Interoperation method fusing security management platform and security capability access gateway

Abstract

The embodiment of the invention relates to the technical field of quantum, and discloses an interoperation method fusing a security management platform and a security capability access gateway. The interoperation method comprises the following steps: a first platform and a second platform are synchronized, the first platform is interconnected and intercommunicated with the second platform through a security capability access gateway, and the first platform and the second platform are respectively accessed to a quantum key distribution network through a first device and a second device; sending a key creation request using a first communication protocol, the first communication protocol being converted by the security capability access gateway into a second communication protocol, the key creation request being forwarded by the security capability access gateway to a second platform using the second communication protocol, the first device and the second device respectively apply for quantum keys to the quantum key distribution network based on the key creation request; a quantum key returned by the quantum key distribution network is obtained, and the quantum key distribution network enables the first device and the second device to share the quantum key through negotiation.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of quantum technology, and in particular to a method for interoperation between a fusion security management platform and a secure capability access gateway. BACKGROUND

[0002] Quantum information technology is a new information processing method for realizing information perception, calculation and transmission by preparing, regulating and observing physical states in micro quantum systems based on quantum mechanics principles, which includes quantum computing, quantum communication and quantum measurement, etc. It can be combined with other technologies to provide quantum-related services, such as the fusion of quantum key distribution (QKD) technology and information and communications technology (ICT) technology realized by the interconnection and interoperation between a QKD network and an ICT network.

[0003] However, the quantum service network provided by the current quantum technology service provider does not support interoperation with the access network, which is not conducive to the fusion of quantum information technology and other technologies. SUMMARY

[0004] Embodiments of the present application provide a method for interoperation between a fusion security management platform and a secure capability access gateway, which realizes the interconnection and interoperation between a quantum service network and an access network.

[0005] According to some embodiments of the present application, the first aspect of the embodiments of the present application provides a method for interoperation, comprising: synchronizing a first platform and a second platform, wherein the first platform is interconnected and interoperated with the second platform through a secure capability access gateway, and the first platform and the second platform are respectively accessed to a quantum key distribution network through a first device and a second device; sending a key creation request using a first communication protocol, wherein the first communication protocol is converted into a second communication protocol by the secure capability access gateway, the key creation request is forwarded to the second platform by the secure capability access gateway using the second communication protocol, and the first device and the second device respectively apply for quantum keys from the quantum key distribution network based on the key creation request; and obtaining quantum keys returned by the quantum key distribution network, wherein the quantum key distribution network enables the first device and the second device to share the quantum keys through negotiation.

[0006] According to some embodiments of the present application, the second aspect of the embodiments of the present application provides a method of interoperation, comprising: synchronizing a first platform and a second platform, wherein the second platform is interconnected with the first platform through a security capability access gateway, and the first platform and the second platform are connected to a quantum key distribution network through a first device and a second device respectively; receiving a key creation request forwarded by the security capability access gateway using a second communication protocol, wherein the security capability access gateway receives a key creation request based on a first communication protocol from the first platform, the first communication protocol is converted into the second communication protocol by the security capability access gateway, the key creation request is forwarded to the second platform by the security capability access gateway using the second communication protocol, and the first device and the second device apply for quantum keys from the quantum key distribution network based on the key creation request respectively; and obtaining quantum keys returned by the quantum key distribution network, wherein the quantum key distribution network enables the first device and the second device to share the quantum keys through negotiation.

[0007] According to some embodiments of the present application, the third aspect of the embodiments of the present application further provides a method of interoperation, which is suitable for a security capability access gateway, comprising: synchronizing first information of a first platform to a second platform, wherein the first platform is interconnected with the second platform through a security capability access gateway, and the first platform and the second platform are connected to a quantum key distribution network through a first device and a second device respectively; receiving a key creation request based on a first communication protocol from the first platform; converting the first communication protocol into a second communication protocol, and forwarding the key creation request to the second platform using the second communication protocol, wherein the first device and the second device apply for quantum keys from the quantum key distribution network based on the key creation request respectively, and the quantum key distribution network enables the first device and the second device to share quantum keys through negotiation.

[0008] According to some embodiments of the present application, the fourth aspect of the embodiments of the present application further provides a fusion security management platform, comprising: at least one processor; and a memory in communication connection with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of interoperation as described in the first aspect.

[0009] According to some embodiments of the present application, the fifth aspect of the embodiments of the present application further provides a middleware platform, comprising: at least one processor; and a memory in communication connection with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the interoperable method according to the second aspect.

[0010] According to some embodiments of the present application, the sixth aspect of the embodiments of the present application further provides a secure capability access gateway, comprising: at least one processor; and a memory in communication connection with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the interoperable method according to the third aspect.

[0011] According to some embodiments of the present application, the seventh aspect of the embodiments of the present application further provides a secure domain interoperable system, comprising: the fusion security management platform according to the fourth aspect, wherein the fusion security management platform accesses the quantum key distribution network through the secure execution module; the middleware platform according to the fifth aspect, wherein the middleware platform accesses the quantum key distribution network through the secure engine; and the secure capability access gateway according to the sixth aspect.

[0012] According to some embodiments of the present application, the eighth aspect of the embodiments of the present application further provides a computer readable storage medium, storing a computer program, characterized in that the computer program is executed by a processor to implement: the interoperable method according to the first aspect, and / or the interoperable method according to the second aspect, and / or the interoperable method according to the third aspect.

[0013] The technical scheme provided by the embodiments of the present application has at least the following advantages: the secure capability access gateway performs protocol conversion and interconnection between the fusion security management platform and the middleware platform, the middleware platform and the secure engine accessing the quantum key distribution network are interconnected, the fusion security management platform and the secure execution module accessing the quantum key distribution network are interconnected, and the secure execution module and the secure engine negotiate to share quantum keys based on the quantum key distribution network. Therefore, the quantum service network provided by the quantum technology service provider can be interconnected and interoperated with the middleware platform in the access network through the fusion security management platform. BRIEF DESCRIPTION OF DRAWINGS

[0014] One or more embodiments are illustrated by way of example in the figures that are part of this disclosure and which are illustrative, but not restrictive, of the embodiments, wherein elements having the same reference number designates like elements throughout the various figures, unless otherwise expressly provided for in the patent claim(s), and wherein the figures do not necessarily bear a proportional relationship to each other. In the figures:

[0015] Figure 1 is a structural schematic diagram of a quantum service network provided in an embodiment of the present application;

[0016] Figure 2 is a structural schematic diagram of a first platform provided in an embodiment of the present application;

[0017] Figure 3 is a structural schematic diagram of a security capability access gateway provided in an embodiment of the present application;

[0018] Figure 4 is a scenario schematic diagram of intercommunication of a first platform and a second platform through a security capability access gateway provided in an embodiment of the present application;

[0019] Figure 5 is a flow of a method of interoperation provided in an embodiment of the present application Figure 1 .

[0020] Figure 6 is a flow of a method of interoperation provided in an embodiment of the present application Figure 2 . DETAILED DESCRIPTION

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below with reference to the drawings. However, those skilled in the art can understand that, in the embodiments of the present application, many technical details are presented in order to make the readers better understand the present application. However, the technical solutions claimed by the present application can be implemented even without these technical details and based on various changes and modifications of the following embodiments. The division of the following embodiments is for the convenience of description, and should not constitute any limitation on the specific implementation of the present application, and the embodiments can be combined and referenced with each other on the premise of not contradicting.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and in the above description are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] In view of the fact that the quantum service network provided by the quantum technology service provider does not support interoperability with the access network, it is very difficult for quantum information technology to be integrated with other technologies. Therefore, at least one embodiment of the present application provides a secure domain external interoperability system, comprising:

[0024] a harmonized security control module (HSCM), wherein the harmonized security control module accesses a quantum key distribution network (or referred to as a QKD network) through a security execution module (SEM). Here, the present application places the harmonized security control module and the security execution module in the quantum service network, which is used to provide quantum technology services externally; the quantum service network domain security capability (or other quantum technology services) is open to calling, that is, the domain security capability (or other quantum technology services) is opened to external calling through the harmonized security control module.

[0025] In some embodiments, the architecture of the quantum service network (referred to as "service network" for short) is as follows Figure 1The shown: fusion security management platform, is a management device: for managing security execution module, is the central management platform of security execution module, is responsible for, for example, user, device, network management, network management, charging management, has the interconnection unit, multiple fusion security management platforms constitute the fusion security management platform network; Security execution module, is the password operation device of data encryption and decryption, for example, has the key generation / storage, digital signature / verification, identity authentication, data encryption / decryption, random number, key management ability, can connect business system, and encrypt and decrypt business system data. QKD network, through the key management terminal (Key Management Terminal, KMT) distributes quantum key vector to the security execution module, different QKD local area network realizes interconnection through QKD backbone network, and different key management terminals maintain quantum key through (Key Management Service, KMS).

[0026] The middleware platform, wherein the middleware platform accesses the quantum key distribution network through the security engine. Here, the application places the middleware platform and the security engine in the access network, which is used to provide quantum technology services to the outside. Similar to the architecture of the quantum service network, the access network includes: a middleware platform similar to the function of the fusion security management platform, and a security engine similar to the function of the security execution module. In addition, the application calls the security capabilities (or other quantum technology services) of the quantum service network through the middleware platform.

[0027] In some embodiments, the middleware platform is a management device: for managing security engines, is the central management platform of the security engine, is responsible for, for example, user, device, network management, network management, charging management, has the interconnection unit. The security engine is a password operation device for data encryption and decryption, for example, has the key generation / storage, digital signature / verification, identity authentication, data encryption / decryption, random number, key management ability, can connect business system, and encrypt and decrypt business system data. QKD network, through the key management terminal distributes quantum key vector to the security execution module.

[0028] The security capability access gateway can better access the devices, users, platforms and the like in the access network side to the service network, and connects the access network and the service network, so that the communication initiator located in the access network side can use the services provided by the service network (such as quantum technology services, including but not limited to quantum key-based encryption services), that is, the communication initiator in the access network side can open and call the quantum security capability in the security domain of the service network (note: the open and call of the quantum security capability of different manufacturers in the security domain can be done according to the secret tube entrustment). It can also be understood that the security capability access gateway is mainly the call of the quantum-related services (such as quantum security capability) provided by the access network to the service network. The quantum-related services can include at least one of the following: user query, customer query, device query, user service query, key state query, key usage record query, user traffic information query and the like. In addition, the basic capabilities provided by the security capability access gateway for the access network access service network process include at least one of the following: device authentication, user authentication, protocol conversion, routing and addressing, heartbeat management and the like.

[0029] Generally, the communication initiator and the communication receiver will complete the negotiation and acquisition of symmetric quantum keys through the QKD network, and perform encrypted communication based on the symmetric quantum keys obtained through negotiation. When the communication initiator is located in the service network side and the communication receiver is located in the network outside the service network side, the communication initiator and the communication receiver cannot negotiate symmetric keys or cannot call quantum-related services, resulting in failure of quantum key service calling. Through the above-mentioned manner, the quantum service network provided by the quantum technology service provider can realize interconnection and interoperation of the middleware platform in the access network through the fusion security management platform, so that the access network can efficiently and high-quality call the quantum-related services provided by the service network with the help of the middleware platform.

[0030] Therefore, the embodiment of the present application provides a fusion security management platform, which is used for managing and controlling the quantum service network. The fusion security management platform realizes the interoperation between the quantum service network and the access network through the interconnection and interoperation between the fusion security management platform and the middleware platform. Figure 2As shown, the apparatus includes: at least one processor 201; and a memory 202 connected with the at least one processor 201 in communication; wherein the memory 202 stores instructions executable by the at least one processor 201, and the instructions are executed by the at least one processor 201 to enable the at least one processor 201 to perform the method provided by the embodiments of the present application: synchronizing a fusion security management platform and a middleware platform; sending a key creation request using a first communication protocol, wherein the first communication protocol is converted into a second communication protocol by a secure capability access gateway, the key creation request is forwarded to the middleware platform by the secure capability access gateway using the second communication protocol, and a security execution module and a security engine apply for quantum keys from a quantum key distribution network based on the key creation request; and obtaining quantum keys (such as a first quantum key) returned by the quantum key distribution network, wherein the quantum key distribution network shares the quantum keys (such as the first quantum key) with the security execution module and the security engine through negotiation, which will be described in detail hereinafter.

[0031] The memory 202 and the processor 201 are connected in a bus manner, the bus can include any number of interconnected buses and bridges, and the bus connects one or more processors 201 and various circuits of the memory 202 together. The bus can also connect various other circuits such as peripheral devices, voltage stabilizers, and power management circuits together, which are well known in the art, and therefore, further description will not be given herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements such as multiple receivers and transmitters, which provide a unit for communicating with various other devices on a transmission medium. The data processed by the processor 201 is transmitted on a wireless medium through an antenna, and further, the antenna also receives data and transmits the data to the processor 201.

[0032] The processor 201 is responsible for managing the bus and general processing, and can also provide various functions including timing, peripheral interface, voltage regulation, power management, and other control functions. The memory 202 can be used to store data used by the processor 201 in performing operations.

[0033] To this end, the embodiment of the present application provides a middleware platform, which is used for managing and controlling an access network, and realizes the interoperation of a quantum service network and the access network through interconnection and intercommunication between the middleware platform and a fusion security management platform. Regarding the middleware platform provided by the embodiment of the present application, in some embodiments, the structure can include: at least one processor; and a memory in communication connection with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method of interoperation: synchronizing the fusion security management platform and the middleware platform; receiving a key creation request forwarded by a security capability access gateway using a second communication protocol, wherein the security capability access gateway receives a key creation request based on a first communication protocol from the fusion security management platform, the first communication protocol is converted into the second communication protocol by the security capability access gateway, the key creation request is forwarded to the middleware platform by the security capability access gateway using the second communication protocol, and a security execution module and a security engine apply for quantum keys from a quantum key distribution network based on the key creation request; and obtaining quantum keys (such as second quantum keys) returned by the quantum key distribution network, wherein the quantum key distribution network shares the quantum keys (such as second quantum keys) with the security execution module and the security engine through negotiation, and the interoperation method executed by the fusion security management platform is referred to.

[0034] It can be understood that there are various access networks that provide encryption service based on quantum keys, and the communication protocols supported by these access networks are various, that is, there can be differences in protocols between the fusion security management platform and the middleware platform.

[0035] To this end, the embodiment of the present application further provides a security capability access gateway, which provides protocol conversion and forwarding services between the security fusion management platform and the middleware platform, so that the protocols in the interconnection and intercommunication process between the fusion security management platform and the middleware platform can be supported by the local end. Regarding the security capability access gateway provided by the embodiment of the present application, in some embodiments, the structure can be as follows Figure 3As shown, the apparatus includes: at least one processor 301; and a memory 303 connected with the at least one processor 301 in communication; wherein the memory 303 stores instructions executable by the at least one processor 301, and the instructions are executed by the at least one processor 301 to enable the at least one processor 301 to perform the interoperation method provided by the embodiments of the present application: synchronizing first information of a fusion security management platform to a middleware platform; receiving a key creation request based on a first communication protocol from the fusion security management platform; converting the first communication protocol into a second communication protocol, and forwarding the key creation request to the middleware platform using the second communication protocol, wherein the security execution module and the security engine apply for quantum keys from a quantum key distribution network based on the key creation request, and the quantum key distribution network makes the security execution module and the security engine share the quantum keys through negotiation (which will be described in detail hereinafter).

[0036] The memory 303 and the processor 301 are connected in a bus manner, the bus can include any number of interconnected buses and bridges, and the bus connects various circuits of the one or more processors 301 and the memory 303 together. The bus can also connect various other circuits such as peripheral devices, voltage stabilizers and power management circuits together, which are well known in the art, and therefore, further description will not be given herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements such as multiple receivers and transmitters, which provide a unit for communicating with various other devices on the transmission medium. The data processed by the processor 301 is transmitted on the wireless medium through the antenna, and further, the antenna also receives data and transmits the data to the processor 301.

[0037] The processor 301 is responsible for managing the bus and general processing, and can also provide various functions including timing, peripheral interface, voltage regulation, power management and other control functions. And the memory 303 can be used to store the data used by the processor 301 in the execution operation.

[0038] Thus, as shown, Figure 4 The security capability access gateway located on the service network side communicates with the fusion security management platform and allows the middleware platform on the access network side to access, so that the fusion security management platform and the middleware platform interconnect through the security capability access gateway. It should be noted that, in order to highlight the innovative part of the present application, the units not closely related to solving the technical problems proposed in the present application are not introduced in the above embodiments, but this does not mean that there are no other units in the present embodiment.

[0039] Therefore, the application enables the security execution module under the fusion security management platform to perform quantum key negotiation with the security engine under the middleware platform based on the quantum key distribution network under the instruction of the fusion security management platform, so that the quantum service network and the access network jointly provide quantum services for users.

[0040] To make the skilled in the art better understand the interoperation method provided by the embodiments of the application, the interoperation method of each entity provided by the embodiments of the application will be described below. In addition, since the fusion security management platform and the middleware platform are similar in function, and the security execution module and the security engine are similar in function, they can be interchanged to a certain extent, and the core reason for the similar function entities with different names is that they are in the service network or the access network. Therefore, in order to highlight the similar or same function of the fusion security management platform and the middleware platform, the fusion security management platform is referred to as the first platform, and the middleware platform is referred to as the second platform; in order to highlight the similar or same function of the security execution module and the security engine, the security execution module is referred to as the first device, and the security engine is referred to as the second device.

[0041] In some embodiments, the interoperation method is applied to the first platform, and the flowchart thereof is as shown in Figure 5 , including the following steps:

[0042] Step 501, synchronizing the first platform and the second platform, wherein the first platform is interconnected with the second platform through the security capability access gateway, and the first platform and the second platform are connected to the quantum key distribution network through the first device and the second device respectively;

[0043] Step 502, sending a key creation request using the first communication protocol, wherein the first communication protocol is converted into the second communication protocol by the security capability access gateway, the key creation request is forwarded to the second platform using the second communication protocol by the security capability access gateway, and the first device and the second device apply for quantum keys from the quantum key distribution network based on the key creation request respectively;

[0044] Step 503, obtaining the quantum key returned by the quantum key distribution network, wherein the quantum key distribution network enables the first device and the second device to share the quantum key through negotiation.

[0045] Through the above-mentioned manner, the security capability access gateway is used to interconnect the first platform and the second platform, which better connects the devices, users, platforms, etc. in the access network to the service network, and connects the access network and the service network, so that the communication initiator located in the access network side can use the services provided by the service network (such as quantum technology services, including but not limited to quantum key-based encryption services).

[0046] For step 501, synchronizing the first platform and the second platform, wherein the first platform interconnects with the second platform through the secure capability access gateway, and the first platform and the second platform access the quantum key distribution network through the first device and the second device respectively. The first information can be any information related to the provision of services, for example, the first information can include identity information, device information, customer information, user information and / or key information, at this time the first information can be synchronized to the second platform through the secure capability access gateway, for example, identity information, device information, customer information, user information and / or key information are sent to the capability security access gateway through the target uniform resource identifier (Uniform Resource Identifier, URI) using the first communication protocol, wherein the secure capability access gateway forwards the identity information, device information, customer information, user information and / or key information to the second platform using the second communication protocol.

[0047] In order for those skilled in the art to better understand the first information, the following will be described in relation to the first information provided in the above examples.

[0048] In some examples, the identity information can include a username and a password, wherein the username and the password can be obtained by a quantum service network provider, and the username can also be obtained by registering with the quantum service network provider (or by agreement with the quantum service network provider). Of course, the above is only an exemplary description of the identity information, and in some examples, it can also be obtained in other ways, which will not be repeated here. For example, the identity information can be defined as shown in Table 1 below:

[0049] Table 1 Data structure of identity information (Credential)

[0050] Parameter Name Type Description username String Username password String Password

[0051] Wherein, Credential is an exemplary name of the data structure of the identity information, and other names can also be used to indicate the data structure of the identity information in other examples or embodiments, which will not be repeated here.

[0052] In some examples, the device information can include at least one of the following information: device identification, device name, device manufacturer name, device model, node name, node number software version, running state, customer and device function. For example, the device information can be defined as shown in Table 2 below:

[0053] Table 2 Data structure of device information (DeviceInfo)

[0054] Parameter Name Type Description deviceName String Device Name deviceId String Device ID manuName String Manufacturer Name model String Model nodeName String Node Name softwareVersion String Node Software Version runningState String Running State costomer String Customer function String Function

[0055] In the above, similar to the aforementioned identity information, DeviceInfo is an exemplary name of a data structure of device information, and other names can be used to indicate the data structure of device information in other examples or embodiments, which will not be described herein.

[0056] In some examples, the customer information can include at least one of the following: customer identification, customer name, customer nickname, customer type, nationality, customer contact information, customer address, customer manager name, customer manager contact information, and customer status. For example, the customer information can be defined as shown in Table 3 below:

[0057] Table 3: Data structure of customer information (CustomerInfo)

[0058]

[0059]

[0060] In some examples, the user information can include at least one of the following: user identification, user name, user account, user nickname, nationality, user contact information, user address, user manager name, user manager contact information, and user status. For example, the customer information can be defined as shown in Table 4 below:

[0061] Table 4: Data structure of user information (UserInfo)

[0062]

[0063] In some examples, the key information can include at least one of the following: key identification, key purpose, key algorithm, key length, current key status, user identification, component identification, key usage result, key usage time, and key usage duration. For example, the key information can be defined as shown in Table 5 below:

[0064] Table 5: Data structure of key information (KeyInfo)

[0065]

[0066] In the above, the business type represented by the component ID, and the key algorithm flag is defined as shown in Table 6 below:

[0067] Table 6: Data structure of key algorithm flag (CryptographicAlgorithm)

[0068] Name Value Description AES 0x00000003 / RSA 0x00000004 / OneTimePad 0x0000001B / SM1 0x00001001 / SM2 0x00001002 / SM3 0x00001003 / SM4 0x00001004 / SM7 0x00001005 / SM9 0x00001006 / ZUC 0x00001007 / HMAC_SM3 0x00001008 / HMAC_SM1 0x0000006A Extended HMAC_SM4 0x0000006B Extended HMAC_AES 0x0000006C Extended

[0069] Of course, the above is only an exemplary description of the relevant information, and in other examples or embodiments, the definition of the first information and the various types of information contained therein can be adjusted as needed, for example, removing contact information and the like from the definition, or adding the name of the service provider, or adjusting the value (and / or type, etc.) of the corresponding information, and the like, which will not be repeated here.

[0070] It should be noted that the above URI is the URI corresponding to the uniform application programming interface (Application Programming Interface, API) exposed by the first platform to provide interconnection service, which can be implemented by calling the corresponding API interface, for example, in some embodiments, the interface can be / crossdomain / kmip, when calling the interconnection service, the API interface of / crossdomain / kmip is sent, of course, the above is only an exemplary naming provided for the interface, in other embodiments, other naming methods can also be used, which will not be repeated here.

[0071] It should be further noted that the synchronized first information can be information that needs to be newly created, information that needs to be queried, or information that needs to be deleted or modified, at this time, the first information is implemented by sending a new request, a query request, a deletion request or a modification request, and the corresponding request of the URI is a new request, a query request, a deletion request and a modification request, and the like, which will not be repeated here. To better understand the above various requests by those skilled in the art, the request parameters carried by the URI in various cases will be exemplarily described below.

[0072] When device information synchronization is implemented by creating a device, the synchronization of the first information can be implemented by the URI carrying the request parameters shown in Table 7 as follows:

[0073] Table 7 Request parameters carried by the URI used to synchronize the first information in the device creation scenario

[0074] Parameter Name Type Description credential Credential Credential deviceInfo DeviceInfo DeviceInfo

[0075] Among them, the identity information can be defined as the data structure shown in the previous Table 1, and the device information can be defined as the data structure shown in the previous Table 2, which will not be repeated here.

[0076] When customer information synchronization is implemented by creating a customer, the synchronization of the first information can be implemented by the URI carrying the request parameters shown in Table 8 as follows:

[0077] Table 8 Request parameters carried by the URI used to synchronize the first information in the customer creation scenario

[0078] Parameter Name Type Description credential Credential Credential customerInfo CustomerInfo CustomerInfo

[0079] Wherein, similar to Table 7, the identity information can be defined as the data structure shown in the previous Table 1, and the device information can be defined as the data structure shown in the previous Table 3, which will not be repeated here. In addition, subsequent similar cases will not be repeated here.

[0080] When the user information synchronization is implemented by creating a user, the first information synchronization can be implemented by a URI carrying the request parameters shown in Table 9 as follows:

[0081] Table 9 Request parameters carried by the URI used for synchronizing the first information in the user creation scenario

[0082] Parameter Name Type Description credential Credential Credential userInfo UserInfo DeviceInfo

[0083] When the key information synchronization is implemented by creating a key, the first information synchronization can be implemented by a URI carrying the request parameters shown in Table 10 as follows:

[0084] Table 10 Request parameters carried by the URI used for synchronizing the first information in the key creation scenario

[0085] Parameter Name Type Description credential Credential Credential keyInfo KeyInfo KeyInfo

[0086] When the device information synchronization is implemented by modifying the device information, the first information synchronization can be implemented by a URI carrying the request parameters shown in Table 11 as follows:

[0087] Table 11 Request parameters carried by the URI used for synchronizing the first information in the device modification scenario

[0088] Parameter Name Type Description credential Credential Credential deviceInfo DeviceInfo DeviceInfo

[0089] When the customer information synchronization is implemented by modifying the customer information, the first information synchronization can be implemented by a URI carrying the request parameters shown in Table 12 as follows:

[0090] Table 12 Request parameters carried by the URI used for synchronizing the first information in the customer modification scenario

[0091] Parameter Name Type Description credential Credential Credential customerInfo CustomerInfo CustomerInfo

[0092] When the user information synchronization is implemented by modifying the user information, the first information synchronization can be implemented by a URI carrying the request parameters shown in Table 13 as follows:

[0093] Table 13 Request parameters carried by the URI used for synchronizing the first information in the user modification scenario

[0094] Parameter Name Type Description credential Credential Credential userInfo UserInfo DeviceInfo

[0095] When the device information synchronization is implemented by deleting the device information, the first information synchronization can be implemented by the URI carrying the request parameters shown in Table 14:

[0096] Table 14: Request parameters carried by the URI used for synchronizing the first information in the device deletion scenario

[0097] Parameter Name Type Description credential Credential Credential deviceId String Device ID

[0098] When the customer information synchronization is implemented by deleting the customer information, the first information synchronization can be implemented by the URI carrying the request parameters shown in Table 15:

[0099] Table 15: Request parameters carried by the URI used for synchronizing the first information in the customer deletion scenario

[0100] Parameter Name Type Description credential Credential Credential customerId String Customer ID

[0101] When the user information synchronization is implemented by deleting the user information, the first information synchronization can be implemented by the URI carrying the request parameters shown in Table 16:

[0102] Table 16: Request parameters carried by the URI used for synchronizing the first information in the user deletion scenario

[0103] Parameter Name Type Description credential Credential Credential userId String User ID

[0104] When the key information synchronization is implemented by updating the key information, the first information synchronization can be implemented by the URI carrying the request parameters shown in Table 17:

[0105] Table 17: Request parameters carried by the URI used for synchronizing the first information in the key update scenario

[0106] Parameter Name Type Description credential Credential Credential keyInfo KeyInfo KeyInfo

[0107] When the key information synchronization is implemented by synchronizing the key information, the first information synchronization can be implemented by the URI carrying the request parameters shown in Table 18:

[0108] Table 18: Request parameters carried by the URI used for synchronizing the first information in the key synchronization scenario

[0109]

[0110]

[0111] Wherein, the usage information can be described by the content defined in Table 19:

[0112] Table 19: Definition of usage information

[0113] Name Value Description Sign 0x00000001 Sign Verify 0x00000002 Verify Encrypt 0x00000004 Encrypt Decrypt 0x00000008 Decrypt Hash 0x00000010 Hash HMAC 0x00000020 HMAC operation

[0114] It should be noted that the above content provides an exemplary description of some cases of the first information and its request parameters in the first information synchronization scenario, and in some embodiments, other ways or other methods can also be used to represent the information or requests in the first information synchronization process, which will not be described one by one here.

[0115] It can also be understood that on the basis of synchronization, there can also be interconnection between queries between the quantum service network and the access network. At this time, in order to unify the API used, when querying device information, the URI carrying the request parameters shown in Table 20 can be used to achieve:

[0116] Table 20 Request parameters carried by URI used in synchronization of first information in device query scenario

[0117] Parameter name Type Description credential Credential Identity information deviceId String Device ID

[0118] When querying customer information, the URI carrying the request parameters shown in Table 21 can be used to achieve:

[0119] Table 21 Request parameters carried by URI used in synchronization of first information in customer query scenario

[0120] Parameter name Type Description credential Credential Identity, see 4.2.1.4.1(1) customerId String Customer ID

[0121] When querying user information, the URI carrying the request parameters shown in Table 22 can be used to achieve:

[0122] Table 22 Request parameters carried by URI used in synchronization of first information in user query scenario

[0123] Parameter name Type Description credential Credential Identity information userId String User ID

[0124] When querying key information, the URI carrying the request parameters shown in Table 23 can be used to achieve:

[0125] Table 23 Request parameters carried by URI used in synchronization of first information in key query scenario

[0126] Parameter name Type Description credential Credential Identity information keyId String Key ID

[0127] That is, the synchronization of the first information and the query of the first information can be achieved by using the same interface, and in order to distinguish the synchronization achieved by different operation modes, the corresponding operation identifier can also be carried in the URI. For example, in some embodiments, the different operations in the URI can be defined in the manner shown in Table 24:

[0128] Table 24 Definition of flags carried by first operation request

[0129] Name Value Description CreateDevice 0x00000001 Add device UpdateDevice 0x00000002 Modify device information DeleteDevice 0x00000004 Delete device GetDevice 0x00000008 Query device information CreateCustomer 0x00000010 Add customer UpdateCustomer 0x00000020 Modify customer information DeleteCustomer 0x00000040 Delete customer GetCustomer 0x00000080 Query customer information CreateUser 0x00000100 Add user UpdateUser 0x00000200 Modify user information DeleteUser 0x00000400 Delete user GetUser 0x00000800 Query user information CreateKey 0x00001000 Create key UpdateKey 0x00002000 Update key information GetKey 0x00004000 Query key information UpdateKeyUsed 0x00008000 Synchronize key usage information

[0130] Wherein, CreateDevice corresponds to the device creation request as before, UpdateDevice corresponds to the device modification request as before, DeleteDevice corresponds to the device deletion request as before, GetDevice corresponds to the device query request as before; CreateCustomer corresponds to the customer creation request as before, UpdateCustomer corresponds to the customer modification request as before, DeleteCustomer corresponds to the customer deletion request as before, GetCustomer corresponds to the customer query request as before; CreateUser corresponds to the user creation request as before, UpdateUser corresponds to the user modification request as before, DeleteUser corresponds to the user deletion request as before, GetUser corresponds to the user query request as before; CreateKey corresponds to the key creation request as before, UpdateKey corresponds to the key update request as before, GetKey corresponds to the key query request as before, UpdateKeyUsed corresponds to the key synchronization request as before.

[0131] Of course, the above is only an exemplary description of the related requests and information, and other request forms or defining other information that needs to be synchronized as the first information can also be used in other embodiments, and will not be described one by one here.

[0132] For step 502, the key creation request is sent using the first communication protocol, wherein the first communication protocol is converted by the security capability access gateway into the second communication protocol, the key creation request is forwarded by the security capability access gateway to the second platform using the second communication protocol, and the first device and the second device apply for quantum keys from the quantum key distribution network based on the key creation request. It can be understood that the key creation request triggers the first device and the second device to perform key negotiation through the quantum key distribution network, that is, the key creation request is sent to the security capability access gateway using the first communication protocol, wherein the security capability access gateway converts the first communication protocol into the second communication protocol used by the second platform, the security capability access gateway forwards the key creation request to the second platform using the second communication protocol, the second platform forwards the key creation request to the second device using the second communication protocol, and the first device and the second device apply for quantum keys from the quantum key distribution network based on the key creation request.

[0133] For step 503, the quantum key returned by the quantum key distribution network (such as the first quantum key) is obtained, wherein the quantum key distribution network enables the first device and the second device to share the quantum key (such as the first quantum key) through negotiation. It can be understood that after the first platform receives the quantum key, new key information is generated, at this time, in order to guarantee the interconnection and intercommunication with the second platform, it will also be synchronized to the second platform, that is, in some embodiments, the first quantum key returned by the quantum key distribution network is obtained from the first device using the first communication protocol, and the key information of the first quantum key is synchronized to the security capability access gateway using the first communication protocol, wherein the security capability access gateway synchronizes the key information of the first quantum key to the second platform using the second communication protocol.

[0134] In the above manner, the first platform and the second platform are interconnected and intercommunicated through the security capability access gateway, which better accesses the devices, users, platforms, etc. in the access network to the service network, and connects the access network and the service network, so that the communication initiator located in the access network side can use the services (such as quantum technology services, including but not limited to encryption services based on quantum keys) provided by the service network.

[0135] In some embodiments, the method of interoperation is applied to the security capability access gateway, and the flow thereof is as shown in Figure 6 , comprising the following steps:

[0136] Step 601, synchronize the first information of the first platform to the second platform, wherein the first platform is interconnected and intercommunicated with the second platform through the security capability access gateway, and the first platform and the second platform are connected to the quantum key distribution network through the first device and the second device respectively;

[0137] Step 602, receive a key creation request based on the first communication protocol from the first platform;

[0138] Step 603, convert the first communication protocol to the second communication protocol, and forward the key creation request to the second platform using the second communication protocol, wherein the first device and the second device apply for quantum keys from the quantum key distribution network based on the key creation request, and the quantum key distribution network enables the first device and the second device to share the quantum key through negotiation.

[0139] In the above manner, the first platform and the second platform are interconnected and intercommunicated through the security capability access gateway, so that even if the protocols supported by the first platform and the second platform are different, they can still be interconnected and intercommunicated through the protocol conversion of the security capability access gateway, thereby supporting the interoperation of the quantum service network and the access network. For the person skilled in the art to better understand the above embodiments, the following will be explained and described.

[0140] For step 601, synchronize the first information of the first platform to the second platform, wherein the first platform interconnects and intercommunicates with the second platform through the secure capability access gateway, and the first platform and the second platform access the quantum key distribution network through the first device and the second device respectively. Similar to the foregoing embodiments, the first information can include identity information, device information, customer information, user information, and / or key information, and correspondingly, the synchronization of the first information of the first platform to the second platform can be implemented by: receiving the identity information, the device information, the customer information, the user information, and / or the key information sent by the first platform based on the first communication protocol; converting the first communication protocol into the second communication protocol, and forwarding the identity information, the device information, the customer information, the user information, and / or the key information to the second platform using the second communication protocol.

[0141] For step 602, receive the key creation request based on the first communication protocol from the first platform. The first communication protocol is a private protocol of the service network.

[0142] For step 603, convert the first communication protocol into the second communication protocol, and forward the key creation request to the second platform using the second communication protocol, wherein the first device and the second device respectively apply for quantum keys from the quantum key distribution network based on the key creation request, and the quantum key distribution network enables the first device and the second device to share quantum keys through negotiation. The first communication protocol includes but is not limited to KMIP protocol or other private protocol, and the second communication protocol includes but is not limited to TCP / IP protocol, HTTP protocol, FTP protocol, SMTP protocol, POP3 protocol, IMAP protocol, SNMP protocol, DNS protocol, and DHCP protocol, for example, the first communication protocol of the first platform is converted into the second communication protocol used by the second platform, and the key creation request is forwarded to the second platform using the second communication protocol, wherein the second platform forwards the key creation request to the first device using the second communication protocol, and the first device and the second device respectively apply for quantum keys from the quantum key distribution network based on the key creation request, and the quantum key distribution network enables the first device and the second device to share quantum keys through negotiation.

[0143] It should be noted that the above steps 601 and 602 are steps corresponding to the foregoing embodiments, and the corresponding features have basically the same meanings, which will not be repeated here. It should also be noted that for the interoperation method provided in the foregoing embodiments, after the information interaction, it can also be necessary to obtain a response result to confirm whether the synchronization or related operation is successful, so as to determine the subsequent operation. Based on this, in some embodiments, the second platform will also feed back the result of the synchronization operation, wherein the operation result can adopt the definition shown in Table 25 as follows:

[0144] Definition of operation result (ResultStatus)

[0145] Result Value Description Success 0x00000000 Success Operation Failed 0x00000001 Operation failed Operation Pending 0x00000002 Operation pending

[0146] Of course, the above is only an exemplary description of the operation result message, and in other examples or embodiments, other contents can also be defined for the operation result message, such as being in progress and possibly failing, or the corresponding values can also be adjusted to other values, etc., which will not be repeated here.

[0147] In this way, on the basis of supporting interconnection and interworking between the quantum service network and the access network, the operation result is fed back through the sending of the operation result message, so that the other party can understand the operation response result on the platform to determine the synchronization success, facilitate subsequent processing, and help improve the synchronization consistency of the quantum network and the access network, and further strengthen the interoperability of the quantum network and the access network.

[0148] It can also be understood that when the synchronization of the first information or the quantum key creation fails, better understanding the problem can help solve the problem or assist subsequent processing, and therefore, in some embodiments, error messages are also exchanged during the key creation and synchronization of the first information to indicate the cause of the problem. The error message can include a main version mismatch flag, a parsing failure flag, an object type identification failure flag, or an authentication invalid flag. For example, the error message of the first operation request and / or the second operation request can be defined as shown in Table 26:

[0149] Table 26 Definition of error message of request

[0150]

[0151] In addition, since the access network is usually an untrusted network, in order to protect the security of the quantum service network, the security of the access network (i.e., the second platform) should be confirmed before the first information synchronization. Therefore, the interconnection and interworking of the second platform and the first platform is based on the security of the second platform being guaranteed. For this purpose, in some embodiments, the second platform is also authenticated by the secure capability access gateway to protect the security of the access quantum network. Therefore, after the second platform is authenticated and allowed to access the service network, it can interact with the first platform in the quantum network through the secure capability access gateway (i.e., the secure capability access gateway is used as a channel for the first platform and the second platform to interact, to support the interaction between the first platform and the second platform).

[0152] The step division of the above various methods is only for clear description, and can be combined into one step or split into multiple steps in implementation, as long as the same logical relationship is included, and all are within the protection scope of the patent; adding irrelevant modifications or introducing irrelevant designs in the algorithm or flow, but not changing the core design of the algorithm and flow, are within the protection scope of the patent.

[0153] It can be found that the embodiment is a system embodiment corresponding to the platform embodiment, and the embodiment can be implemented in cooperation with the platform embodiment. The related technical details mentioned in the platform embodiment are still valid in the embodiment. In order to reduce repetition, they will not be described here. Accordingly, the related technical details mentioned in the embodiment can also be applied in the platform embodiment.

[0154] Those skilled in the art can understand that the above embodiments are specific embodiments for implementing the present application, and in actual application, various changes can be made in form and details without departing from the spirit and scope of the present application.

Claims

1. A method of interoperation, characterized by, The method comprises: synchronizing a first platform and a second platform, wherein the first platform is interconnected with the second platform through a security capability access gateway, and the first platform and the second platform are connected to a quantum key distribution network through a first device and a second device respectively; sending a key creation request using a first communication protocol, wherein the first communication protocol is converted into a second communication protocol by the security capability access gateway, the key creation request is forwarded to the second platform by the security capability access gateway using the second communication protocol, and the first device and the second device respectively apply for quantum keys from the quantum key distribution network based on the key creation request; obtaining quantum keys returned by the quantum key distribution network, wherein the quantum key distribution network enables the first device and the second device to share the quantum keys through negotiation.

2. The method of claim 1, wherein, Synchronizing a first platform and a second platform comprises: synchronizing first information to the second platform through the security capability access gateway, wherein the first information comprises identity information, device information, customer information, user information and / or key information.

3. The method of claim 2, wherein, Synchronizing first information to the second platform through the security capability access gateway comprises: sending identity information, device information, customer information, user information and / or key information to the security capability access gateway through a URI using a first communication protocol, wherein the security capability access gateway forwards the identity information, the device information, the customer information, the user information and / or the key information to the second platform using a second communication protocol.

4. The method of claim 1, wherein, The first platform is a fusion security management platform, the first device is a security execution module, the second platform is a middleware platform, and the second device is a security engine. Sending a key creation request using a first communication protocol comprises: sending a key creation request to the security capability access gateway using a first communication protocol, wherein the security capability access gateway converts the first communication protocol into a second communication protocol used by the middleware platform, the security capability access gateway forwards the key creation request to the middleware platform using the second communication protocol, the middleware platform forwards the key creation request to the security engine using the second communication protocol, and the security execution module and the security engine respectively apply for quantum keys from the quantum key distribution network based on the key creation request.

5. The method of claim 4, wherein, Obtaining quantum keys returned by the quantum key distribution network comprises: obtaining quantum keys returned by the quantum key distribution network from the security execution module using a first communication protocol, and synchronizing key information of the quantum keys to the security capability access gateway using the first communication protocol, wherein the security capability access gateway synchronizes the key information of the quantum keys to the middleware platform using the second communication protocol.

6. A method of interoperation, applicable to a secure access gateway, characterized in that, The method comprises: synchronizing first information of a first platform to a second platform, wherein the first platform is interconnected with the second platform through a security capability access gateway, and the first platform and the second platform are connected to a quantum key distribution network through a first device and a second device respectively; receiving a key creation request based on a first communication protocol from the first platform; The first communication protocol is converted into a second communication protocol, and the key creation request is forwarded to the second platform using the second communication protocol, wherein the first device and the second device apply for quantum keys from a quantum key distribution network based on the key creation request, and the quantum key distribution network negotiates to enable the first device and the second device to share quantum keys.

7. The method of claim 6, wherein, The first information includes identity information, device information, customer information, user information, and / or key information, and the first information of the first platform is synchronized to the second platform, including: Identity information, device information, customer information, user information, and / or key information sent by the first platform based on the first communication protocol is received; The first communication protocol is converted into a second communication protocol, and the identity information, the device information, the customer information, the user information, and / or the key information are forwarded to the second platform using the second communication protocol.

8. The method of claim 6, wherein, The first platform is a converged security management platform, the first device is a secure execution module, the second platform is a middleware platform, and the second device is a security engine. The first communication protocol is converted into a second communication protocol, and the key creation request is forwarded to the second platform using the second communication protocol, including: The first communication protocol of the converged security management platform is converted into a second communication protocol used by the middleware platform, and the key creation request is forwarded to the middleware platform using the second communication protocol, wherein the middleware platform forwards the key creation request to the security engine using the second communication protocol. The secure execution module and the security engine apply for quantum keys from a quantum key distribution network based on the key creation request, and the quantum key distribution network negotiates to enable the secure execution module and the security engine to share quantum keys.

9. A converged security management platform, characterized by, Comprising: At least one processor; And, A memory in communication connection with the at least one processor; wherein The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of interoperation according to any one of claims 1 to 5.

10. A secure access gateway, comprising: Comprising: At least one processor; And, A memory in communication connection with the at least one processor; wherein The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of interoperation according to any one of claims 6 to 8.

Images