An encryption agility security management system and method supporting post-quantum cryptography

Abstract

This invention discloses a secure and agile cryptographic management system and method supporting post-quantum cryptography. The system includes a cryptographic capability scanning and evaluation unit, a remote acquisition and verification unit for cryptographic algorithm modules, and a hot-swappable algorithm replacement engine. Signed cryptographic algorithm modules and digital certificates are acquired through a quantum-resistant cryptographic secure channel. After verification by a hardware root of trust, a double-buffered hot-swappable approach is used to dynamically upgrade the cryptographic algorithm without interrupting business operations. Switching employs a transaction-level consistency pointer switching mechanism. The system includes a hardware capability compatibility detection step to ensure that upgrades are only performed on devices that meet the minimum computing resource requirements. A performance monitoring and automatic rollback unit supports dynamic adjustment of performance thresholds based on business type, automatically triggering circuit breaker rollback when latency exceeds the threshold. This invention is particularly suitable for post-quantum cryptography migration scenarios, solving the problem that existing AI devices cannot acquire quantum attack resistance capabilities without replacing hardware chips.

Description

Technical Field

[0001] This invention relates to the fields of cryptography and information security technology, specifically to a management system and method that enables existing deployed AI devices to smoothly acquire resistance to quantum computing attacks through remote security upgrades without replacing the underlying hardware security chip. Background Technology

[0002] NIST has officially approved CRYSTALS-Kyber and CRYSTALS-Dilithium as post-quantum cryptography standards. Billions of existing devices deployed globally generally use RSA and ECC to protect data. Replacing all existing devices would be extremely costly. Existing cryptographic agility solutions generally require device downtime or restarts and are not combined with hardware root of trust verification. Summary of the Invention

[0003] This invention obtains a signed cryptographic algorithm module through a quantum-resistant encrypted secure channel. After verification by a hardware root of trust, it uses a double-buffered hot-swappable method to dynamically upgrade the encryption algorithm without service interruption during the switchover. Digital certificates ensure backward compatibility. Automatic rollback occurs upon self-test failure. This system is particularly suitable for post-quantum cryptography migration scenarios. In one specific embodiment, the digital certificate adopts a cascaded certificate structure, comprising a first certificate signed with a traditional cryptographic algorithm and a second certificate signed with a post-quantum cryptographic algorithm. The two certificates are linked through extended fields, and authentication requires both certificates to pass verification. This structure ensures seamless compatibility between the old and new systems during the transition period of hybrid cryptography. In one specific embodiment, when scanning the encryption capabilities of existing devices, the system simultaneously assesses whether the devices' hardware capabilities meet the minimum computational resource requirements of the new cryptographic algorithm. Device hardware capability assessment indicators include whether the device supports the AVX2 instruction set and whether its available memory is not less than a preset baseline capacity. When the device's hardware capabilities do not meet the requirements, the system automatically marks the device as hardware incompatible and prompts the administrator to perform a hardware upgrade, not just an encryption agility upgrade. When the device's hardware capabilities meet the requirements, the system continues with the subsequent upgrade process. In one specific embodiment, the preset performance threshold is dynamically adjusted according to the business type. A first threshold is used for the first type of business, financial transactions, which have high real-time requirements, and a second threshold is used for the second type of business, background batch processing, which has low real-time requirements. The first threshold is less than the second threshold. In one specific embodiment, the cryptographic policy dynamic evolution module obtains the latest cryptographic standard updates and algorithm security assessment information released by relevant organizations through a pre-set standard update interface, automatically parses the algorithm security level changes and standardization dynamics contained therein, generates upgrade suggestions based on these suggestions, and pushes them to the administrator. When the system detects that the latency of the newly loaded cryptographic algorithm module exceeds a preset performance threshold when processing requests, the performance monitoring and automatic rollback unit automatically triggers a circuit breaker rollback, restoring the encryption algorithm to the stable version before the upgrade, ensuring that the quality of business services is not affected. The rollback operation also adopts a double-buffering mechanism, ensuring that business services are not interrupted during the rollback process. Attached Figure Description

[0004] Figure 1 This is a schematic diagram of the system architecture of the present invention; Figure 2 Flowchart for dual-buffered hot-swap replacement. Detailed Implementation

[0005] The present invention will now be described in detail with reference to the accompanying drawings and embodiments: A large enterprise has deployed an AI inference cluster comprising 5,000 servers, currently using a hybrid encryption method of RSA-2048 and AES-256. An encryption capability scanning and evaluation unit performs a full-stack encryption scan on all devices, simultaneously evaluating whether the hardware capabilities of each device meet the minimum computational resource requirements of post-quantum cryptography algorithms. In one specific embodiment, device hardware capability evaluation indicators include whether the device supports the AVX2 instruction set and whether its available memory is not less than a preset baseline capacity. Devices that do not meet the hardware requirements are marked as hardware incompatible, prompting the administrator to upgrade the hardware; for devices that meet the requirements, RSA-2048 is marked as quantum fragile. The cryptographic algorithm module remote acquisition and verification unit obtains the CRYSTALS-Kyber-1024 key encapsulation module and the CRYSTALS-Dilithium-5 digital signature module through a secure channel encrypted with CRYSTALS-Kyber. The acquired modules come with digital certificates signed by a trusted distribution source. In one specific embodiment, the digital certificates employ a cascaded certificate structure, containing a first certificate with a traditional RSA signature and a second certificate with a CRYSTALS-Dilithium signature. The hardware root of trust verifies the trustworthiness of the signature confirmation module's source. The hot-swappable algorithm replacement engine initiates a dual-buffered switchover: In Buffer A, RSA-2048 continues to process requests normally; in Buffer B, the Kyber-1024 module is loaded and initialized and self-tested. After the self-test passes, the engine completes the transaction-level consistency pointer switchover within one scheduling cycle. During the switchover, the encrypted state of all established sessions remains continuous, and no business interruption occurs. If the self-test fails after the upgrade, it automatically rolls back to all RSA functions. In the upgraded operational monitoring, the performance monitoring and automatic rollback unit continuously monitors the processing latency of the new algorithm. In one specific embodiment, the preset performance threshold is dynamically adjusted according to the service type. If the detected latency exceeds the performance threshold for the corresponding service type of the device, a circuit breaker rollback is automatically triggered, restoring the encryption algorithm to the stable version before the upgrade. The rollback operation also adopts a double-buffering mechanism, ensuring uninterrupted service during the rollback process. The cryptographic policy dynamic evolution module obtains the latest cryptographic standard updates and algorithm security assessment information released by relevant organizations through a pre-built standard update interface. When a new standardized algorithm is detected or the security rating of the current algorithm is downgraded, upgrade suggestions are proactively pushed.

Claims

1. A cryptographically agile security management system supporting post-quantum cryptography, characterized in that, include: The encryption capability scanning and evaluation unit is used to perform a comprehensive scan of the current encryption configuration of the deployed existing devices, generate a list of current encryption configurations including traditional cryptographic algorithm types, key lengths, application protocols and encryption interfaces, and evaluate the risk level of each encryption configuration's resistance to quantum attacks. The cryptographic algorithm module remote acquisition and verification unit is communicatively connected to the encryption capability scanning and evaluation unit. It is used to acquire the digitally signed cryptographic algorithm module and the corresponding digital certificate from a trusted distribution source through a quantum-resistant secure channel. The acquired cryptographic algorithm module must be signed and verified by the hardware root of trust before being loaded. A hot-swappable algorithm replacement engine communicates with the remote acquisition and verification unit of the cryptographic algorithm module. It dynamically unloads or downgrades the old encryption algorithm module and loads and activates the new one without interrupting normal device operation and upper-layer business services. Employing a double-buffering mechanism, the new cryptographic algorithm module is pre-loaded and initialized in the background. After completing its self-test, it switches pointer references to achieve transaction-level consistency between the old and new modules. During the switch, the encryption state of all established sessions remains continuous, preventing business interruption. This system is particularly suitable for post-quantum cryptography migration scenarios, enabling deployed existing devices to smoothly gain resistance to quantum computing attacks through remote security upgrades without replacing the underlying hardware security chip.

2. The system according to claim 1, characterized in that, It also includes a post-quantum security capability self-testing unit and a cryptographic policy dynamic evolution module; the self-testing unit automatically performs a self-test after the upgrade is completed, and automatically rolls back if the self-test fails; the cryptographic policy dynamic evolution module obtains the latest cryptographic standard updates and algorithm security assessment information released by relevant organizations through a pre-set standard update interface, and automatically pushes upgrade suggestions to the administrator when it detects that the security level of the currently used encryption algorithm has decreased or a new standardized algorithm has been released.

3. The system according to claim 1, characterized in that, The hot-swappable algorithm replacement engine generates a complete upgrade log after the replacement is completed, and then uses a hardware root of trust to hash and solidify the evidence.

4. The system according to claim 1, characterized in that, It also includes a performance monitoring and automatic rollback unit: when the system detects that the latency of the newly loaded cryptographic algorithm module in processing requests exceeds the preset performance threshold, it automatically triggers circuit breaker rollback to restore the encryption algorithm to the stable version before the upgrade, ensuring that the quality of business services is not affected.

5. The system according to claim 4, characterized in that, The preset performance threshold is dynamically adjusted according to the service type. A first threshold is used for the first type of service with high real-time requirements, and a second threshold is used for the second type of service with low real-time requirements. The first threshold is less than the second threshold.

6. A method for managing cryptographic agility and security in post-quantum cryptography, characterized in that, Includes the following steps: Encryption capability scanning and evaluation steps: Perform full-stack encryption configuration scanning and quantum attack resistance risk level assessment on existing devices; Secure acquisition steps for cryptographic algorithm module: Obtain the signed cryptographic algorithm module and digital certificate through a quantum-resistant encrypted secure channel; Hot-swappable replacement steps: A double-buffering mechanism is used to dynamically unload, downgrade, or upgrade the encryption algorithm without interrupting business operations; this method is particularly suitable for post-quantum cryptography migration scenarios.

Images