphertext DEK_EncByKEK (i.e., data encryption key ciphertext); and uses the data encryption key DEK and the SM4 algorithm to encrypt the written data data to obtain the data ciphertext data_EncByDEK.

[0087] The passphrase management system uses the DEK_EncByKEK, KDF and passphrase ID as metadata corresponding to data_EncByDEK through the passphrase management service, and returns data_EncByDEK and metadata to the Ceph RBD client.

[0088] The Ceph RBD client encapsulates the returned data, such as encapsulating it as data_EncByDEK|metadata, where | is a string connector.

[0089] The Ceph RBD client uploads the encapsulated data to the OSD storage service in the Ceph cloud storage service after striping, such as mapping the encapsulated data into a Reliable Autonomic Distributed Object Store (RADOS) object of a specified size to implement striping processing, and saves it to the OSD storage service.

[0090] Therefore, the embodiment of the present application implements a Ceph block storage encryption mechanism based on quantum keys and national secret algorithms, which can ensure the security of data stored in Ceph RBD mirror volumes. During the data writing process, the Ceph RBD client returns the data ciphertext and the metadata corresponding to the data ciphertext to the Ceph cloud storage service client, which can resist threats such as quantum eavesdropping attacks, thereby ensuring the transmission security of the written data.

[0091] Among them, the Ceph RBD client can send the written data to the passphrase management system through an encryption request; or, when the passphrase management system returns information that the identity authentication is passed, the Ceph RBD client sends the written data to the passphrase management system. This embodiment of the present application does not impose any specific restrictions on this.

[0092] Optionally, the Ceph RBD client is further configured to send an identity authentication request and a write request to the Ceph cloud storage service client;

[0093] The Ceph RBD client is further configured to create a new image (i.e., generate the write data) upon receiving the identity authentication pass information associated with the write request returned by the Ceph cloud storage service client, and send the identity authentication request and the encryption request corresponding to the write data to the passphrase management system.

[0094] It should be noted that the identity authentication described in this application (such as the identity authentication between the Ceph RBD client and the passphrase management system, and the identity authentication between the Ceph RBD client and the Ceph cloud storage service server, etc.) can be flexibly configured according to actual needs. For example, the identity authentication request may also include a user login password. If the user login password carried in the identity authentication request is correct, the Ceph cloud storage service server determines that the Ceph RBD client has passed the identity authentication.

[0095] By adopting the technical solution of the embodiment of the present application, a passphrase management system is set up to provide the Ceph RBD client with data encryption-related operation functions based on quantum random number cryptography, thereby applying quantum security technology to Ceph's encrypted storage, so that the data stored in Ceph can resist the risk of being cracked by quantum computers, thereby ensuring the long-term security of the stored data; and an architecture in which the Ceph RBD client and the passphrase management system are separately deployed is adopted, that is, the related operation functions based on quantum random number cryptography are independently encapsulated in the passphrase management system for implementation, which can avoid the complex business logic in the Ceph RBD client from introducing security vulnerabilities into the related operation functions, thereby increasing the control capability of data leakage risks, and when the related operation functions are adjusted or updated, there is no need to change the business logic in the Ceph RBD client, which can reduce maintenance costs.

[0096] Optionally, in one embodiment, the Ceph RBD client is further configured to read target encapsulated data from the Ceph cloud storage service client and send an authentication request and a decryption request to the passphrase management system, wherein the target encapsulated data includes: target data ciphertext and target metadata corresponding to the target data ciphertext;

[0097] The passphrase management system is further configured to receive the target encapsulated data sent by the Ceph RBD client if the Ceph RBD client passes the identity authentication associated with the decryption request;

[0098] The passphrase management system is further configured to obtain the target metadata and the target data ciphertext from the target encapsulated data, and query the corresponding target passphrase based on the target passphrase identifier in the target metadata;

[0099] The passphrase management system is further configured to generate a target key encapsulation key based on the target passphrase and the target key derivation function in the target metadata, and use the target key encapsulation key to decrypt the target data encryption key ciphertext in the target metadata using a national secret algorithm to obtain the target data encryption key;

[0100] The passphrase management system is further configured to use the target data encryption key to decrypt the target data ciphertext using a national secret algorithm to obtain target data, and return the target data to the Ceph RBD client.

[0101] In a specific implementation, after the Ceph RBD client reads the target encapsulated data data_EncByDEK|metadata from the Ceph cloud storage service, it initiates an identity authentication request and a decryption request to the passphrase management system through the Ceph RBD client service.

[0102] After receiving the identity authentication passed information returned by the passphrase management system, the Ceph RBD client sends data_EncByDEK|metadata to the passphrase management system through the Ceph RBD client service.

[0103] The passphrase management system uses the passphrase management service to read the target data encryption key ciphertext DEK_EncByKEK, the target key derivation function KDF, and the target passphrase identifier passphrase ID from the target metadata; based on the target passphrase identifier passphrase ID, it finds the corresponding target passphrase passphrase, and based on the target passphrase passphrase and the target key derivation function KDF, it calculates the target key encapsulation key KEK used to encrypt the target data encryption key DEK.

[0104] Subsequently, the passphrase management service uses the target KEK and SM4 algorithm to decrypt the target DEK_EncByKEK to obtain the target DEK, and uses the target DEK to decrypt the target data ciphertext data_EncByDEK through the SM4 algorithm to obtain the data plaintext (i.e., target data), and returns the target data to the initiator of the decryption application (i.e., Ceph RBD client service). At this point, the reading and decryption process of Ceph storage data is completed.

[0105] It should be noted that, considering that Ceph block storage is often used to dynamically allocate volumes to virtual machines and other applications, that is, the data stored in Ceph needs to be frequently transmitted in the network and between different nodes, it is particularly important to ensure the security of Ceph data transmission.

[0106] In order to improve the data transmission security of Ceph, the embodiment of the present application sets a passphrase management system to encrypt and decrypt the data transmitted by the Ceph RBD client using quantum keys and national secret algorithms during the data reading and writing process described in the above embodiment, so that the data transmitted between the Ceph RBD client and the Ceph cloud storage service client are all encrypted using quantum keys and national secret algorithms. This not only ensures the data transmission security between the Ceph RBD client and the Ceph cloud storage service client, but also reduces the changes to the original architecture of the Ceph storage system and the original data reading and writing process between the Ceph RBD client and the Ceph cloud storage service client, thereby reducing the implementation cost.

[0107] Optionally, the Ceph RBD client is further configured to send an identity authentication request and a read request to the Ceph cloud storage service client;

[0108] The Ceph cloud storage service client is used to return the identity authentication pass information associated with the read request and the target encapsulated data to the Ceph RBD client when the Ceph RBD client passes the identity authentication associated with the read request.

[0109] Optionally, in one embodiment, referring to Figure 2 The flowchart of secure interaction between the passphrase management system and the Ceph RBD client is shown, wherein the system further includes: a quantum cryptography service platform for distributing symmetric keys to the Ceph RBD client and the passphrase management system; wherein:

[0110] The Ceph RBD client is further configured to, before sending read-write related data to the passphrase management system so that the passphrase management system performs encryption and decryption processing on the read-write related data, send a system authentication request to the passphrase management system as an initiator of establishing a quantum secure channel;

[0111] The Ceph RBD client is further configured to, upon receiving information indicating that the system authentication is passed returned by the passphrase management system, send a quantum key agreement request to the passphrase management system, and generate a corresponding first symmetric key identifier based on the symmetric key distributed by the quantum cryptography service platform;

[0112] The passphrase management system is further configured to, upon receiving the quantum key agreement request, generate a corresponding second symmetric key identifier based on the symmetric key, and return the second symmetric key identifier to the CephRBD client;

[0113] The Ceph RBD client is further configured to encrypt the read-write related data using a national encryption algorithm according to the first symmetric key identifier, and send the second symmetric key identifier and the encrypted read-write related data to the passphrase management system;

[0114] The passphrase management system is further configured to, upon receiving the second symmetric key identifier and the encrypted read-write related data, decrypt the encrypted read-write related data using a national secret algorithm according to the second symmetric key identifier to obtain the read-write related data;

[0115] The passphrase management system is further configured to, after encrypting and decrypting the read-write related data, use the encrypted and decrypted data obtained as return data, encrypt the return data using a national secret algorithm according to the second symmetric key identifier, and send the encrypted return data to the Ceph RBD client;

[0116] The Ceph RBD client is further used to decrypt the encrypted return data using a national encryption algorithm according to the first symmetric key identifier to obtain the return data.

[0117] In a specific implementation, when the Ceph RBD client needs to send read-write related data (such as the above-mentioned write data or target encapsulated data) to the passphrase management system, it acts as the initiator of establishing a quantum secure channel and sends a request to its own quantum security service module (QSSM) to establish a quantum secure channel with the passphrase management system through the Ceph RBD client service.

[0118] After receiving a request to establish a quantum secure channel with the passphrase management system, the QSSM (i.e., the first quantum security service) of the Ceph RBD client service initiates a system authentication request to the QSSM (i.e., the second quantum security service) of the passphrase management system. This system authentication request can carry system-related information such as the username or password for the second quantum security service to perform system authentication.

[0119] After receiving the system authentication passed information returned by the second quantum security service, the first quantum security service sends a quantum key negotiation request to the second quantum security service to perform quantum key negotiation with the second quantum security service.

[0120] Specifically, the first quantum security service and the second quantum security service each send a key request to their respective quantum hardware security modules (QHSMs). The keys in the QHSM on the first quantum security service side (i.e., the first quantum cryptographic device) and the QHSM on the second quantum security service side (i.e., the second quantum cryptographic device) are the symmetric keys QKD_key pre-distributed and injected by the quantum cryptographic service platform.

[0121] The first quantum cryptography device generates a first symmetric key identifier QKD_keyID_A corresponding to QKD_key, and the second quantum cryptography device generates a second symmetric key identifier QKD_keyID_B corresponding to QKD_key.

[0122] The first quantum cryptographic machine returns QKD_keyID_A to the first quantum security service, the second quantum cryptographic machine returns QKD_keyID_B to the second quantum security service, and the second quantum security service returns QKD_keyID_B to the first quantum security service. Thus, the key negotiation between the Ceph RBD client and the passphrase management system is completed.

[0123] The First Quantum Security Service returns the key IDs of both parties, QKD_keyID_A and QKD_keyID_B, to the Ceph RBD client service. The Ceph RBD client service then uses QKD_keyID_A (or its corresponding QKD_key) and the SM4 algorithm to encrypt the read / write data through the First Quantum Cryptography Machine, obtaining the encrypted read / write data request_EncByQKD. In the data write process, request_EncByQKD is the encrypted write data; in the data read process, request_EncByQKD is the encrypted target encapsulated data.

[0124] The Ceph RBD client service transmits request_EncByQKD and QKD_keyID_B to the passphrase management service. The passphrase management service then decrypts request_EncByQKD using QKD_keyID_B using a second quantum cryptographic machine. The passphrase management service then encrypts or decrypts the decrypted plaintext data to generate the return data response. During the data writing process, the response is the encrypted data ciphertext data_EncByDEK and the metadata corresponding to the encrypted data ciphertext. During the data reading process, the response is the target data obtained by decrypting the target data ciphertext.

[0125] The second quantum cryptography machine encrypts the response using the SM4 national encryption algorithm and QKD_keyID_B, obtaining the encrypted response data. The passphrase management service returns the encrypted response data to the Ceph RBD client service. The first quantum cryptography machine then decrypts the encrypted response data using QKD_keyID_A to obtain the plaintext response.

[0126] As a result, data transmission based on quantum secure channels is realized between the Ceph RBD client and the passphrase management system, that is, data transmission based on the national secret algorithm and the symmetric key distributed by the quantum cryptography service platform is realized, thereby ensuring the security of data transmission between the Ceph RBD client and the passphrase management system.

[0127] Optionally, the quantum cryptography service platform is also used to perform routing calculations between subnets, and to collect availability data of quantum networks and cryptographic systems.

[0128] In specific implementation, the quantum key generated by the quantum network is processed by the cryptographic system and then transmitted to the quantum cryptographic service platform. The quantum cryptographic platform collects availability data of the quantum network and the cryptographic system to determine whether the quantum key transmitted by the cryptographic system is available. After obtaining the available quantum key, the quantum cryptographic service platform transmits the quantum key to the quantum cryptographic machine devices on the passphrase management system side and the Ceph RBD client side through inter-subnet routing calculation, so that the passphrase management system and the Ceph RBD client side can conduct key negotiation when establishing a quantum secure channel.

[0129] Based on the above embodiments, the present application applies national secret algorithms and quantum security technologies (such as quantum key distribution and quantum-safe symmetric encryption algorithms) to the Ceph storage system, so that the data stored in the Ceph RBD volume can resist the cracking risks brought by quantum computing, thereby ensuring the long-term security of data storage, and can effectively resist threats such as quantum eavesdropping attacks during data transmission, ensuring the security of data frequently transmitted in different nodes or networks (such as data frequently transmitted between the passphrase management system, Ceph RBD client and Ceph cloud storage service client), thereby achieving data privacy protection; and adopting an architecture in which the Ceph RBD client and the passphrase management system are separately deployed, encapsulating quantum security technology-related functions such as key and passphrase management and cryptographic operations in the passphrase management system, which can reduce security vulnerabilities introduced by the complexity of the business logic of the Ceph RBD client, thereby increasing the risk control capability of data leakage, and making it easier to upgrade the encryption algorithm or add new security features to the quantum security technology-related functions without changing the overall business logic, thereby reducing maintenance costs.

[0130] Secondly, refer to Figure 3 FIG. 1 is a flowchart of an implementation of a quantum key-based encryption method for Ceph block storage provided by an embodiment of the present application. The quantum key-based encryption method for Ceph block storage is applied to a passphrase management system. The method may include the following steps:

[0131] Step S11: Receive the identity authentication request and encryption request sent by the Ceph RBD client;

[0132] Step S12: When the Ceph RBD client passes the identity authentication associated with the encryption request, obtain a quantum random number password, and create a data encryption key and a passphrase based on the quantum random number password;

[0133] Step S13: generating a key encapsulation key according to the passphrase and a key derivation function corresponding to the passphrase, and generating a passphrase identifier corresponding to the passphrase;

[0134] Step S14: using the key encapsulation key to encrypt the data encryption key using the national secret algorithm to obtain data encryption key ciphertext, and using the data encryption key to encrypt the write data corresponding to the encryption request using the national secret algorithm to obtain data ciphertext;

[0135] Step S15: The data encryption key ciphertext, the key derivation function corresponding to the passphrase, and the passphrase identifier are used as metadata corresponding to the data ciphertext, and the data ciphertext and the metadata corresponding to the data ciphertext are sent to the Ceph RBD client, so that the Ceph RBD client performs data encapsulation processing and data striping processing on the data ciphertext and the metadata corresponding to the data ciphertext in sequence, and sends the processed data to the Ceph cloud storage service client for storage.

[0136] By adopting the technical solution of the embodiment of the present application, a passphrase management system is set up to provide the Ceph RBD client with data encryption-related operation functions based on quantum random number cryptography, thereby applying quantum security technology to Ceph's encrypted storage, so that the data stored in Ceph can resist the risk of being cracked by quantum computers, thereby ensuring the long-term security of the stored data; and an architecture in which the Ceph RBD client and the passphrase management system are separately deployed is adopted, that is, the related operation functions based on quantum random number cryptography are independently encapsulated in the passphrase management system for implementation, which can avoid the complex business logic in the Ceph RBD client from introducing security vulnerabilities into the related operation functions, thereby increasing the control capability of data leakage risks, and when the related operation functions are adjusted or updated, there is no need to change the business logic in the Ceph RBD client, which can reduce maintenance costs.

[0137] As a possible implementation, the method further includes:

[0138] Receive an authentication request and a decryption request sent by the Ceph RBD client;

[0139] When the Ceph RBD client passes the identity authentication associated with the decryption request, receiving target encapsulated data sent by the Ceph RBD client, where the target encapsulated data is read by the Ceph RBD client from the Ceph cloud storage service client, and the target encapsulated data includes: target data ciphertext and target metadata corresponding to the target data ciphertext;

[0140] Obtaining the target metadata and the target data ciphertext from the target encapsulated data, and querying the corresponding target passphrase according to the target passphrase identifier in the target metadata;

[0141] Generate a target key encapsulation key based on the target passphrase and the target key derivation function in the target metadata, and use the target key encapsulation key to decrypt the target data encryption key ciphertext in the target metadata using a national secret algorithm to obtain the target data encryption key;

[0142] The target data encryption key is used to decrypt the target data ciphertext through the national secret algorithm to obtain the target data, and the target data is returned to the Ceph RBD client.

[0143] As a possible implementation, the method further includes:

[0144] Receive a system authentication request sent by the Ceph RBD client;

[0145] If the Ceph RBD client passes the system authentication, return the system authentication pass information to the Ceph RBD client;

[0146] Receiving a quantum key agreement request sent by the Ceph RBD client;

[0147] Generate a corresponding second symmetric key identifier based on the symmetric key pre-distributed by the quantum cryptography service platform, and return the second symmetric key identifier to the Ceph RBD client;

[0148] Receive the second symmetric key identifier and the encrypted read-write related data sent by the Ceph RBD client, where the encrypted read-write related data is encrypted by the Ceph RBD client according to the first symmetric key identifier and the national secret algorithm, and the first symmetric key identifier is generated by the Ceph RBD client according to the symmetric key;

[0149] Decrypting the encrypted read-write related data using a national secret algorithm according to the second symmetric key identifier to obtain the read-write related data;

[0150] After the read-write related data is encrypted and decrypted, the encrypted and decrypted data is used as the return data, and the return data is encrypted by the national secret algorithm according to the second symmetric key identifier, and the encrypted return data is sent to the Ceph RBD client so that

[0151] The Ceph RBD client decrypts the encrypted return data using a national encryption algorithm according to the first symmetric key identifier to obtain the return data.

[0152] Optionally, the passphrase management system includes:

[0153] Passphrase management service, used to perform encryption and decryption of data, and to manage the lifecycle of passphrases and keys associated with the encryption and decryption processes;

[0154] A second quantum security service is configured to provide the passphrase management service with a function of interacting with the second quantum cryptography machine device in the form of an SDK toolkit;

[0155] The second quantum cryptography machine is used for quantum key management and quantum cryptography operations.

[0156] It should be noted that the encryption method embodiment of the quantum key-based national secret Ceph block storage provided in the embodiment of the present application corresponds to the relevant embodiment of the passphrase management system in the encryption system of the quantum key-based national secret Ceph block storage described in the first aspect. To avoid repetition, it will not be repeated here.

[0157] Thirdly, refer to Figure 4 As shown in FIG, it is an implementation flow chart of another quantum key-based national secret Ceph block storage encryption method provided in an embodiment of the present application. The quantum key-based national secret Ceph block storage encryption method is applied to the Ceph RBD client. The method may include the following steps:

[0158] Step S21: sending an identity authentication request and an encryption request to the passphrase management system;

[0159] Step S22: upon receiving identity authentication success information associated with the encryption request sent by the passphrase management system, sending write data corresponding to the encryption request to the passphrase management system;

[0160] Step S23: receiving the data ciphertext and metadata corresponding to the data ciphertext sent by the passphrase management system;

[0161] Step S24: performing data encapsulation processing and data striping processing on the data ciphertext and the metadata corresponding to the data ciphertext, and sending the processed data to the Ceph cloud storage service for storage.

[0162] The data ciphertext is obtained by encrypting the written data using a data encryption key by the passphrase management system through a national secret algorithm; the metadata corresponding to the data ciphertext includes a data encryption key ciphertext, a key derivation function corresponding to the passphrase, and a passphrase identifier; the data encryption key and the passphrase are created by the passphrase management system based on a quantum random number cipher; the data encryption key ciphertext is obtained by encrypting the data encryption key using a key encapsulation key by the passphrase management system through a national secret algorithm; the key encapsulation key is generated by the passphrase management system based on the passphrase and the key derivation function corresponding to the passphrase.

[0163] By adopting the technical solution of the embodiment of the present application, a passphrase management system is set up to provide the Ceph RBD client with data encryption-related operation functions based on quantum random number cryptography, thereby applying quantum security technology to Ceph's encrypted storage, so that the data stored in Ceph can resist the risk of being cracked by quantum computers, thereby ensuring the long-term security of the stored data; and an architecture in which the Ceph RBD client and the passphrase management system are separately deployed is adopted, that is, the related operation functions based on quantum random number cryptography are independently encapsulated in the passphrase management system for implementation, which can avoid the complex business logic in the Ceph RBD client from introducing security vulnerabilities into the related operation functions, thereby increasing the control capability of data leakage risks, and when the related operation functions are adjusted or updated, there is no need to change the business logic in the Ceph RBD client, which can reduce maintenance costs.

[0164] As a possible implementation, the method further includes:

[0165] Reading target encapsulated data from the Ceph cloud storage service client, and sending an identity authentication request and a decryption request to the passphrase management system, the target encapsulated data including: target data ciphertext and target metadata corresponding to the target data ciphertext;

[0166] When the Ceph RBD client passes the identity authentication associated with the decryption request, the target encapsulated data is sent to the passphrase management system so that

[0167] The passphrase management system obtains the target metadata and the target data ciphertext from the target encapsulated data, and queries the corresponding target passphrase according to the target passphrase identifier in the target metadata, generates a target key encapsulation key according to the target passphrase and the target key derivation function in the target metadata, uses the target key encapsulation key to decrypt the target data encryption key ciphertext in the target metadata through the national secret algorithm to obtain the target data encryption key, uses the target data encryption key to decrypt the target data ciphertext through the national secret algorithm to obtain the target data, and returns the target data to the Ceph RBD client.

[0168] As a possible implementation, the method further includes:

[0169] Send an authentication request and a read request to the Ceph cloud storage service client to enable

[0170] When the Ceph RBD client passes the identity authentication associated with the read request, the Ceph cloud storage service client returns the identity authentication pass information associated with the read request and the target encapsulated data to the Ceph RBD client.

[0171] As a possible implementation, the method further includes:

[0172] Before sending read-write related data to the passphrase management system so that the passphrase management system performs encryption and decryption processing on the read-write related data, as the initiator of establishing the quantum secure channel, sending a system authentication request to the passphrase management system;

[0173] Upon receiving the system authentication passing information returned by the passphrase management system, sending a quantum key agreement request to the passphrase management system, and generating a corresponding first symmetric key identifier according to the symmetric key distributed by the quantum cryptography service platform;

[0174] receiving a second symmetric key identifier sent by the passphrase management system, where the second symmetric key identifier is generated by the passphrase management system according to the symmetric key;

[0175] According to the first symmetric key identifier, the read-write related data is encrypted by the national secret algorithm, and the second symmetric key identifier and the encrypted read-write related data are sent to the passphrase management system so that

[0176] The passphrase management system decrypts the encrypted read-write related data using the national secret algorithm according to the second symmetric key identifier to obtain the read-write related data, and after encrypting and decrypting the read-write related data, uses the obtained encrypted and decrypted data as return data, encrypts the return data using the national secret algorithm according to the second symmetric key identifier, and sends the encrypted return data to the Ceph RBD client;

[0177] When the encrypted return data returned by the passphrase management system is received, the encrypted return data is decrypted using a national secret algorithm according to the first symmetric key identifier to obtain the return data.

[0178] As a possible implementation, the method further includes:

[0179] Send an authentication request and a write request to the Ceph cloud storage service client;

[0180] Upon receiving the identity authentication pass information associated with the write request returned by the Ceph cloud storage service client, the write data is generated, and the identity authentication request and the encryption request corresponding to the write data are sent to the passphrase management system.

[0181] Optionally, the Ceph RBD client includes:

[0182] Ceph RBD client service, used to mount and use RBD devices, and to set and query metadata corresponding to data ciphertext;

[0183] A first quantum security service is configured to provide the Ceph RBD client service with a function of interacting with the first quantum cryptography machine device in the form of an SDK toolkit;

[0184] The first quantum cryptography machine device is used for quantum key management and quantum cryptography operations.

[0185] It should be noted that the encryption method embodiment of the quantum key-based national secret Ceph block storage provided in the embodiment of the present application corresponds to the relevant embodiment of the Ceph RBD client in the encryption system of the quantum key-based national secret Ceph block storage described in the first aspect. To avoid repetition, it will not be repeated here.

[0186] For the sake of simplicity, the method embodiments are described as a series of action combinations. However, those skilled in the art should be aware that the embodiments of the present application are not limited by the order of the actions described, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0187] The present application also provides an electronic device, Figure 5 , Figure 5 Schematic diagram of the electronic device proposed in the embodiment of the present application. Figure 5 As shown, the electronic device 100 includes: a memory 110 and a processor 120. The memory 110 and the processor 120 are connected via a bus communication. A computer program is stored in the memory 110. The computer program can be run on the processor 120 to implement the steps in the encryption method of the national secret Ceph block storage based on quantum key disclosed in the embodiment of the present application.

[0188] An embodiment of the present application also provides a computer-readable storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, it implements the encryption method of the national secret Ceph block storage based on quantum key as disclosed in the embodiment of the present application.

[0189] An embodiment of the present application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the encryption method of the national secret Ceph block storage based on quantum key as disclosed in the embodiment of the present application.

[0190] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0191] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "includes," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or terminal device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or elements that are inherent to such process, method, article, or terminal device. In the absence of further restrictions, an element defined by the phrase "comprises a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that includes the element.

[0192] The above is a detailed introduction to the encryption method and system for quantum key-based national secret Ceph block storage provided by this application. Specific examples are used in this article to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method of this application and its core idea; at the same time, for general technical personnel in this field, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on this application.

Claims

1. An encryption system for Ceph block storage based on quantum keys, characterized in that: It includes a passphrase management system, Ceph RBD client, and Ceph cloud storage service client, including: The Ceph RBD client is used to send an identity authentication request and an encryption request to the passphrase management system; The passphrase management system is configured to obtain a quantum random number password when the Ceph RBD client passes the identity authentication associated with the encryption request, and create a data encryption key and a passphrase based on the quantum random number password; The passphrase management system is further configured to generate a key encapsulation key based on the passphrase and a key derivation function corresponding to the passphrase, and to generate a passphrase identifier corresponding to the passphrase; The passphrase management system is further configured to use the key encapsulation key to encrypt the data encryption key using a national secret algorithm to obtain a data encryption key ciphertext, and use the data encryption key to encrypt the write data corresponding to the encryption request using a national secret algorithm to obtain a data ciphertext; The passphrase management system is further configured to use the data encryption key ciphertext, the key derivation function corresponding to the passphrase, and the passphrase identifier as metadata corresponding to the data ciphertext, and send the data ciphertext and the metadata corresponding to the data ciphertext to the Ceph RBD client; The Ceph RBD client is further used to perform data encapsulation processing and data striping processing on the data ciphertext and the metadata corresponding to the data ciphertext, and send the processed data to the Ceph cloud storage service client for storage.

2. The system according to claim 1, wherein: The Ceph RBD client is further configured to read target encapsulated data from the Ceph cloud storage service client and send an authentication request and a decryption request to the passphrase management system, wherein the target encapsulated data includes: target data ciphertext and target metadata corresponding to the target data ciphertext; The passphrase management system is further configured to receive the target encapsulated data sent by the Ceph RBD client if the Ceph RBD client passes the identity authentication associated with the decryption request; The passphrase management system is further configured to obtain the target metadata and the target data ciphertext from the target encapsulated data, and query the corresponding target passphrase based on the target passphrase identifier in the target metadata; The passphrase management system is further configured to generate a target key encapsulation key based on the target passphrase and the target key derivation function in the target metadata, and use the target key encapsulation key to decrypt the target data encryption key ciphertext in the target metadata using a national secret algorithm to obtain the target data encryption key; The passphrase management system is further configured to use the target data encryption key to decrypt the target data ciphertext using a national secret algorithm to obtain target data, and return the target data to the Ceph RBD client.

3. The system according to claim 2, characterized in that The Ceph RBD client is further configured to send an authentication request and a read request to the Ceph cloud storage service client; The Ceph cloud storage service client is used to return the identity authentication pass information associated with the read request and the target encapsulated data to the Ceph RBD client when the Ceph RBD client passes the identity authentication associated with the read request.

4. The system according to claim 1, wherein: The system further includes: a quantum cryptography service platform for distributing symmetric keys to the Ceph RBD client and the passphrase management system; wherein: The Ceph RBD client is further configured to, before sending read-write related data to the passphrase management system so that the passphrase management system performs encryption and decryption processing on the read-write related data, send a system authentication request to the passphrase management system as an initiator of establishing a quantum secure channel; The Ceph RBD client is further configured to, upon receiving information indicating that the system authentication is passed returned by the passphrase management system, send a quantum key agreement request to the passphrase management system, and generate a corresponding first symmetric key identifier based on the symmetric key distributed by the quantum cryptography service platform; The passphrase management system is further configured to, upon receiving the quantum key agreement request, generate a corresponding second symmetric key identifier based on the symmetric key, and return the second symmetric key identifier to the Ceph RBD client; The Ceph RBD client is further configured to encrypt the read-write related data using a national encryption algorithm according to the first symmetric key identifier, and send the second symmetric key identifier and the encrypted read-write related data to the passphrase management system; The passphrase management system is further configured to, upon receiving the second symmetric key identifier and the encrypted read-write related data, decrypt the encrypted read-write related data using a national secret algorithm according to the second symmetric key identifier to obtain the read-write related data; The passphrase management system is further configured to, after encrypting and decrypting the read-write related data, use the encrypted and decrypted data obtained as return data, encrypt the return data using a national secret algorithm according to the second symmetric key identifier, and send the encrypted return data to the Ceph RBD client; The Ceph RBD client is further used to decrypt the encrypted return data using a national encryption algorithm according to the first symmetric key identifier to obtain the return data.

5. The system according to claim 4, characterized in that The quantum cryptography service platform is also used to perform routing calculations between subnets and to collect availability data of quantum networks and cryptographic systems.

6. The system according to claim 1, wherein: The Ceph RBD client is further configured to send an authentication request and a write request to the Ceph cloud storage service client; The Ceph RBD client is further configured to, upon receiving identity authentication success information associated with the write request returned by the Ceph cloud storage service client, generate the write data and send the identity authentication request and an encryption request corresponding to the write data to the passphrase management system.

7. The system according to any one of claims 1 to 6, characterized in that: The Ceph RBD client includes: Ceph RBD client service, used to mount and use RBD devices, and to set and query metadata corresponding to data ciphertext; The first quantum security service is used to provide the Ceph RBD client service with the function of interacting with the first quantum cryptography machine device in the form of an SDK toolkit; The first quantum cryptography machine device is used for quantum key management and quantum cryptography operations.

8. The system according to any one of claims 1 to 6, characterized in that: The passphrase management system includes: Passphrase management service, used to perform encryption and decryption of data, and to manage the lifecycle of passphrases and keys associated with the encryption and decryption processes; A second quantum security service is used to provide the passphrase management service with a function of interacting with a second quantum cryptography machine device in the form of an SDK toolkit; The second quantum cryptography machine is used for quantum key management and quantum cryptography operations.

9. An encryption method for Ceph block storage based on quantum key, characterized in that: Applied to a passphrase management system, the method includes: Receive authentication and encryption requests from Ceph RBD clients; When the Ceph RBD client passes the identity authentication associated with the encryption request, obtaining a quantum random number password, and creating a data encryption key and a passphrase based on the quantum random number password; generating a key encapsulation key according to the passphrase and a key derivation function corresponding to the passphrase, and generating a passphrase identifier corresponding to the passphrase; Using the key encapsulation key, encrypting the data encryption key using a national secret algorithm to obtain a data encryption key ciphertext, and using the data encryption key, encrypting the write data corresponding to the encryption request using a national secret algorithm to obtain a data ciphertext; The data encryption key ciphertext, the key derivation function corresponding to the passphrase, and the passphrase identifier are used as metadata corresponding to the data ciphertext, and the data ciphertext and the metadata corresponding to the data ciphertext are sent to the Ceph RBD client, so that the Ceph RBD client performs data encapsulation processing and data striping processing on the data ciphertext and the metadata corresponding to the data ciphertext in sequence, and sends the processed data to the Ceph cloud storage service client for storage.

10. An encryption method for Ceph block storage based on quantum key, characterized in that: Applied to a Ceph RBD client, the method includes: Sending identity authentication and encryption requests to the passphrase management system; Upon receiving identity authentication success information associated with the encryption request sent by the passphrase management system, sending write data corresponding to the encryption request to the passphrase management system; receiving a data ciphertext and metadata corresponding to the data ciphertext sent by the passphrase management system; The data ciphertext and the metadata corresponding to the data ciphertext are sequentially encapsulated and striped, and the processed data is sent to the Ceph cloud storage service for storage; The data ciphertext is obtained by encrypting the written data using a data encryption key by the passphrase management system through a national secret algorithm; the metadata corresponding to the data ciphertext includes a data encryption key ciphertext, a key derivation function corresponding to the passphrase, and a passphrase identifier; the data encryption key and the passphrase are created by the passphrase management system based on a quantum random number cipher; the data encryption key ciphertext is obtained by encrypting the data encryption key using a key encapsulation key by the passphrase management system through a national secret algorithm; the key encapsulation key is generated by the passphrase management system based on the passphrase and the key derivation function corresponding to the passphrase.

Images