A quantum key cloud-based encryption system unified management and key distribution method

Abstract

The application relates to the technical field of network security, in particular to an encryption machine unified management and key distribution method based on a quantum key cloud. The method comprises the following steps: receiving a registration request and extracting a device name, authentication information and a timestamp, completing identity authentication, authorization management and device quantum information generation; subsequently collecting an online state and judging the device usage state corresponding to a central processing unit, memory, disk and network port, combining authentication information comparison and communication state comparison to generate an abnormal state judgment result; then performing alarm information output, blocking illegal connection, permission verification, key identification matching and quantum ciphertext data distribution, and completing quantum key acquisition, acquisition confirmation message generation, data encryption and decryption, key update management, and reset password verification and recovery factory setting processing. The application significantly improves the security, real-time performance and closed-loop autonomy of the encryption machine unified management.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for unified management and key distribution of encryption machines based on quantum key cloud. Background Technology

[0002] In the field of network security technology, existing solutions for online encryption machines typically revolve around registration requests, identity authentication, quantum key distribution, data encryption / decryption, and key update management. They combine quantum key cloud platforms, quantum key management modules, quantum key service modules, and device management modules to establish and maintain encrypted communication links. However, these solutions suffer from limitations such as separating online status from device usage status, fragmented determination of authentication information and communication status, and limited conditions for quantum ciphertext data distribution. Existing methods often rely on the identity authentication result or key update policy identifier after a successful registration request to directly proceed to quantum key distribution and data encryption / decryption.

[0003] In scenarios involving unified management and key distribution of online encryption machines, issues arise such as changes in online status not being pre-integrated into the quantum key service chain and abnormal device usage not being synchronously constrained in quantum ciphertext data distribution. This makes it difficult to meet the stable implementation requirements of controlled quantum key services for online encryption machines. Existing technologies typically involve first receiving registration requests, then performing identity authentication and authorization management, followed by generating device quantum information and incorporating it into quantum key distribution, quantum ciphertext data verification, quantum key decryption, and data encryption / decryption processing. In this type of processing, the device usage status corresponding to the central processing unit, memory, disk, and network port is often treated as independent monitoring information; communication status is often treated as independent connection information; and authentication information is often treated as access verification information. There is a lack of a unified pre-determination chain among these three. Consequently, when the online encryption machine experiences fluctuations in online status, abnormal device usage, or situations not involving communication between online encryption machines, the quantum key service may still continue along the original process. This can easily lead to problems in field operation, such as loose connections between alarm output, blocking of illegal connections, permission verification, key identifier matching, and quantum ciphertext data distribution.

[0004] For the joint processing of the first online status data, the first device usage status data, the first abnormal status judgment result, and the first quantum ciphertext distribution data, existing technologies generally separate online status acquisition, device usage status judgment, authentication information comparison, communication status comparison, abnormal status generation, blocking of illegal connections, and quantum ciphertext data distribution into different processing stages. This makes it difficult to form a consistent process in the application scenario of unified management and key distribution of online encryption machines, including registration request processing, online status acquisition, abnormal status generation, quantum ciphertext data distribution, confirmation message generation, key update management, and factory reset. As a result, the continuous link of the controlled quantum key service of the online encryption machine is not complete, and it is difficult to maintain a unified recording, judgment, and distribution relationship between the device side and the platform side. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a unified management and key distribution method for encryption machines based on quantum key clouds, comprising:

[0006] S100: Obtain the registration request, perform identity authentication, authorization management and device quantum information generation processing to obtain the first device quantum information;

[0007] The registration request is sent by the online encryption machine when it accesses the quantum key cloud platform. The triggering conditions are that the online encryption machine is powered on, the port type is in the access state, and the network port has the conditions for sending and receiving messages.

[0008] S200. Based on the quantum information of the first device, perform online status acquisition, device usage status determination and abnormal status generation processing to obtain the first abnormal status determination result.

[0009] S300. Based on the first abnormal state determination result, perform alarm information sorting, illegal connection blocking processing, permission verification, KID matching and quantum ciphertext data distribution processing to obtain the first quantum ciphertext distribution data.

[0010] S400: Based on the first quantum ciphertext distribution data, perform quantum ciphertext data verification, quantum key decryption, and confirmation message generation to obtain the first factory reset state.

[0011] Furthermore, the process of obtaining a registration request and performing identity authentication, authorization management, and device quantum information generation includes:

[0012] Read the Device Name, authentication information, and timestamp from the registration request;

[0013] For the same Device Name, retain the registration request corresponding to the latest timestamp and mark the previous registration request as a replaced request;

[0014] Write the processing result into the first registration request data;

[0015] The identity authentication and authorization management process includes: based on the first registration request data, the identity authentication service module verifies the correspondence between Device Name, Device ID, timestamp order, and the integrity of authentication information; when the verification matches, the online encryption device is written into the authorization management process and a permission boundary is formed; when the verification does not match, the failed status is stored in the first authentication management result.

[0016] The device quantum information generation process includes: generating device quantum information only for online encryption machines that have passed identity authentication and completed authorization management, wherein the device quantum information includes a quantum identity key, a key encryption quantum key, a key update quantum key, and a verification quantum key; assigning a key identifier KID to each set of device quantum information; associating the KID with a key update strategy ID and writing it into the first device quantum information.

[0017] Furthermore, the process of online status collection and equipment usage status determination includes:

[0018] The online status acquisition and processing includes: based on the quantum information of the first device, the device management module initiates online status acquisition to distinguish between online and offline status; online encryption devices that have been registered but have not received status messages for a long time are first marked as pending processing status; multiple status messages are merged according to Device Name and Device ID, and the status corresponding to the latest timestamp is retained.

[0019] The device usage status determination process includes: based on the first online status data, reading the CPU usage, memory usage, disk usage, and network port transceiver usage of the current online encryption machine; when the CPU, memory, disk, and network port are all continuously reporting, it is classified as normal device usage status; when there are continuous missing records, interrupted usage records, or network port records that do not correspond to the online status, it is classified as abnormal device usage status; and the determination result is written into the first device usage status data.

[0020] Furthermore, the process of handling abnormal state generation includes:

[0021] Simultaneously, the first online status data and the first device usage data are acquired and executed collaboratively by the device management module and the identity authentication service module;

[0022] First, retrieve the authentication information from the first authentication management result and compare it with the current record in the first online status data. If they are inconsistent, write an authentication information exception item.

[0023] Then, extract the relevant network port records and verify their association with the registered online encryption machines. If the current communication object does not appear in the registered relationships, write an abnormal item indicating that it does not belong to the communication between online encryption machines.

[0024] Finally, the four types of abnormal sources—changing from online to offline, abnormal device usage, inconsistent authentication information, and communication between an online encryption machine and a non-online encryption machine—are grouped into a unified judgment result to generate the first abnormal state judgment result.

[0025] Furthermore, the alarm information processing procedure includes:

[0026] Based on the first abnormal state determination result, the device management module determines whether there is an abnormal state corresponding item; if so, the abnormal state is merged by Device Name and written into the alarm record, and the port type, current network port status and current online status are also written; the device management module calls the output interface corresponding to alarm, WeChat and SMS to output and generate the first alarm information.

[0027] Furthermore, the process of blocking unauthorized connections includes:

[0028] Based on the first abnormal state determination result and the first alarm information, the device management module extracts records that do not belong to the communication between the online encryption machine and the online encryption machine, registers them as connections to be blocked, sends a processing instruction to terminate the current connection to the quantum key service module, writes the blocking status into the cloud service platform database, and generates the first blocking processing result.

[0029] Furthermore, the processes of permission verification, KID matching, and quantum ciphertext data distribution include:

[0030] Based on the first abnormal state determination result and the first blocking processing result, the quantum key management module first determines whether the conditions of no abnormal state and no blocking state are met.

[0031] If the conditions are not met, distribution will stop and the stop status will be written to the record before distribution; if the conditions are met, permission verification will continue.

[0032] After the permission verification is passed, the quantum key management module reads the corresponding KID and checks it against the current key update policy ID, the current authentication information status, and the current connection status.

[0033] When the KID is successfully matched and the first blocking process result is not written into the blocking state, and the first abnormal state judgment result does not trigger the communication state abnormality, the quantum key service module calls the quantum identity key, key encryption quantum key, key update quantum key, verification quantum key and quantum session key corresponding to the current KID in the quantum key pool to generate quantum ciphertext data and key verification data and distribute them.

[0034] When KID is missing, mismatched, or the corresponding record does not exist, the current online encryption machine is set to a non-distribution state and recorded as a distribution exception.

[0035] Write the current distribution record, current KID state, current distribution status, and current timestamp into the first quantum ciphertext distribution data.

[0036] Furthermore, the process of verifying quantum ciphertext data includes:

[0037] Based on the first quantum ciphertext distribution data, the online encryption machine calls the local verification quantum key to verify the key verification data.

[0038] Furthermore, the quantum key decryption process includes:

[0039] After verification, the quantum key is used to encrypt the quantum ciphertext data and decrypt it to obtain the quantum session key; the successful decryption status and the current timestamp are written into the first quantum key to obtain the result.

[0040] Furthermore, the confirmation message generation process includes:

[0041] The acquisition confirmation message generation process includes: generating an acquisition confirmation message by an online encryption machine based on the first quantum key acquisition result; the acquisition confirmation message includes Device Name, Device ID, KID and current timestamp; when the verification fails or the decryption fails, the corresponding failure flag is written into the message; and the returned acquisition confirmation message is written into the first acquisition confirmation data.

[0042] The key innovations of this invention include:

[0043] (1) After obtaining the first online status data and the first device usage status data, perform authentication information comparison, communication status comparison and abnormal status generation processing to form the first abnormal status judgment result, and use the first abnormal status judgment result as the common input for subsequent alarm information organization, blocking illegal connection, permission verification and quantum ciphertext data distribution.

[0044] (2) Based on the first abnormal state determination result and the first blocking processing result, perform permission verification, KID matching and quantum ciphertext data distribution processing, and establish quantum ciphertext data distribution on the joint constraints of the first abnormal state determination result, the first blocking processing result, permission state and KID state.

[0045] (3) The continuous processing link consists of registration request, identity authentication and authorization management, device quantum information generation, online status acquisition and online status sorting, device usage status judgment, abnormal status generation, alarm information output, blocking illegal connection, quantum ciphertext data verification, quantum key decryption, obtaining confirmation message generation, key update management processing and reset password verification and factory reset processing, and the first factory reset state is connected back to the registration request state.

[0046] The following are its main beneficial effects:

[0047] (1) In view of the problems of separate processing of online status and device usage status and scattered determination of authentication information and communication status in the existing scheme, the present invention generates the first abnormal status determination result by comparing the first online status data, the first device usage status data, the authentication information and the communication status, so that the online encryption machine completes a unified determination before entering the quantum ciphertext data distribution, and the pre-constraint relationship of the quantum key service link is clearer.

[0048] (2) In view of the problem that the quantum ciphertext data distribution conditions are singular in the existing scheme and the quantum key distribution is directly entered after the authentication is passed, the present invention controls the quantum ciphertext data distribution through the first abnormal state judgment result, the first blocking processing result, the permission verification and KID matching, so that the quantum ciphertext data distribution is consistent with the current online state, the current connection state and the current permission state, and the distribution boundary in the quantum key service process is clearer.

[0049] (3) In view of the problem that the connection between alarm information output, blocking illegal connection, quantum ciphertext data distribution and quantum key decryption is not tight in the existing scheme, the present invention continuously transmits the first abnormal state judgment result to the first alarm information, the first blocking processing result and the first quantum ciphertext distribution data, and then transmits it to the first quantum key acquisition result and the first acquisition confirmation data, so that the processing order between the platform side and the online encryption machine is consistent.

[0050] (4) In view of the problem that the key update management process is not sufficiently associated with the current operating status in the existing scheme, the present invention connects the first quantum key acquisition result, the first acquisition confirmation data and the key update management process to the same processing link, so that the key update management process and the quantum ciphertext data verification, quantum key decryption and data encryption and decryption processes form a corresponding relationship.

[0051] (5) In view of the problem that the factory reset and the preceding management link are separated in the existing scheme, the present invention puts the reset password verification and factory reset processing after the first acquisition confirmation data, and outputs the first factory reset status, so that the registration request, device quantum information generation, quantum ciphertext data distribution, acquisition confirmation message generation and factory reset are in the same continuous process, and the recording, judgment and update relationship between the device side and the platform side remains consistent. Attached Figure Description

[0052] Figure 1 A flowchart illustrating a unified management and key distribution method for encryption machines based on a quantum key cloud, provided in an embodiment of this application;

[0053] Figure 2 This is a structural block diagram of a unified management and key distribution method for encryption machines based on quantum key cloud, provided in an embodiment of this application. Detailed Implementation

[0054] Example 1: Refer to Figure 1 This is a flowchart illustrating a unified management and key distribution method for encryption machines based on a quantum key cloud, provided by an embodiment of the present invention. The process may include at least steps S100-S400:

[0055] S100: Obtain the registration request, perform identity authentication, authorization management and device quantum information generation processing to obtain the first device quantum information;

[0056] S200. Based on the quantum information of the first device, perform online status acquisition, device usage status determination and abnormal status generation processing to obtain the first abnormal status determination result.

[0057] S300. Based on the first abnormal state determination result, perform alarm information sorting, illegal connection blocking processing, permission verification, KID matching and quantum ciphertext data distribution processing to obtain the first quantum ciphertext distribution data.

[0058] S400: Based on the first quantum ciphertext distribution data, perform quantum ciphertext data verification, quantum key decryption, and confirmation message generation to obtain the first factory reset state.

[0059] Step S100 includes at least steps S110-S130:

[0060] S110. Obtain the registration request, extract the Device Name, extract the authentication information, and process the timestamp to obtain the first registration request data.

[0061] Specifically, the registration request is issued by the online encryption machine when it accesses the quantum key cloud platform. The triggering conditions are that the online encryption machine is powered on, the port type is in the access state, and the network port has the conditions for sending and receiving messages.

[0062] The registration request first enters the registration module, and then is received by the device management module, which records the source channel, the receiving order, and the current processing status.

[0063] The Device Name is used to distinguish the current online encryption machine on the quantum key cloud platform side; the authentication information is the registration content directly called by subsequent identity authentication and authorization management, including the device ID corresponding to the online encryption machine, the registered authentication information, and the authentication information item in this registration request; the timestamp is the time record attached when the registration request enters the registration module, used to distinguish the order when the same online encryption machine repeatedly initiates registration requests.

[0064] In practice, the registration module can first read the Device Name from the registration request, then read the authentication information in the predetermined field order, and finally organize the timestamps to ensure that online encryption machines with different port types, different installation methods, and different access orders maintain a unified field order before proceeding to subsequent steps.

[0065] In a practical installation scenario, the online encryption machine is rack-mounted and connected to the quantum key cloud platform via a network port. After receiving a registration request, the registration module first extracts the Device Name, then extracts the device ID and authentication information from the authentication information, and then organizes the timestamps into the record order currently used by the cloud service platform database. If the same Device Name appears repeatedly in a short period of time, the device management module retains the registration request corresponding to the latest timestamp and marks the previous registration request as a replaced request, and does not enter the current processing link.

[0066] Furthermore, after the Device Name extraction, authentication information extraction, and timestamp processing are completed, the registration module writes the processing result into the first registration request data. The first registration request data is recorded in the cloud service platform database as the output field name of this step and is directly available for S120's "first registration request data" to call. At the same time, the first registration request data serves as the only preceding input in this main step, running through the processing links of the identity authentication service module and the device management module. It does not perform quantum key distribution or quantum ciphertext data distribution processing in the S110 stage, thereby ensuring that the registration request and subsequent quantum key services maintain a segmented operation relationship.

[0067] S120. Based on the first registration request data, perform identity authentication and authorization management processing to obtain the first authentication management result.

[0068] Specifically, after the first registration request data enters the identity authentication service module, the identity authentication service module first reads the Device Name, authentication information and timestamp, and then the device management module calls the registered authentication information in the cloud service platform database for corresponding comparison.

[0069] The identity authentication process is a consistency check between the authentication information in this registration request and the authentication information corresponding to the same Device Name in the cloud service platform database. The process includes checking the Device Name correspondence, checking the device ID correspondence, checking the order of timestamps, and checking the integrity of authentication information.

[0070] The authorization management is a continuous process performed after identity authentication. The object of authorization management is not a general message, but whether the current online encryption machine has entered the security scope of the quantum key cloud, whether subsequent requests to obtain quantum keys are allowed, and whether subsequent key update management is allowed.

[0071] Furthermore, after the identity authentication service module completes the consistency check, if the Device Name, Device ID, and authentication information items all correspond to the content already registered in the cloud service platform database, then the online encryption machine is written into the authorization management process; if there is a mismatch in Device Name, a mismatch in Device ID, missing authentication information, or an abnormal timestamp order, then the device management module writes the processing result as a failed state and stores the failed state in the first authentication management result.

[0072] The reason for this is that the first authentication management result needs to retain both the pass and fail statuses completely. Subsequently, S130 only performs device quantum information generation, KID association, and key update strategy ID association processing on the pass status. The fail status is stored in the cloud service platform database for subsequent online status collection and abnormal status generation.

[0073] Understandably, the authorization management does not directly distribute quantum keys, but first establishes the permission boundaries of the current online encryption machine.

[0074] This permission boundary at least corresponds to whether one can subsequently access the quantum key management module, the quantum key service module, and whether the establishment of key update management relationships is permitted.

[0075] In practice, the device management module can register the Device Name and the corresponding device ID that have passed the identity authentication as the currently manageable object, and then write the permission items corresponding to the object into the first authentication management result.

[0076] Therefore, the first authentication management result is generated as the output field name of this step and is directly called by "first authentication management result" in S130; at the same time, the pass status, fail status and permission items in the first authentication management result will be reused in the authentication information comparison process in S230, so that S100 and S200 form a corresponding processing relationship.

[0077] S130. Based on the first authentication management result, perform device quantum information generation, KID association and key update strategy ID association processing to obtain the first device quantum information.

[0078] Specifically, after the first authentication management result enters the quantum key management module, the quantum key management module first determines the identity authentication status and authorization management status, and only performs device quantum information generation processing on online encryption machines that have passed identity authentication and completed authorization management.

[0079] The device quantum information is the basic data used in subsequent online status acquisition, quantum ciphertext data distribution, quantum key decryption, and key update management. The device quantum information includes at least a quantum identity key, a key encryption quantum key, a key update quantum key, and a verification quantum key.

[0080] The quantum identity key is used for the corresponding calls between the subsequent identity authentication service module and the quantum key service module. The key encryption quantum key is used for encryption processing before the subsequent generation and verification of quantum ciphertext data. The key update quantum key is used for subsequent key update management processing. The verification quantum key is used for subsequent key verification data and quantum ciphertext data verification processing.

[0081] Furthermore, after generating the aforementioned device quantum information, the quantum key management module assigns a key identifier, or KID, to each set of device quantum information.

[0082] The KID is not a standalone data item, but rather it is associated with the Device Name, Device ID, and Device Quantum Information. This allows the S330 to directly retrieve the corresponding KID from the first Device Quantum Information when performing subsequent permission verification, KID matching, and quantum ciphertext data distribution.

[0083] At the same time, the quantum key management module also performs key update policy ID association processing on the permission items in the first authentication management result.

[0084] The key update policy ID is the call index for subsequent key update management processes, and its minimum set includes timed updates or count updates; in a preferred embodiment, it can also be further associated with the destruction time, destruction reminder time, and the number of preloaded keys.

[0085] In practice, the quantum key management module first generates device quantum information according to the management object corresponding to the Device Name, then writes the KID corresponding to the same management object into the device quantum information, and then writes the key update policy ID and KID of the same management object into the cloud service platform database.

[0086] In this way, the quantum information of the first device can be directly accessed by the "first device quantum information" in S210 as input for online state acquisition and online state processing. It can also be used to call the KID in S330 and the key update policy ID in S430, thus connecting S100, S200, S300, and S400 across main steps. For online encryption machines where authentication fails or authorization management is incomplete, the quantum key management module does not generate the first device quantum information; it only records the ungenerated state and terminates the current link, without entering S210.

[0087] Specifically, in an operational engineering embodiment, after the quantum key cloud platform receives the first authentication management result of the rack-mounted online encryption machine, the quantum key management module retrieves the quantum identity key, key encryption quantum key, key update quantum key, and verification quantum key corresponding to the online encryption machine from the quantum key pool, writes the same set of quantum keys into the first device quantum information, binds the KID and key update strategy ID to the first device quantum information at the same time, and finally submits it to the cloud service platform database and device management module for registration, so that S210 can read it directly.

[0088] The first device quantum information is the output field name of this step. Its direct destination is "first device quantum information" in S210, and it continues to participate in quantum ciphertext data distribution, quantum key decryption and key update management in subsequent S330, S410 and S430.

[0089] In summary, the technical effects of this step are as follows: Steps S110 to S130 establish a continuous processing chain for registration requests, identity authentication, authorization management, device quantum information generation, KID association, and key update strategy ID association. Preceding data is transferred within this main step in a closed loop, eliminating the previous processing sequence of probing, negotiating, and then entering the quantum key service. This approach ensures that subsequent online status acquisition, abnormal status generation, quantum ciphertext data distribution, and factory reset all utilize the same source of first-source device quantum information. The field relationships in the main process are more explicit, and the processing boundaries during operation are clearer.

[0090] Step S200 includes at least steps S210-S230:

[0091] S210. Obtain the online state corresponding to the quantum information of the first device, perform online state acquisition and online state processing, and obtain the first online state data.

[0092] Specifically, the first device quantum information comes from the preceding step S130 and already includes the Device Name, Device ID, authentication information, quantum identity key, key encryption quantum key, key update quantum key, verification quantum key, KID and key update strategy ID corresponding to the current online encryption machine. After the first device quantum information enters this step, the device management module initiates online status collection.

[0093] The online status is a management status formed by the quantum key cloud platform based on the current access status of the online encryption machine. It distinguishes between online and offline, and corresponds one-to-one with the Device Name and Device ID. The online status collection is not a single read, but a continuous process that starts after the online encryption machine completes the registration request, identity authentication, and authorization management.

[0094] The triggering conditions include the online encryption machine being in a registered state, the network port being in a message sending and receiving state, and the existence of a device record corresponding to the Device Name in the cloud service platform database.

[0095] In terms of implementation, the device management module receives status messages from the network port of the currently online encryption machine, and then combines them with the most recent online record, the most recent timestamp record, and the current receiving time in the cloud service platform database to complete the online status collection.

[0096] For online encryption machines that have been registered but have not received status messages for a long time, the device management module first marks their current status as pending processing, instead of directly writing it as offline, so that subsequent online status processing retains a review process.

[0097] Furthermore, the online status processing is jointly completed by the device management module and the cloud service platform database. Specifically, multiple status messages from the same online encryption machine are first merged according to Device Name and Device ID, then arranged in order of timestamp, and duplicate timestamp records are removed. Finally, the merged online status is written into a unified field.

[0098] If the same online encryption machine reports multiple online statuses in a short period of time, the device management module retains the status corresponding to the latest timestamp and writes the previous status to the historical location in the cloud service platform database. If online and offline statuses alternate, the device management module writes the alternation status along with the corresponding timestamp into the processing result, so that subsequent steps can directly call upon it.

[0099] Understandably, in a practical engineering embodiment, after the rack-mounted online encryption machine is connected to the data center network, the device management module calls the corresponding record based on the first device quantum information, receives the status message of the online encryption machine from the network port, and combines the current timestamp to organize three consecutive status records, finally forming a unified record containing Device Name, device ID, online status and timestamp order.

[0100] The unified record is written as the first online status data. The first online status data is used as the output field name of this step and is directly called by "first online status data" in S220, and continues to be called by "first online status data" in S230, so that the online status acquisition results can participate in the determination of equipment usage status and the generation of abnormal status at the same time.

[0101] S220. Based on the first online status data, perform device usage status determination processing for CPU, memory, disk and network port to obtain the first device usage status data.

[0102] Specifically, after the first online status data enters this step, the device management module locates the current online encryption machine according to the DeviceName and device ID, and reads the device usage status of the online encryption machine.

[0103] The device usage status is the device operation record of the online encryption machine at the current running time, including the processing usage of the central processing unit (CPU), the memory usage, the storage usage of the disk, and the transmission and reception usage of the network port.

[0104] The CPU, memory, disk, and network port are the minimum essential components required for the unified management of online encryption machines in this invention. This is because these four components directly reflect whether the online encryption machine is continuously in a manageable, distributable, and executable quantum key service operating state. The port type and number of ports are preferred extensions and can be read together in the same device usage status determination process, but the core determination objects in this step are still the CPU, memory, disk, and network port.

[0105] Furthermore, the equipment usage status determination process does not simply collect the original occupancy value, but first performs a preliminary check on the online status in the first online status data, and only performs the determination when the online status is online or pending processing.

[0106] If the online status has been changed to offline, the device management module will directly write the corresponding entries for the CPU, memory, disk, and network port of the online encryption machine as offline records and end the current device usage status determination.

[0107] When the online status is online, the device management module first reads the CPU usage from the currently online encryption machine, then reads the memory usage, disk usage, and network port transmission and reception usage. Subsequently, it compares the results of this reading with the most recent historical record of the same Device Name in the cloud service platform database.

[0108] In practice, if the CPU, memory, disk, and network port all maintain continuous reporting, and there is no interruption, reverse jump, or empty field between two adjacent records, the device management module will classify it as normal device usage status. If a certain item has consecutive missing records, interrupted occupancy records, or network port transmission and reception records that do not correspond to the online status, the device management module will write that item as abnormal device usage status and retain the corresponding timestamp and corresponding item name.

[0109] The reason for this is that S230 needs to call the first online status data and the first device usage data simultaneously to generate the first abnormal status judgment result. Therefore, the data output in this step cannot be just the raw collected value, but needs to be the judgment result after the corresponding relationship has been sorted out.

[0110] Understandably, in a practical engineering embodiment, the rail-mounted online encryption machine remains online after completing S210. The device management module sequentially reads its CPU usage, memory usage, disk usage, and network port transceiver usage, and then compares them with the record of the previous timestamp in the cloud service platform database.

[0111] When it is found that network port transmit / receive usage persists while CPU usage shows an empty field, the device management module writes the device usage status of the online encryption machine as a combined record containing CPU anomalies and network port normal status. This combined record is written as the first device usage status data, which serves as the output field name for this step and is directly used by "First Device Usage Status Data" in S230. It is also read again as the anomaly source record when S310 organizes alarm information.

[0112] S230. Based on the first online status data and the first device usage status data, perform authentication information comparison, communication status comparison and abnormal status generation processing to obtain the first abnormal status determination result.

[0113] Specifically, the first online status data and the first device usage data have already completed online status processing and device usage status determination respectively upon entering this step. Therefore, this step is executed collaboratively by the device management module and the identity authentication service module. The authentication information comparison involves matching the Device Name, Device ID, and current online encryption machine record corresponding to the first online status data with the authentication information in the first authentication management result output in the previous step S120. The communication status comparison involves verifying the network interface message transmission and reception relationship of the current online encryption machine with the online encryption machine relationships registered in the quantum key cloud platform to identify whether there are any communication situations between online encryption machines that do not belong to the online encryption machine. The abnormal status generation is a unified merging of offline, abnormal device usage status, abnormal key update, and communication situations between online encryption machines that do not belong to the online encryption machine after the aforementioned two types of comparisons are completed.

[0114] Furthermore, the identity authentication service module first retrieves the authentication information from the first authentication management result, and then compares the authentication information with the current record in the first online status data one by one according to the Device Name and the device ID.

[0115] If the authentication information matches and no anomalies are written in the first device usage status data, this step retains the normal candidate status of the current online encryption machine. If the authentication information is inconsistent, or the Device Name correspondence changes, or the device ID is inconsistent with the current online status record, an authentication information anomaly is directly written. Subsequently, the device management module performs a comparison of the communication status.

[0116] The specific procedure is as follows: extract network port-related records from the first online status data and the first device usage data, and then verify them with the online encryption machine associations registered in the cloud service platform database; if the current communication object does not appear in the registered online encryption machine relationships, or if the current communication object exists but its online status has been changed to offline, then write an abnormal item that does not belong to online encryption machine communication.

[0117] In case of a key update anomaly, the device management module retrieves the key update policy ID from the first device's quantum information and then checks whether the current online status and device usage status support continuing subsequent key update management. If the online status is offline, or if there is an anomaly in the first device usage status data corresponding to the network port or disk, the key update management is marked as aborted and written in along with the anomaly status. Thus, the anomaly status generation is not determined from a single source, but rather by compressing the online status, authentication information, device usage status, and communication status into a unified judgment result.

[0118] Specifically, in a practical engineering embodiment, a standard desktop-mounted online encryption machine is set to online status in S210 and written with a disk anomaly item in S220. This step continues to call its first authentication management result to compare authentication information and finds that the authentication information is consistent. However, in the communication status comparison, it is found that its communication object is not in the currently registered online encryption machine relationship. Therefore, the device management module writes the disk anomaly item and the anomaly item that does not belong to the communication between the online encryption machine and the online encryption machine into the same judgment record and generates the first anomaly status judgment result.

[0119] The first abnormal state determination result is used as the output field name of this step and is directly called by "first abnormal state determination result" in S310. At the same time, the abnormal item type in this result will also participate in the illegal connection blocking process in S320 and the permission verification, KID matching and quantum ciphertext data distribution process in S330 across the main steps.

[0120] In summary, steps S210 to S230 integrate online status, device usage, authentication information, and communication status into a single processing chain, eliminating the need to separate online monitoring and anomaly detection into unrelated auxiliary actions. Compared to the existing processing sequence that only revolves around registration, key retrieval, and encryption / decryption, this step generates the first anomaly status determination result upfront and directly integrates it with subsequent alarm information output and illegal connection blocking, thus subjecting the quantum key service path to pre-determination constraints and making the processing chain more complete.

[0121] In one specific embodiment, firstly, in S210, the online status corresponding to the quantum information of the first device is acquired, and online status collection and processing are performed to obtain first online status data. The device management module extracts the Device Name, Device ID, and timestamp from the quantum information of the first device and initiates online status collection. The triggering conditions for the online status collection are: the online encryption machine is in a registered state, the network port is in a message transmission and reception state, and a device record corresponding to the Device Name exists in the cloud service platform database. The device management module receives status messages from the network port of the currently online encryption machine, and combines them with the most recent online record, the most recent timestamp record, and the current reception time in the cloud service platform database to complete the original online status sampling.

[0122] To address the issue of misjudgment of status caused by status message jitter and brief packet loss, this step introduces an online status stability index within a sliding window. Formula ① calculates the consistency weighted score of the online status over N consecutive sampling periods:

[0123]

[0124] Variable and symbol definition:

[0125] :time Online stability score, value range ;

[0126] : Current time, in seconds (s), derived from the system timestamp;

[0127] : For index from arrive Summation;

[0128] : The reverse index within the sliding window Indicates the current moment. This indicates the previous moment, and so on.

[0129] : Sliding window length (number of sampling points), taken as a positive integer. In this embodiment... ;

[0130] : Corresponding sampling point The weighting coefficients are determined by the exponential decay function. calculate;

[0131] : Natural constant, approximately equal to 2.71828;

[0132] Attenuation factor, taken as ;

[0133] :time The original online status value, with values... (Online) or (Offline), derived from network interface status message parsing;

[0134] denominator : The sum of all weights, used for normalization.

[0135] Simple numerical example: Current time The moment before The first two moments N=3, weight , , Therefore, the numerator = 1 × 1 + 0.6065 × 1 + 0.3679 × 0 = 1.6065, and the denominator = 1 + 0.6065 + 0.3679 = 1.9744. The score is above the threshold of 0.7, indicating a stable online status. Next, the online status processing merges multiple status messages: merging by Device Name and Device ID, sorting by timestamp order, and removing duplicates.

[0136] To quantify the confidence level of the merged state, formula ② calculates the weight of the consolidated state, which integrates timestamp freshness and message continuity:

[0137]

[0138] Variable and symbol definition:

[0139] The final weight of the merged state, with a range of values. ;

[0140] Balance coefficient, taken as ;

[0141] : Natural constant;

[0142] Attenuation factor, taken as The unit is (Decay rate per second);

[0143] The difference between the current status message timestamp and the latest valid timestamp in the database, in seconds (s).

[0144] The number of valid status messages received within the time window;

[0145] Theoretically, the total number of messages that should be received;

[0146] : Valid message ratio.

[0147] Simple numerical examples: seconds, then The first term = 0.6 × 0.8187 = 0.4912; if , The second term = 0.4 × (5 / 6) = 0.3333, then The device management module retains the status corresponding to the latest timestamp and writes the previous status to the history location.

[0148] When an alternation between "online" and "offline" occurs, this alternation, along with a timestamp, is written into the processing result. Finally, this step outputs the first online status data, which includes the Device Name, Device ID, the processed online status (online / offline / to be processed), and the timestamp order. This data is directly used by S220's "first online status data" and is also used by S230's "first online status data".

[0149] Further, in S220, based on the first online status data, the device usage status of CPU, memory, disk, and network port is determined to obtain the first device usage status data. The device management module locates the current online encryption machine according to the Device Name and device ID in the first online status data, and reads the CPU usage, memory usage, disk storage usage, and network port transmit / receive usage.

[0150] To address misjudgments caused by fluctuations in a single indicator and to comprehensively reflect equipment health, this step first constructs relative deviation indicators for each resource item. Formula ③ calculates the instantaneous anomaly index for the i-th resource (i=1 corresponds to CPU, i=2 to memory, i=3 to disk, and i=4 to network port):

[0151]

[0152] Variable and symbol definition:

[0153] : No. Item resources at any time The instantaneous anomaly index;

[0154] Resource index Corresponding CPU, Corresponding memory, Corresponding disk, Corresponding network port;

[0155] : The current moment;

[0156] Absolute value function;

[0157] The number collected at the current moment The resource utilization values ​​(CPU utilization, memory utilization, disk utilization, network bandwidth utilization) are all in percentage (%).

[0158] : No. The average value of a resource during a historical stable period, expressed as a percentage (%).

[0159] : No. Standard deviation of a resource over a historical stable period, in percentage (%).

[0160] : Minimal positive number, take Units and Same (%), used to prevent division by zero.

[0161] Simple numerical example: For CPU, Historical average Standard deviation ,but .

[0162] Then, to comprehensively assess the overall health of the four resources and determine anomalies, formula ④ uses a weighted Euclidean distance to construct a comprehensive score for equipment usage status:

[0163]

[0164] Variable and symbol definition:

[0165] :time The overall health score of the equipment's usage status is used; the higher the value, the more serious the abnormality.

[0166] : Square root function;

[0167] : Resource index from arrive Summation;

[0168] : No. The weight of each resource satisfies Specific values: CPU ,Memory ,disk network port ;

[0169] The first one given by formula ③ The instantaneous anomaly index of the resource;

[0170] : The square of the instantaneous anomaly index.

[0171] like If the online status is not specified, the device is deemed to be in an abnormal condition. Further, the device management module first performs a preliminary check on the online status in the initial online status data: the above judgment is only executed when the online status is "online" or "pending maintenance"; if the online status is "offline," the corresponding items for CPU, memory, disk, and network port are directly written as offline records. For online status, the current occupancy value is read and compared with historical records. If there are consecutive missing values, interrupted occupancy records, or network port records that do not correspond to the online status, the corresponding item is written as abnormal.

[0172] This step outputs the first device usage status data, which includes Device Name, Device ID, anomaly markers for each resource item, and a comprehensive score. This data is directly used by the "First Device Usage Status Data" function in S230 and will be read again as an anomaly source record when S310 organizes alarm information.

[0173] Furthermore, in S230, based on the first online status data and the first device usage data, authentication information comparison, communication status comparison, and abnormal status generation processing are performed to obtain the first abnormal status determination result. The device management module and the identity authentication service module execute this collaboratively. First, the identity authentication service module retrieves the authentication information (including Device Name, Device ID, and registration certificate) from the first authentication management result output in the preceding step S120 and compares it item by item with the current record in the first online status data. Let the comparison consistency index be... This is a binary variable, where 1 indicates complete consistency and 0 indicates inconsistency. Next, the communication status is compared: network port-related records (source IP, destination IP, port) are extracted from the first online status data and the first device usage data, and compared with the registered online encryption machine associations in the cloud service platform database. If the current communication pair does not appear in the registered relationships or the other party's online status is offline, then the communication is marked as abnormal. Otherwise, it is 1. Then, the anomaly generation process compresses the four sources (online anomalies, resource anomalies, identity anomalies, and relationship anomalies) into a unified judgment result. Formula ⑤ calculates the composite anomaly status score:

[0174]

[0175] Variable and symbol definition: :time The composite abnormal state score, with values ​​ranging from... , This indicates no abnormalities. Indicates a complete anomaly;

[0176] Authentication information comparison result, binary variable, value (Inconsistent) or (Consistent);

[0177] Communication status comparison result, binary variable, value (Abnormal, not a legitimate communication pair) or (normal);

[0178] : The function that retrieves the maximum value returns 0. The larger of the values ​​in parentheses;

[0179] The overall health score of the equipment's usage status is given by formula ④;

[0180] : Abnormal equipment usage threshold, taken as ;

[0181] The online state stability score given by formula ① has a range of values. ;

[0182] Parentheses in a product: Indicates resource health factors, when At that time Otherwise less than .

[0183] Simple numerical example: If the authentication is consistent , communication is legal , (If it exceeds 2.5), then Multiply by The product is approximately 0.558. This indicates the presence of a moderate anomaly (primarily due to resource anomalies).

[0184] If the communication status comparison finds that it does not belong to communication between online encryption machines, then This directly makes the product equal to 0. This indicates a complete anomaly. Subsequently, the device management module writes the specific items from the four anomaly sources (online status changing from online to offline, abnormal device usage, inconsistent authentication information, not belonging to an online encryption machine and communicating with an online encryption machine) and key update anomalies (if the online status is offline or there are network port / disk anomalies, then key update management is marked as suspended) into the same judgment record.

[0185] This step also includes a practical engineering example: a rack-mounted online encryption machine, whose online status is calculated using formula ①. (Stable online), the equipment usage status is calculated using formulas ③ and ④. (Normal) The authentication information matches, but during the communication status comparison, it was found that the IP address of the current communication target was not in the list of online encryption machines registered on the cloud platform. Substituting into formula ⑤, we get .

[0186] The device management module generates the first abnormal status judgment result, which includes the exception item "Not belonging to online encryption machine communication", along with the Device Name, Device ID, and timestamp. Finally, formula ⑥ is used to generate the abnormal status code for rapid routing in subsequent steps:

[0187]

[0188] Variable and symbol definition:

[0189] : Exception status code, non-negative integer;

[0190] : Floor function;

[0191] :by A logarithmic function with base 0;

[0192] : Index for exception types from arrive Summation;

[0193] : Exception type index This indicates an online exception. This indicates a resource-related exception. This indicates an identity-related exception. Indicates a relational exception;

[0194] : No. Class exception flag, binary variable, value (No such exception) or (This type of anomaly exists);

[0195] :by Powers with base 0 are used to construct unique combinations and sums.

[0196] addition: Mapping abnormal combinations to Integers.

[0197] Simple numerical example: If only If the rest are 0, then , , Rounding down gives .

[0198] This step outputs the first abnormal state determination result, which includes a composite abnormality score. Exception status codes The specific descriptions and timestamps of each anomaly are directly used by S310 for the "first anomaly state determination result". At the same time, the anomaly types in this result will also participate in the blocking of illegal connections in S320 and the permission verification, KID matching and quantum ciphertext data distribution in S330 across the main steps.

[0199] This section summarizes the technical effects: By using a sliding window stability score, a weighted Euclidean distance-based comprehensive health assessment, and a composite anomaly score mapped to status codes, discrete online, resource, authentication, and communication states are uniformly quantified into transferable judgment results, forming a pre-governance hub that provides clear access criteria for subsequent alarm, blocking, and key distribution steps.

[0200] Step S300 includes at least steps S310-S330:

[0201] S310. Based on the first abnormal state determination result, perform alarm information sorting and alarm information output processing to obtain the first alarm information.

[0202] Specifically, the first abnormal state determination result comes from the preceding step S230 and already includes the online status, device usage status, authentication information comparison result, communication status comparison result, and the corresponding abnormal state item. After the first abnormal state determination result enters this step, it is first received by the device management module, and then the identity authentication service module cooperates to read the Device Name, Device ID, timestamp, and abnormal state corresponding item corresponding to the current online encryption machine.

[0203] The alarm information organization is a process of merging and transcribing the corresponding items of abnormal states. The processing object is not the original message, but the judgment record that has completed the generation of abnormal states.

[0204] Specifically, the device management module first determines whether there are any records in the first abnormal status determination results indicating a change from online to offline, abnormal device usage, abnormal key update, or communication between online encryption machines that do not belong to online encryption machines. If such records exist, the device management module merges the abnormal statuses corresponding to the same online encryption machine into the same alarm record according to the Device Name and Device ID, and writes the timestamps corresponding to each abnormal status into the alarm record in sequence.

[0205] If the above record does not exist, the device management module will write the current online encryption machine to a state of no alarm output and record this state in the cloud service platform database, but will not stop subsequent link reading.

[0206] Furthermore, the alarm information compilation not only retains the anomaly name, but also writes the port type of the currently online encryption machine, the current network port status, the current online status, and the current processing order into the alarm record.

[0207] The reason for this is that when the S320 performs the blocking of illegal connections, it needs to know not only whether there is an abnormal state, but also which online encryption machine the abnormal state occurs on, which network port it corresponds to, and whether it is currently online.

[0208] The alarm information output is completed by the device management module calling the corresponding output interfaces for alarms, WeChat, and SMS. The alarms are alarm records output from within the quantum key cloud platform, while the WeChat and SMS messages are external information outputs to the administrator. Understandably, alarms, WeChat messages, and SMS messages do not need to occur simultaneously, but are called sequentially according to the corresponding abnormal state item in the first abnormal state determination result.

[0209] In practice, if the current online encryption device only changes its online status from online to offline, the device management module first outputs a platform alarm and then forwards the same alarm record to the SMS interface; if the current online encryption device communicates with an online encryption device that is not an online encryption device, the device management module first outputs a platform alarm and then forwards the corresponding content to both the WeChat and SMS interfaces, and writes the output order into the cloud service platform database.

[0210] Furthermore, in a practically operable engineering embodiment, after the rack-mounted online encryption machine completes S230, it generates a first abnormal state determination result. The result shows that the communication state of the online encryption machine does not correspond to communication between online encryption machines, while the network port still has send and receive records.

[0211] After receiving the result, the device management module first merges the abnormal states of the same online encryption machine by Device Name, then organizes the device ID, timestamp, and network port status to form a complete alarm record. Subsequently, it first generates an alarm within the quantum key cloud platform, and then sends it to the administrator via WeChat and SMS.

[0212] After this process is completed, the device management module writes the complete alarm record as the first alarm information. The first alarm information is the output field name of this step, which is written to the cloud service platform database and directly called by the "first alarm information" of S320; at the same time, the abnormal status corresponding items in the first alarm information will be retained in the history of S330 and S430 across the main steps for subsequent permission verification and factory reset.

[0213] S320. Based on the first abnormal state determination result and the first alarm information, perform illegal connection blocking processing to obtain the first blocking processing result.

[0214] Specifically, the first abnormal state determination result and the first alarm information are used as inputs for this step. The former provides the corresponding abnormal state item and the communication state comparison result, while the latter provides the Device Name, Device ID, current network port status, current online status, and alarm output order.

[0215] The blocking of illegal connections is initiated by the device management module, with the quantum key service module assisting in freezing the current connection status and recording subsequent quantum key service termination.

[0216] In this invention, the illegal connection is the processing object directly given by the communication status comparison result of S230. Specifically, it includes current connection relationships that do not belong to online encryption machine communication, current connection relationships with inconsistent authentication information, and current connection relationships where the current online encryption machine has been organized to be offline but the network port still has send and receive records.

[0217] Furthermore, after receiving the aforementioned two inputs, the device management module first extracts records that do not belong to the communication between online encryption machines from the first abnormal state determination result, then extracts the corresponding Device Name, Device ID and current network port status from the first alarm information, and then performs illegal connection blocking processing.

[0218] The practical path for blocking illegal connections is as follows: first, register the current connection as a connection to be blocked in the device management module; then, send a processing instruction to terminate the current connection to the quantum key service module; subsequently, write the blocking status in the cloud service platform database and update the blocking status of the corresponding record of the network port of the current online encryption machine.

[0219] If no illegal connection entry is found in the first abnormal state determination result, but the online status changes from online to offline or the device usage is abnormal, the device management module will not perform network port-level blocking, but will only write a restriction state preventing entry into the quantum key service module. In this way, a constraint relationship is formed between the illegal connection blocking process and the quantum key service path.

[0220] Furthermore, the process for blocking illegal connections also includes processing for repeated illegal connections.

[0221] If an illegal connection has already occurred for the same Device Name at a previous timestamp, and the first abnormal state determination result still gives the same illegal connection record, the device management module will not create a new blocking object again. Instead, it will append a new timestamp and a new alarm output order to the original blocking record and write the appended record into the first blocking processing result.

[0222] Understandably, the minimum set of data for blocking illegal connections in this step includes Device Name, Device ID, current network interface status, corresponding abnormal status items, and current timestamp. WeChat, SMS, and port type are optional extended record items and can be written into the first blocking result along with the first alarm information.

[0223] In a specific implementation scenario involving a rail-mounted online encryption machine, the device management module identifies from the first abnormal state determination result that the communication object of the online encryption machine is not registered in the current online encryption machine relationship, and reads from the first alarm information that the current network port of the online encryption machine is still sending and receiving messages. The device management module then writes this connection as a connection to be blocked, and the quantum key service module stops the subsequent quantum ciphertext data service corresponding to this connection. Subsequently, the blocking timestamp, the network port status before blocking, and the status after blocking are written into the cloud service platform database to form the first blocking processing result.

[0224] The first blocking result is used as the output field name of this step and is directly called by "first blocking result" in S330. At the same time, the restriction state in the first blocking result will affect the quantum ciphertext data verification and quantum key decryption processing of S410 across the main steps, so that the illegal connection processing is consistent with the subsequent quantum key service link.

[0225] S330. Based on the first abnormal state determination result and the first blocking processing result, perform permission verification, KID matching and quantum ciphertext data distribution processing to obtain the first quantum ciphertext distribution data.

[0226] Specifically, the first abnormal state determination result is used to provide the basis for determining whether the current online encryption machine is still in a state where it can access the quantum key service, and the first blocking processing result is used to provide the basis for determining whether the current online encryption machine has entered a restricted state or a blocked state.

[0227] The quantum key management module and the quantum key service module work together to perform this step. The quantum key management module is responsible for permission verification and KID matching, while the quantum key service module is responsible for quantum ciphertext data distribution.

[0228] The permission verification is a further determination of whether the current online encryption machine has the permission to request the quantum key. The verification basis includes the authorization management result formed in the preceding S120, the first device quantum information formed in S130, the first abnormal state determination result formed in S230, and the first blocking processing result formed in S320.

[0229] Specifically, the quantum key management module first reads the corresponding item of the abnormal state from the first abnormal state determination result, and then reads the current connection state from the first blocking processing result.

[0230] If the abnormal status corresponds only to an online status that is normal, authentication information that is consistent, and communication status that has not been triggered and does not belong to communication between online encryption machines, and the first blocking processing result has not been written into the blocking status, then the quantum key management module continues to perform permission verification; if the first blocking processing result has been written into the blocking status, then the quantum key management module stops the current online encryption machine's quantum ciphertext data distribution and writes the stop status into the pre-distribution record of the first quantum ciphertext data distribution.

[0231] Furthermore, after the permission verification is completed, the quantum key management module performs KID matching. The KID is the Key Identifier, abbreviated as KID, which has already been associated with the quantum information of the first device in step S130.

[0232] In this step, the quantum key management module first reads the corresponding KID from the cloud service platform database based on the Device Name and Device ID, and then checks the KID against the current key update policy ID, the current authentication information status, and the current connection status.

[0233] If the KID matches successfully, the quantum ciphertext data distribution begins; if the KID is missing, mismatched, or the quantum key pool record corresponding to the KID does not exist, the quantum key management module writes the current online encryption machine to a non-distribution state and records this state in the distribution anomaly item of the first quantum ciphertext distribution data.

[0234] The quantum ciphertext data distribution is not a regular message transmission. Instead, the quantum key service module calls the quantum identity key, key encryption quantum key, key update quantum key, verification quantum key, and quantum session key corresponding to the current KID in the quantum key pool, generates quantum ciphertext data and key verification data in a predetermined order, and then sends them to the current online encryption machine.

[0235] Furthermore, before distributing the data, the quantum key service module first confirms that the current connection has not been blocked based on the first blocking processing result, and then confirms that the current online encryption machine is not offline and has not triggered a communication state abnormality based on the first abnormal state determination result, before generating the data for this distribution.

[0236] If the current online status changes, the current network port status is interrupted, or the key update strategy ID is written to the aborted state during the generation process, the quantum key service module will interrupt the distribution and write the interruption information into the first quantum ciphertext distribution data.

[0237] Understandably, in a practically feasible engineering embodiment, after a typical desktop-mounted online encryption machine completes S320 without writing a blocking state, the quantum key management module first verifies its permissions to confirm that the online encryption machine has the permission to request a quantum key. Then, it reads the KID corresponding to the preceding S130 and performs KID matching. After successful matching, the quantum key service module retrieves the quantum identity key, key encryption quantum key, key update quantum key, verification quantum key, and quantum session key corresponding to the KID from the quantum key pool, generates the current quantum ciphertext data and key verification data, and sends them to the online encryption machine via the current network port.

[0238] After completing the above processing, the quantum key management module and the quantum key service module jointly write the current distribution record, the current KID state, the current distribution status, and the current timestamp into the first quantum ciphertext distribution data. The first quantum ciphertext distribution data is used as the output field name of this step and is directly called by "first quantum ciphertext distribution data" in S410, and enters the quantum ciphertext data verification and quantum key decryption processing across the main steps.

[0239] In summary, the technical effects of this step are as follows: Steps S310 to S330 integrate the initial anomaly determination result throughout the entire process of alarm information output, blocking unauthorized connections, and quantum ciphertext data distribution. This ensures that the quantum key service is no longer the default path after registration, but a controlled path built upon continuous monitoring, anomaly determination, and blocking processing. Compared to the existing processing sequence centered around registration, negotiation, and encryption / decryption, this step places permission verification and KID matching before quantum ciphertext data distribution and directly writes the blocking status into the distribution chain, making the boundary for the current online encryption machine to enter the quantum key service clearer.

[0240] Step S400 includes at least steps S410-S430:

[0241] S410. Based on the first quantum ciphertext distribution data, perform quantum ciphertext data verification and quantum key decryption processing to obtain the first quantum key acquisition result.

[0242] Specifically, the first quantum ciphertext distribution data comes from the preceding step S330 and already includes the Device Name, Device ID, KeyIdentifier (KID), quantum ciphertext data, key verification data, current distribution status, and current timestamp of the current online encryption machine.

[0243] After the first quantum ciphertext distribution data enters this step, it is received by the local quantum encryption proxy terminal or quantum encryption proxy gateway of the online encryption machine. The internal verification processing unit of the device first performs quantum ciphertext data verification, and then the decryption processing unit performs quantum key decryption processing.

[0244] The quantum ciphertext data verification is a consistency check between the quantum ciphertext data and the key verification data. The basic objects called are the verification quantum key and the key encryption quantum key that have been generated and associated with the quantum information of the first device in the preceding S130.

[0245] In practice, after receiving the first quantum ciphertext distribution data, the online encryption machine first reads the DeviceName and KID, then locates the corresponding verification quantum key in the local device quantum information record based on the DeviceName, and verifies the key verification data. If the verification passes, the current quantum ciphertext data is retained and proceeds to the next step. If the verification fails, the current first quantum ciphertext distribution data is written as a verification failure status, and this status, along with the current timestamp, is written to the corresponding location in the local processing record and the cloud service platform database. Quantum key decryption processing is not continued.

[0246] Furthermore, the quantum key decryption process is a continuous process performed under the condition that the verification is passed. Specifically, the online encryption machine calls the key to encrypt the quantum key to decrypt the quantum ciphertext data. The decryption object includes at least one or more of the quantum identity key, key update quantum key, verification quantum key and quantum session key.

[0247] If the current distribution state in the first quantum ciphertext distribution data is marked as an aborted or restricted state, the decryption processing unit only records the reason for the abort and does not perform decryption. If the current distribution state is an available state, the decryption processing unit completes the decryption according to the KID correspondence and merges the decrypted quantum key set, the current KID state, the current verification state, and the current timestamp into a unified result.

[0248] Understandably, in a practical engineering embodiment, the rack-mounted online encryption machine receives the first quantum ciphertext distribution data in S330. The quantum encryption proxy gateway first extracts the KID from it, and then calls the local verification quantum key to verify the key verification data. After the verification is successful, it calls the key encryption quantum key to decrypt the quantum ciphertext data, obtains the corresponding quantum session key and verification quantum key, and writes the decryption success status and the current timestamp into the first quantum key acquisition result.

[0249] The first quantum key acquisition result is the output field name of this step. This output field name is directly called by S420 for "first quantum key acquisition result". At the same time, the KID status and verification status will also participate in the data encryption and decryption processing and key update management processing of S430 across the main steps.

[0250] S420. Based on the first quantum key acquisition result, perform acquisition confirmation message generation processing to obtain the first acquisition confirmation data.

[0251] Specifically, the first quantum key acquisition result, as the input for this step, already includes the Device Name, Device ID, KID, verification status, decryption status, quantum key set, and current timestamp corresponding to the current online encryption machine.

[0252] The confirmation message generation process is executed by the quantum encryption proxy terminal or quantum encryption proxy gateway on the online encryption machine side, and the confirmation result is received by the device management module on the quantum key cloud platform side.

[0253] The confirmation message is not a regular response message, but a status message formed in response to the acquisition result of the first quantum key. Its processing content includes the current online encryption machine identifier, the current KID, the current verification status, the current decryption status, and the current timestamp.

[0254] Furthermore, after reading the result of the first quantum key acquisition, the online encryption machine first determines whether the verification pass status and the decryption success status are written in it. If both of these statuses are present, an acquisition confirmation message is generated, and the Device Name, Device ID, KID and current timestamp are written in the message. If only the verification pass status is present but the decryption success status is not present, an acquisition confirmation message with a decryption failure mark is generated. If the verification fails, an acquisition confirmation message with a verification failure mark is generated.

[0255] The reason for this is that the quantum key cloud platform needs to use the confirmation message to distinguish whether the online encryption machine has entered the data encryption and decryption process, is still in the verification failure state, or is still in the decryption failure state, so as to provide continuous input for key update management and factory reset processing.

[0256] Furthermore, after the confirmation message is generated, it is first returned to the quantum key cloud platform by the online encryption machine through the current network port, and then archived and recorded by the quantum key service module according to Device Name and KID.

[0257] If the quantum key cloud platform does not receive the corresponding acquisition confirmation message within the set processing time, the device management module will write the current online encryption machine to an unconfirmed state and save the unconfirmed state together with the aforementioned first quantum key acquisition result.

[0258] Understandably, in a workable engineering embodiment, after the rail-mounted online encryption machine completes the decryption of the quantum session key in S410, the quantum encryption agent terminal immediately reads the KID and decryption success status from the first quantum key acquisition result, generates an acquisition confirmation message containing Device Name, Device ID, KID, verification pass status, decryption success status and current timestamp, and then returns it to the quantum key cloud platform through the current network port.

[0259] After receiving the message, the quantum key service module writes it to the end of the corresponding distribution record in the cloud service platform database, forming the first acquisition confirmation data. The first acquisition confirmation data is the output field name of this step. This output field name is directly used by S430 for "first acquisition confirmation data". At the same time, the verification passed status, decryption successful status and unconfirmed status in it will also participate in data encryption and decryption processing, key update management processing and reset password verification processing across the main steps.

[0260] S430. Based on the first obtained confirmation data, perform data encryption and decryption processing, key update management processing, reset password verification and factory reset processing to obtain the first factory reset state.

[0261] Specifically, the first confirmation data comes from the preceding step S420 and already includes the Device Name, Device ID, KID, verification status, decryption status, confirmation message status, and current timestamp corresponding to the current online encryption machine.

[0262] This step is executed collaboratively by the local processing unit of the online encryption machine and the quantum key management module, quantum key service module, and device management module on the quantum key cloud platform side. The former is responsible for data encryption and decryption processing, while the latter is responsible for key update management, password reset verification, and factory reset processing.

[0263] The data encryption and decryption process is the actual processing of the data to be sent or received by the current online encryption machine. The calling objects are the quantum session key obtained by S410 and the current KID confirmed by S420.

[0264] Specifically, when the first confirmation data is written with the verification passed status and the decryption successful status, the online encryption machine loads the current quantum session key into the quantum encryption proxy terminal or quantum encryption proxy gateway, encrypts the sent data, decrypts the received data, and writes the current data encryption / decryption status into the local record.

[0265] If the first confirmed data contains a decryption failure status, a verification failure status, or an unconfirmed status, the current online encryption machine will not proceed with data encryption / decryption processing, but will instead write the status into the restricted status record.

[0266] Furthermore, the key update management process is executed by the quantum key management module based on the key update policy ID already associated in the preceding S130. The key update policy ID corresponds at least to a timed update or a count-based update.

[0267] For timed updates, the quantum key management module reads the destruction time, destruction reminder time, and preloaded key quantity, and prepares a new quantum ciphertext data distribution record when the current timestamp is close to the destruction reminder time. For count updates, the quantum key management module reads the current KID usage count and quantum key quantity to update the set threshold. When the usage count reaches the corresponding condition, the current KID is stopped from being used for data encryption and decryption, and the update request is written to a new processing link.

[0268] Understandably, the key update management process does not operate independently of the preceding steps, but is constrained by the verification status, decryption status, and acknowledgment message status in the first acknowledgment data. If the current online encryption machine is in an unacknowledgment state or a restricted state, the quantum key management module will not initiate a new quantum key distribution, but will only retain the current key update management record.

[0269] Furthermore, the reset password verification and factory reset process is executed by the device management module. The triggering condition is that the current online encryption machine receives a factory reset request, or the device management module records that the current online encryption machine is continuously in a verification failure state, decryption failure state, or unconfirmed state within multiple consecutive processing cycles and receives a factory reset instruction issued by the administrator.

[0270] The reset password is control information that must be verified before the online encryption machine performs a factory reset. The reset password verification process first reads the reset password in the current factory reset request, and then compares it with the reset password record corresponding to the online encryption machine in the cloud service platform database.

[0271] If the reset password is correct, the device management module performs a factory reset process, which includes at least clearing the device quantum information, authentication information, KID record, key update policy ID record, and current distribution record of the current online encryption machine, and writing the online encryption machine back to the registration request status; if the reset password is incorrect, the device management module only writes the reset failure status and does not perform a factory reset.

[0272] In a typical desktop-mounted online encryption machine scenario, after completing S420, the online encryption machine is in a successfully decrypted state. Therefore, it first uses the current quantum session key to encrypt business data. Then, the quantum key management module checks if the current KID is nearing its expiration time according to the key update policy ID. When the update condition is met, it registers the next quantum ciphertext data distribution request. If the online encryption machine repeatedly enters an unconfirmed state during subsequent operation, and the administrator issues a factory reset request through the device management module, the device management module calls the reset password for verification. After successful verification, it clears the device's quantum information, authentication information, KID, and key update policy ID, and then returns the online encryption machine to the registration request state.

[0273] After all the above processes are completed, the device management module merges the factory reset result, return status, and current timestamp of the current online encryption machine and writes it as the first factory reset status.

[0274] The first factory reset state is the output field name of this step. This output field name is closed in the forward loop of this implementation link and corresponds to the "registration request" processing link when re-entering S110. At the same time, the restricted state, update state and factory reset state in the first factory reset state will also be saved by the cloud service platform database for the next round of online status collection and device usage status determination.

[0275] In summary, the technical effects of this step are as follows: S410 to S430 integrate quantum ciphertext data verification, quantum key decryption, acknowledgment message acquisition, data encryption / decryption, key update management, and reset password verification and factory reset into a continuous main chain, rather than as scattered post-processing actions. Compared to existing processes that only focus on the order of key acquisition and encryption / decryption, this step directly integrates acknowledgment message acquisition and key update management before the factory reset, creating a closed loop for quantum key services, key update management, and the entire lifecycle management of the device. This makes the path for the current online encryption machine from distribution, use, and update to returning the registration request status more complete.

[0276] Example 2: Figure 2 This diagram illustrates a structural block diagram of a unified management and key distribution method for encryption machines based on a quantum key cloud, according to an embodiment of the present invention. Figure 2 As shown, the structure may include:

[0277] The registration request processing module 01 is used to acquire registration requests and extract device names, authentication information, and timestamps to obtain first registration request data. Specifically, the registration request processing module receives registration requests from online encryption machines and sequentially reads the device name, authentication information, and timestamp from the registration requests. The registration request processing module internally includes a receiving interface, a field processing interface, and a registration interface. The receiving interface registers the incoming registration requests. The field processing interface extracts the device name, authentication information, and timestamps according to a predetermined field order. The registration interface writes the processed content into the cloud service platform database to form the first registration request data. The first registration request data includes a device name corresponding item, an authentication information corresponding item, and a timestamp corresponding item. The registration request processing module transmits the first registration request data to the identity authentication and authorization management module as processing input and simultaneously retains the current receiving status and time sequence record for subsequent modules to read.

[0278] The identity authentication and authorization management module 02, connected to the registration request processing module, is used to perform identity authentication and authorization management based on the first registration request data to obtain a first authentication management result. Specifically, the identity authentication and authorization management module receives the first registration request data output from the registration request processing module and calls the registered authentication information in the cloud service platform database for corresponding verification. The identity authentication and authorization management module internally sets up an authentication processing interface, an authorization processing interface, and a result registration interface. The authentication processing interface compares the device name, authentication information, and timestamp in the first registration request data item by item. The authorization processing interface registers the permission items of the current online encryption machine after authentication processing is completed. The result registration interface merges the authentication status and authorization status and writes them into the first authentication management result. The first authentication management result records the current online encryption machine's pass status, fail status, and permission status. The identity authentication and authorization management module provides the first authentication management result to the device quantum information generation module for invocation and writes the current processing time and corresponding status into the cloud service platform database for subsequent online status and device usage status processing modules to read.

[0279] The device quantum information generation module 03, connected to the identity authentication and authorization management module, is used to generate device quantum information, associate key identifiers, and associate key update policy identifiers based on the first authentication management result to obtain first device quantum information. Specifically, the device quantum information generation module receives the first authentication management result from the identity authentication and authorization management module and reads the pass status and permission status. The device quantum information generation module internally includes a quantum key retrieval interface, a key identifier association interface, and a key update policy identifier association interface. The quantum key retrieval interface retrieves the quantum identity key, key encryption quantum key, key update quantum key, and verification quantum key corresponding to the current online encryption machine from the quantum key pool. The key identifier association interface establishes a correspondence between the retrieved device quantum information and the key identifier. The key update policy identifier association interface writes the key update policy identifier corresponding to the current online encryption machine and the key identifier into the same record. The device quantum information generation module forms the first device quantum information from the record and passes it to the online status and device usage status processing module for retrieval as the first device quantum information. At the same time, it stores the correspondence between device name, device identifier, key identifier and key update policy identifier in the cloud service platform database.

[0280] The online status and device usage status processing module 04, connected to the device quantum information generation module, is used to acquire the online status corresponding to the first device quantum information, perform online status collection and online status organization, and determine the device usage status corresponding to the central processing unit, memory, disk, and network port based on the online status, thereby obtaining first online status data and first device usage status data. Specifically, the online status and device usage status processing module receives the first device quantum information output from the device quantum information generation module and locates the current online encryption machine according to the device name, device terminal identifier, and key identifier therein. The online status and device usage status processing module internally includes an online status acquisition interface, an online status organization interface, and a device usage status determination interface. The online status acquisition interface receives status messages from the current online encryption machine and registers the current access status. The online status organization interface merges multiple status records corresponding to the same online encryption machine in chronological order to form first online status data. The device usage status determination interface reads the operation records corresponding to the central processing unit, memory, disk, and network port based on the first online status data to form first device usage status data. If the current online encryption device is offline, the device usage status determination interface writes corresponding offline records for the CPU, memory, disk, and network port. If the current online encryption device is online, the device usage status determination interface compares the current records for the CPU, memory, disk, and network port with historical records. The online status and device usage status processing module provides the first online status data and the first device usage status data to the abnormal status and alarm processing module as input, and records the current status order, device usage status order, and corresponding time in the cloud service platform database.

[0281] An abnormal state and alarm processing module 05, connected to the online state and device usage status processing module, is used to perform authentication information comparison, communication status comparison, and abnormal state generation based on the first online state data and the first device usage status data. Based on the generated abnormal states, it organizes and outputs alarm information to obtain a first abnormal state judgment result and a first alarm message. Specifically, the abnormal state and alarm processing module receives the first online state data and the first device usage status data from the online state and device usage status processing module and retrieves the corresponding authentication information item from the preceding records. The abnormal state and alarm processing module internally includes an authentication information comparison interface, a communication status comparison interface, an abnormal state generation interface, an alarm information organization interface, and an alarm information output interface. The authentication information comparison interface checks the current online state record against the authentication information record item by item. The communication status comparison interface checks the relationship between the communication object corresponding to the current network port and the registered online encryption machine. The abnormal state generation interface merges online state abnormalities, device usage status abnormalities, authentication information abnormalities, and communication status abnormalities into a first abnormal state judgment result. The alarm information processing interface organizes the records corresponding to abnormal states according to device name, device identifier, and time sequence to form the first alarm information. The alarm information output interface sends the first alarm information to the alarm channel. The abnormal state and alarm processing module transmits the first abnormal state determination result and the first alarm information to the illegal connection blocking and quantum encrypted data distribution module for invocation, and registers the abnormal state sequence and alarm output status in the cloud service platform database.

[0282] The illegal connection blocking and quantum ciphertext data distribution module 06, connected to the abnormal state and alarm processing module, is used to block illegal connections based on the first abnormal state determination result and the first alarm information, and to perform permission verification, key identifier matching, and quantum ciphertext data distribution based on the first abnormal state determination result and the blocking processing result, obtaining a first blocking processing result and first quantum ciphertext distribution data. Specifically, the illegal connection blocking and quantum ciphertext data distribution module receives the first abnormal state determination result and the first alarm information from the abnormal state and alarm processing module, and reads the current connection relationship according to the corresponding item of the abnormal state. The illegal connection blocking and quantum ciphertext data distribution module internally sets up a blocking processing interface, a permission verification interface, a key identifier matching interface, and a quantum ciphertext data distribution interface. The blocking processing interface performs blocking processing on connection relationships that do not belong to the communication between the online encryption machine and writes the blocking status as the first blocking processing result. The permission verification interface reads the permission record of the current online encryption machine and verifies the request to obtain the quantum key status. The key identifier matching interface retrieves the key identifier according to the device name and device identifier, and verifies the current distribution status. When both the permission record and the key identifier record meet the calling conditions, the quantum ciphertext data distribution interface retrieves the corresponding data from the quantum key pool, generates quantum ciphertext data and key verification data, and forms the first quantum ciphertext distribution data. If the first blocking processing result has been written into the blocking state, the quantum ciphertext data distribution interface stops the current distribution and registers the abort state. The illegal connection blocking and quantum ciphertext data distribution module transmits the first blocking processing result and the first quantum ciphertext distribution data to the quantum key acquisition and factory reset module, and synchronously records the distribution state, blocking state, and current time sequence.

[0283] The quantum key acquisition and factory reset module 07, connected to the illegal connection blocking and quantum ciphertext data distribution module, is used to perform quantum ciphertext data verification and quantum key decryption based on the first quantum ciphertext distribution data to obtain a first quantum key acquisition result. It also generates an acquisition confirmation message based on the first quantum key acquisition result to obtain first acquisition confirmation data. Furthermore, it is used to perform data encryption / decryption, key update management, password reset verification, and factory reset based on the first acquisition confirmation data to obtain a first factory reset state. Specifically, the quantum key acquisition and factory reset module receives the first quantum ciphertext distribution data from the illegal connection blocking and quantum ciphertext data distribution module and reads the current distribution content according to the device name, device identifier, and key identifier. The quantum key acquisition and factory reset module internally includes a quantum ciphertext data verification interface, a quantum key decryption interface, an acquisition confirmation message generation interface, a data encryption / decryption interface, a key update management interface, and a password reset verification and factory reset interface. The quantum ciphertext data verification interface verifies the quantum ciphertext data and the key verification data. After successful verification, the quantum key decryption interface calls the corresponding key to encrypt the quantum key and complete the decryption, obtaining the first quantum key acquisition result. The acquisition confirmation message generation interface generates an acquisition confirmation message based on the first quantum key acquisition result and writes it as the first acquisition confirmation data. The data encryption / decryption interface calls the decrypted quantum session key to execute the current business data processing. The key update management interface registers and switches the current key status according to the key update policy identifier. The reset password verification and factory reset interface receives the factory reset request and reads the reset password record. After successful verification, it clears the device quantum information, authentication information, key identifier, and key update policy identifier, forming the first factory reset state. The quantum key acquisition and factory reset module returns the first factory reset state to the processing link corresponding to the registration request processing module and completes the writing of the current state record, historical record, and update time record.

Claims

1. A method for unified management and key distribution of encryption machines based on quantum key clouds, characterized in that, include: S100: Obtain the registration request, perform identity authentication, authorization management and device quantum information generation processing to obtain the first device quantum information; The registration request is sent by the online encryption machine when it accesses the quantum key cloud platform. The triggering conditions are that the online encryption machine is powered on, the port type is in the access state, and the network port has the conditions for sending and receiving messages. S200. Based on the quantum information of the first device, perform online status acquisition, device usage status determination and abnormal status generation processing to obtain the first abnormal status determination result. The process of generating and processing abnormal states includes: Simultaneously, the first online status data and the first device usage data are acquired and executed collaboratively by the device management module and the identity authentication service module; The authentication information in the first authentication management result is retrieved and compared one by one with the current record in the first online status data. If they are inconsistent, an authentication information exception is written. Extract network port related records and verify their association with registered online encryption machines. If the current communication object does not appear in the registered relationships, write an exception item indicating that it does not belong to communication between online encryption machines. The four types of abnormal sources, namely, changing from online to offline status, abnormal device usage, inconsistent authentication information, and communication between an online encryption machine and a non-online encryption machine, are grouped into a unified judgment result to generate the first abnormal status judgment result. S300. Based on the first abnormal state determination result, perform alarm information sorting, illegal connection blocking processing, permission verification, KID matching and quantum ciphertext data distribution processing to obtain the first quantum ciphertext distribution data. The process of organizing alarm information includes: Based on the first abnormal state determination result, the device management module determines whether there is an abnormal state corresponding item; if so, the abnormal state is merged by Device Name and written into the alarm record, and the port type, current network port status and current online status are also written; the device management module calls the output interface corresponding to alarm, WeChat and SMS to output and generate the first alarm information. The process of blocking illegal connections includes: Based on the first abnormal state determination result and the first alarm information, the device management module extracts records that do not belong to the communication between the online encryption machine and the online encryption machine, registers them as connections to be blocked, sends a processing instruction to terminate the current connection to the quantum key service module, writes the blocking status into the cloud service platform database, and generates the first blocking processing result. The permission verification, KID matching, and quantum ciphertext data distribution process includes: based on the first abnormal state determination result and the first blocking processing result, permission verification continues only when the first abnormal state determination result does not contain an abnormal state and the first blocking processing result does not write a blocking state; after the permission verification is passed, the corresponding KID is read and checked against the current key update policy ID, the current authentication information status, and the current connection status; when the KID matches successfully, the quantum identity key, key encryption quantum key, key update quantum key, verification quantum key, and quantum session key corresponding to the current KID in the quantum key pool are called to generate quantum ciphertext data and key verification data and distribute them; when the KID is missing, the KID is mismatched, or the quantum key pool record corresponding to the KID does not exist, the current online encryption machine is written to a non-distribution status and recorded in the distribution anomaly item; the current distribution record, the current KID status, the current distribution status, and the current timestamp are written into the first quantum ciphertext distribution data; where KID represents key identifier, short for Key Identifier; S400: Based on the first quantum ciphertext distribution data, perform quantum ciphertext data verification, quantum key decryption, and confirmation message generation to obtain the first factory reset state; The process of generating the confirmation message includes: based on the first quantum key acquisition result, an online encryption machine generates an acquisition confirmation message, which includes Device Name, Device ID, KID and current timestamp; when the verification fails or the decryption fails, the corresponding failure flag is written into the message; the returned acquisition confirmation message is written into the first acquisition confirmation data. The process of obtaining the first factory reset state further includes: based on the first confirmed data, when the factory reset setting trigger condition is met, performing a reset password verification and checking the reset password against the reset password record corresponding to the online encryption machine in the cloud service platform database; If the reset password is correct, then the factory reset process is performed. The factory reset process includes clearing the device quantum information, authentication information, KID record, key update policy ID record and current distribution record of the current online encryption machine, and writing the online encryption machine back to the registration request state. If the reset password is incorrect, a reset failure status will be written.

2. The method according to claim 1, characterized in that, The process of obtaining a registration request and performing identity authentication, authorization management, and device quantum information generation includes: Read the Device Name, authentication information, and timestamp from the registration request; For the same Device Name, retain the registration request corresponding to the latest timestamp and mark the previous registration request as a replaced request; Write the processing result into the first registration request data; The identity authentication and authorization management process includes: based on the first registration request data, the identity authentication service module verifies the correspondence between Device Name, Device ID, timestamp order, and the integrity of authentication information; when the verification matches, the online encryption device is written into the authorization management process and a permission boundary is formed; when the verification does not match, the failed status is stored in the first authentication management result. The device quantum information generation process includes: generating device quantum information only for online encryption machines that have passed identity authentication and completed authorization management, wherein the device quantum information includes a quantum identity key, a key encryption quantum key, a key update quantum key, and a verification quantum key; assigning a key identifier KID to each set of device quantum information; associating the KID with a key update strategy ID and writing it into the first device quantum information.

3. The method according to claim 2, characterized in that, The process of online status data collection and equipment usage status assessment includes: The online status acquisition and processing includes: based on the quantum information of the first device, the device management module initiates online status acquisition to distinguish between online and offline status; online encryption devices that have been registered but have not received status messages for a long time are first marked as pending processing status; multiple status messages are merged according to Device Name and Device ID, and the status corresponding to the latest timestamp is retained. The device usage status determination process includes: based on the first online status data, reading the CPU usage, memory usage, disk usage, and network port transceiver usage of the current online encryption machine; when the CPU, memory, disk, and network port are all continuously reporting, it is classified as normal device usage status; when there are continuous missing records, interrupted usage records, or network port records that do not correspond to the online status, it is classified as abnormal device usage status; and the determination result is written into the first device usage status data.

Images