Network system for global quantum security protection

Abstract

The invention relates to the technical field of information security, in particular to a global quantum security protection network system. According to the scheme, the quantum security service system is adopted and comprises the quantum security server, the access base station and the key center, so that quantum encryption and decryption processing of the service data is realized, the security of data transmission is effectively improved, data leakage and tampering are prevented, and the information security of a network system is guaranteed. The provincial center serves as a main machine room and is responsible for receiving data reports of gateway network elements of the city and managing the data reports, the backup center receives data backups of the provincial center, a data backup special line and a multiplexing line are adopted, and stability and reliability of data backup are ensured. City client systems can access the network management system of the provincial center through remote browsing, so that the service interaction between clients and the provincial center is facilitated, and the service processing efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a network system with global quantum security protection. Background Art

[0002] In today's information age, the security of network systems is crucial to protecting sensitive information and maintaining stable system operation. As network attack methods become increasingly complex and the limitations of traditional encryption technology gradually emerge, finding a more secure means of communication has become an urgent need. In this context, encryption technology based on the principles of quantum mechanics has emerged, providing a communication method that is theoretically unbreakable.

[0003] Existing network management systems generally adopt a centralized architecture, in which the provincial center serves as the main computer room, responsible for receiving and managing data from gateway network elements in various cities. At the same time, in order to ensure the integrity of the data and the continuity of the system, a backup center is usually set up to back up the data. However, the existing data backup transmission lines, whether dedicated lines or multiplexed lines, have certain security risks, especially on multiplexed lines, the mixed use of data backup and client access may increase the risk of data leakage.

[0004] The client systems of cities and prefectures usually access the network management system of the provincial center through remote browsing. This access method may not be sufficient to resist advanced network attacks under traditional encryption technology. Therefore, how to improve the security of the network system while maintaining the existing network architecture and user operation habits has become a technical problem.

[0005] At present, although some security service systems based on quantum principles have been proposed, they still face challenges in integrating into existing network management systems, achieving efficient data encryption transmission and key management. In particular, how to achieve an efficient and secure communication method in the existing network infrastructure while simplifying the key management process is an urgent problem to be solved in the field of network security technology. Summary of the invention

[0006] To solve the above problems, this application discloses a network system for global quantum security protection, including a provincial center, a prefecture-level client system, and a backup center;

[0007] The provincial center serves as the main computer room, receiving and managing data reports from gateway network elements in cities and prefectures;

[0008] The backup center is used to receive data backup from the provincial center. The data backup transmission lines include: a dedicated data backup line and a multiplexed line; the multiplexed line is used for data backup and client access.

[0009] Client systems in various cities access the network management system of the provincial center through remote browsing;

[0010] The network management system of the provincial center includes a network server and a quantum security service system. The quantum security service system includes: a quantum security server, an access base station and a key center. The quantum security server is respectively communicated with the access base station and the key center. The network server is connected to the quantum security server, and business data is transmitted between the client and the network server through the quantum security server. Quantum encryption and decryption processing is provided for business service data, and quantum keys used for encryption and decryption are managed.

[0011] The quantum security service system is connected to the access switch via a communication agent;

[0012] The quantum security server of the quantum security service system corresponds to multiple network servers; each of the network servers is connected to the quantum security server through an independent network card; and the quantum security server is connected to each network port IP of the corresponding network server as a network server gateway; the communication agent is connected to each network port IP of the access switch as the corresponding network server address;

[0013] The quantum security server further includes an isolation module, which is used for data filtering. Non-network management clients, backup data, and network element data of city and district gateways are not quantum-protected and are directly released.

[0014] The provincial center includes at least two sets of quantum security service systems, and the quantum security servers in each of the quantum security service systems are connected to the core switch through a communication agent and a firewall; the quantum security servers in the two quantum security service systems are in a master-slave relationship with each other, and the quantum security servers in the two quantum security service systems synchronize quantum keys in real time;

[0015] The network port of the access switch connected to the quantum security server serves as the gateway of the access switch, and the network port of the core switch connected to the communication agent serves as the gateway of the core switch, so as not to change the original networking relationship, routing configuration and firewall policy.

[0016] The backup center includes a first computer room and a second computer room, wherein the first computer room is connected to the main computer room of the provincial center through a dedicated communication line; the second computer room is connected to the client system of the prefecture-level city through a multiplexed line;

[0017] The backup network servers of the first and second computer rooms are connected to the quantum security server of the backup center, and the quantum security server is connected to the access switch between the main computer rooms through a communication agent;

[0018] The quantum security server of the backup center, the key center of the main computer room and the access base station constitute a quantum security service system; the supplementary quantum key is obtained through the key center of the provincial center, and the quantum key is relayed through the access base station of the provincial center.

[0019] The backup center includes a first computer room and a second computer room, wherein the first computer room is connected to the main computer room of the provincial center through a dedicated communication line; the second computer room is connected to the client system of the prefecture-level city through a multiplexed line;

[0020] The backup network servers in the first and second computer rooms are connected to the quantum security server in the backup center, the quantum security server is connected to the core switch through a communication agent and a firewall, and the backup management server is connected to the quantum security server through an access switch;

[0021] The quantum security server of the backup center, the key center of the main computer room and the access base station constitute a quantum security service system; the supplementary quantum key is obtained through the key center of the provincial center, and the quantum key is relayed through the access base station of the provincial center;

[0022] The access switch network port connected to the quantum security server serves as the gateway of the access switch, and the communication agent connects to the core switch network port as the gateway of the core switch, thereby ensuring that the original networking relationship, routing configuration, and firewall policy are not changed.

[0023] The local client system includes a quantum security all-in-one machine, a quantum security encryption box or a quantum security server.

[0024] The quantum security all-in-one machine, i.e., the quantum security privacy computer, directly provides users with a quantum encryption privacy environment, where users can directly access the network management system through quantum security encryption. Non-secure network access can be achieved by connecting an existing computer to the privacy computer. The privacy computer has a built-in KVM switching function, which allows users to switch freely between the privacy environment and the existing computer.

[0025] The quantum security encryption box is connected to the existing terminal in an external way. All data accessed by the user terminal through the encryption box will be sent out after being quantum securely encrypted. The user's office environment is still the original terminal equipment, and the data communicated by the existing network management client to the outside is encrypted and protected by the quantum security encryption box;

[0026] Quantum security server, for the security access requirements of large traffic, can be used as quantum security encryption protection. Its function for the terminal is the same as that of the quantum security encryption box.

[0027] The solution of this application realizes quantum encryption and decryption processing of business data by adopting a quantum security service system, including a quantum security server, an access base station and a key center, effectively improving the security of data transmission, preventing data leakage and tampering, and ensuring the information security of the network system. As the main computer room, the provincial center is responsible for receiving and managing the data reports of the gateway network elements of each city, and the backup center receives the data backup of the provincial center, using dedicated lines and multiplexing lines for data backup to ensure the stability and reliability of data backup. The client systems of various cities can access the network management system of the provincial center through remote browsing, which facilitates the business interaction between the client and the provincial center and improves the business processing efficiency. The multiplexing line is used for both data backup and client access, realizing the rational use of line resources and reducing the cost of network construction and operation and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a schematic diagram of the structure of a provincial center in an embodiment of the present application;

[0029] Figure 2 This is a schematic diagram of the structure of another provincial center in the embodiment of the present application;

[0030] Figure 3 This is a schematic diagram of the structure of a backup center in an embodiment of the present application;

[0031] Figure 4 This is a schematic diagram of the structure of another backup center in an embodiment of the present application. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0033] Example: Figure 1-4 As shown, a network system with global quantum security protection includes a provincial center, a prefecture-level client system, and a backup center;

[0034] The provincial center serves as the main computer room, receiving and managing data reports from gateway network elements in cities and prefectures. Specifically, it serves as the core management node, responsible for collecting, processing and storing data from gateway network elements in cities and prefectures, and conducting centralized monitoring and management.

[0035] The backup center is used to receive data backup from the provincial center. The data backup transmission lines include: dedicated data backup lines and multiplexed lines; the multiplexed lines are used for data backup and client access. The backup center is used to ensure data security and receive data backup from the provincial center so that it can be quickly restored when a provincial center fails.

[0036] Composition: includes backup servers, storage devices, backup lines, etc.

[0037] Client systems in various cities access the network management system of the provincial center through remote browsing;

[0038] The prefecture-level client system is responsible for reporting data to the local gateway network element, and accesses the provincial center's network management system through remote browsing to query and operate data. Specifically, it includes client computers, gateway devices, local databases, etc.

[0039] The network management system of the provincial center includes a network server and a quantum security service system. The quantum security service system includes: a quantum security server, an access base station and a key center. The quantum security server is respectively communicated with the access base station and the key center. The network server is connected to the quantum security server, and business data is transmitted between the client and the network server through the quantum security server. Quantum encryption and decryption processing is provided for business service data, and quantum keys used for encryption and decryption are managed.

[0040] Among them, the dedicated data backup line is used to transmit data backup from the provincial center to the backup center to ensure the real-time and security of data transmission.

[0041] Multiplexing lines: used for both data backup and client access. They can be used for client access outside the backup period to improve line utilization.

[0042] In this embodiment, the key center generates a quantum random number key through a quantum true random number generator; when encrypting, data can be encrypted using methods such as XOR or AES.

[0043] The specific process includes:

[0044] The gateway network elements in prefectures and cities report the data to the provincial central network server;

[0045] The provincial central network server transmits the data to the quantum security server;

[0046] The quantum security server performs quantum encryption on the data and transmits it to the client;

[0047] The client uses the quantum key to decrypt the encrypted data and obtain the original data.

[0048] By using quantum encryption technology, the security of data transmission can be ensured. The provincial center is responsible for the data management of the gateway network elements in the prefectures and cities to improve the efficiency of operation and maintenance. The backup center uses dedicated lines and multiplexed lines to ensure the real-time nature of data backup and line utilization. The client systems in prefectures and cities can easily access the quantum security service system to achieve quantum encryption communication.

[0049] In a possible implementation, the quantum security service system is connected to an access switch via a communication agent;

[0050] The quantum security server of the quantum security service system corresponds to multiple network servers; each of the network servers is connected to the quantum security server through an independent network card; and the quantum security server is connected to each network port IP of the corresponding network server as a network server gateway; the communication agent is connected to each network port IP of the access switch as the corresponding network server address;

[0051] The quantum security server further includes an isolation module, which is used for data filtering. Non-network management clients, backup data, and network element data of city and district gateways are not quantum-protected and are directly released.

[0052] The communication agent acts as a bridge between the quantum security server and the access switch, responsible for forwarding and receiving data packets. The communication agent connects to each network port IP of the access switch as the address of the corresponding network server. The access switch can correctly forward the data to the corresponding network server.

[0053] The quantum security service system is connected to the access switch through a communication agent, which can realize data exchange between the quantum security server and the network server.

[0054] The access switch is responsible for forwarding data from the network server to the quantum security server, and forwarding data from the quantum security server to the network server.

[0055] The quantum security server corresponds to multiple network servers, that is, one quantum security server can serve multiple network servers. Each network server is connected to the quantum security server through an independent network card to ensure the independence and security of data transmission. The quantum security server connects to the network port IP of each network server and serves as the gateway of the network server. All data entering and leaving the network server needs to be routed through the quantum security server.

[0056] The isolation module is used to filter data and decide whether to perform quantum security protection based on the data source and type. For data from non-network management clients, backup data, and gateway network data in cities and counties, the isolation module will not apply quantum security protection, but will directly release it. These data may not require quantum-level security protection, and directly releasing them can save resources and improve data processing efficiency. Some data may need to be transmitted in plain text or use traditional encryption methods. The isolation module allows these data to be processed in the original way.

[0057] Through the above solutions, the quantum security service system achieves the following advantages:

[0058] Through the communication agent and access switch, effective communication between the quantum security server and multiple network servers is achieved. As the gateway of the network server, the quantum security server ensures the security of data transmission. The isolation module allows the system to select the appropriate security strategy according to the data type and source, which not only ensures security but also improves the flexibility of the system.

[0059] Correspondingly, the backup center includes a first computer room and a second computer room, wherein the first computer room is connected to the main computer room of the provincial center through a dedicated communication line; the second computer room is connected to the prefecture-level client system through a multiplexed line;

[0060] The backup network servers of the first and second computer rooms are connected to the quantum security server of the backup center, and the quantum security server is connected to the access switch between the main computer rooms through a communication agent;

[0061] The quantum security server of the backup center, the key center of the main computer room and the access base station constitute a quantum security service system; the supplementary quantum key is obtained through the key center of the provincial center, and the quantum key is relayed through the access base station of the provincial center.

[0062] In another possible implementation, the provincial center includes at least two quantum security service systems, and the quantum security servers in each of the quantum security service systems are connected to the core switch through a communication agent and a firewall; the quantum security servers in the two quantum security service systems are in a master-slave relationship with each other, and the quantum security servers in the two quantum security service systems synchronize quantum keys in real time;

[0063] The network port of the access switch connected to the quantum security server serves as the gateway of the access switch, and the network port of the core switch connected to the communication agent serves as the gateway of the core switch, so as not to change the original networking relationship, routing configuration and firewall policy.

[0064] The provincial center includes at least two quantum security service systems to improve the reliability and availability of the system. The quantum security server is connected to the core switch through a communication agent and a firewall. This connection method ensures the security and stability of data during transmission.

[0065] The communication agent is responsible for forwarding data packets between the quantum security server and the core switch.

[0066] Firewalls are used to protect quantum secure servers from unauthorized access and attacks.

[0067] The quantum security servers in the two quantum security service systems are in a master-backup relationship with each other, that is, one server runs as the main server and the other as the backup server.

[0068] The quantum keys are synchronized in real time between the two sets of quantum security servers, ensuring that when the main server fails, the backup server can take over immediately without affecting the continuity and security of encrypted communications.

[0069] The network port of the access switch connected to the quantum security server serves as the gateway of the access switch. All data entering and leaving the access switch must pass through the quantum security server. The network port of the communication proxy connected to the core switch serves as the gateway of the core switch, so that the core switch can correctly forward data to the quantum security server.

[0070] Through the above gateway settings, the system realizes seamless integration of quantum security services without changing the original network networking relationship, routing configuration and firewall strategy. It helps to reduce the complexity and potential risks of deployment while ensuring the stable operation of the network.

[0071] The backup center includes a first computer room and a second computer room, wherein the first computer room is connected to the main computer room of the provincial center through a dedicated communication line; the second computer room is connected to the client system of the prefecture-level city through a multiplexed line;

[0072] The backup network servers in the first and second computer rooms are connected to the quantum security server in the backup center, the quantum security server is connected to the core switch through a communication agent and a firewall, and the backup management server is connected to the quantum security server through an access switch;

[0073] The quantum security server of the backup center, the key center of the main computer room and the access base station constitute a quantum security service system; the supplementary quantum key is obtained through the key center of the provincial center, and the quantum key is relayed through the access base station of the provincial center;

[0074] The access switch network port connected to the quantum security server serves as the gateway of the access switch, and the communication agent connects to the core switch network port as the gateway of the core switch, thereby ensuring that the original networking relationship, routing configuration, and firewall policy are not changed.

[0075] The local client system includes a quantum security all-in-one machine, a quantum security encryption box or a quantum security server.

[0076] The quantum security all-in-one machine, i.e., the quantum security privacy computer, directly provides users with a quantum encryption privacy environment, where users can directly access the network management system through quantum security encryption. Non-secure network access can be achieved by connecting an existing computer to the privacy computer. The privacy computer has a built-in KVM switching function, which allows users to switch freely between the privacy environment and the existing computer.

[0077] The quantum security encryption box is connected to the existing terminal in an external way. All data accessed by the user terminal through the encryption box will be sent out after being quantum securely encrypted. The user's office environment is still the original terminal equipment, and the data communicated by the existing network management client to the outside is encrypted and protected by the quantum security encryption box;

[0078] Quantum security server, for the security access requirements of large traffic, can be used as quantum security encryption protection. Its function for the terminal is the same as that of the quantum security encryption box.

[0079] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A network system with global quantum security protection, characterized in that: Including provincial centers, prefecture-level and municipal client systems and backup centers; The provincial center serves as the main computer room, receiving and managing data reports from gateway network elements in cities and prefectures; The backup center is used to receive data backup from the provincial center. The data backup transmission lines include: a dedicated data backup line and a multiplexed line; the multiplexed line is used for data backup and client access. Client systems in various cities access the network management system of the provincial center through remote browsing; The network management system of the provincial center includes a network server and a quantum security service system. The quantum security service system includes: a quantum security server, an access base station and a key center. The quantum security server is respectively communicated with the access base station and the key center. The network server is connected to the quantum security server, and business data is transmitted between the client and the network server through the quantum security server. Quantum encryption and decryption processing is provided for business service data, and quantum keys used for encryption and decryption are managed.

2. The system according to claim 1, characterized in that The quantum security service system is connected to the access switch via a communication agent; The quantum security server of the quantum security service system corresponds to multiple network servers; each of the network servers is connected to the quantum security server through an independent network card; In addition, the quantum security server connects to each network port IP of the corresponding network server as the network server gateway; the communication proxy connects to each network port IP of the access switch as the corresponding network server address; The quantum security server further includes an isolation module, which is used for data filtering. Non-network management clients, backup data, and network element data of city and district gateways are not quantum-protected and are directly released.

3. The system according to claim 1, characterized in that The provincial center includes at least two sets of quantum security service systems, and the quantum security servers in each of the quantum security service systems are connected to the core switch through a communication agent and a firewall; the quantum security servers in the two quantum security service systems are in a master-slave relationship with each other, and the quantum security servers in the two quantum security service systems synchronize quantum keys in real time; The network port of the access switch connected to the quantum security server serves as the gateway of the access switch, and the network port of the core switch connected to the communication agent serves as the gateway of the core switch, so as not to change the original networking relationship, routing configuration and firewall policy.

4. The system according to claim 2, characterized in that The backup center includes a first computer room and a second computer room, wherein the first computer room is connected to the main computer room of the provincial center through a dedicated communication line; the second computer room is connected to the client system of the prefecture-level city through a multiplexed line; The backup network servers of the first and second computer rooms are connected to the quantum security server of the backup center, and the quantum security server is connected to the access switch between the main computer rooms through a communication agent; The quantum security server of the backup center, the key center of the main computer room and the access base station constitute a quantum security service system; the supplementary quantum key is obtained through the key center of the provincial center, and the quantum key is relayed through the access base station of the provincial center.

5. The system according to claim 2, characterized in that The backup center includes a first computer room and a second computer room, wherein the first computer room is connected to the main computer room of the provincial center through a dedicated communication line; the second computer room is connected to the client system of the prefecture-level city through a multiplexed line; The backup network servers in the first and second computer rooms are connected to the quantum security server in the backup center, the quantum security server is connected to the core switch through a communication agent and a firewall, and the backup management server is connected to the quantum security server through an access switch; The quantum security server of the backup center, the key center of the main computer room and the access base station constitute a quantum security service system; the supplementary quantum key is obtained through the key center of the provincial center, and the quantum key is relayed through the access base station of the provincial center; The access switch network port connected to the quantum security server serves as the gateway of the access switch, and the communication agent connects to the core switch network port as the gateway of the core switch, thereby ensuring that the original networking relationship, routing configuration, and firewall policy are not changed.

6. The system according to claim 1, characterized in that The local client system includes a quantum security all-in-one machine, a quantum security encryption box or a quantum security server.

7. The system according to claim 1, characterized in that The quantum security all-in-one machine, i.e., the quantum security privacy computer, directly provides users with a quantum encryption privacy environment, where users can directly access the network management system through quantum security encryption. Non-secure network access can be achieved by connecting an existing computer to the privacy computer. The privacy computer has a built-in KVM switching function, which allows users to switch freely between the privacy environment and the existing computer. The quantum security encryption box is connected to the existing terminal in an external way. All data accessed by the user terminal through the encryption box will be sent out after being quantum securely encrypted. The user's office environment is still the original terminal equipment, and the data communicated by the existing network management client to the outside is encrypted and protected by the quantum security encryption box; Quantum security server, for the security access requirements of large traffic, can be used as quantum security encryption protection. Its function for the terminal is the same as that of the quantum security encryption box.

Images