A key management and data security protection method, device, equipment and medium

Abstract

The application discloses a key management and data security protection method, device, equipment and medium, relates to the technical field of information security, and comprises the following steps: generating a pre-quantum asymmetric key pair through a software password component and registering the public key of the pre-quantum asymmetric key pair to a password service platform, generating an asymmetric key pair with quantum resistance, and saving the private key in the asymmetric key pair to the software password component; generating a working key through the password service platform, encapsulating the working key, and then distributing the encapsulated digital envelope to the password component, so that the working key is obtained by unpackaging the digital envelope by using the local first private key, and the working key is encrypted by using the second public key to obtain the key ciphertext; and the working key obtained by decrypting the key ciphertext is used to perform quantum-resistant symmetric encryption on target business data. The application can enhance the quantum-resistant security of business data without the need of quantum-resistant transformation of the password service platform, and improves the security of the business data.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a key management and data security protection method, apparatus, device and medium. Background Technology

[0002] With the rapid development of quantum computing technology, traditional public-key cryptography faces the security risk of being quickly cracked by quantum computing capabilities. However, current government and enterprise information systems, business data platforms, and various edge computing terminals typically still rely on traditional public-key cryptography algorithms for authentication, key negotiation, key distribution, digital envelope encapsulation, and data protection. Once a quantum computing attack with the necessary capabilities becomes a reality, business data and key materials protected by these traditional public-key cryptography systems will face significant security threats and the risk of leakage.

[0003] In real-world business scenarios, core business data typically has long retention periods and high security requirements. Attackers may use a "store first, decrypt later" approach to steal and store currently unbreakable encrypted data, key-encapsulated data, or digital envelopes for extended periods, only to decrypt them later when quantum computing capabilities are available. Furthermore, during the storage, transmission, and retrieval of business data, it may be vulnerable to malicious tampering, forgery, and unauthorized replacement attacks, thereby compromising data integrity and trustworthiness and impacting the secure operation of business systems.

[0004] To address the aforementioned post-quantum security threats, the migration and transformation of quantum-resistant cryptographic algorithms and related cryptographic infrastructure are being gradually promoted. However, the migration to quantum-resistant cryptography is not a one-time event, but a long-term systems engineering project involving multiple stages, including algorithm selection, cryptographic device upgrades, business system adaptation, key management system adjustments, and compliance verification. In actual implementation, pilot transformations are usually prioritized for business application systems with higher security risks, higher business priorities, relatively relaxed business fault tolerance, or stronger transformation feasibility. Traditional centralized cryptographic infrastructure, such as key management services (KMS), cryptographic machine clusters, and certificate authentication systems (CA authentication systems), often find it difficult to simultaneously complete quantum-resistant upgrades due to their wide business scope, high transformation costs, complex compatibility requirements, and long transformation cycles.

[0005] Currently, centralized cryptographic service platforms based on centralized cryptographic infrastructure suffer from the following shortcomings during the quantum-resistant migration transition phase: 1) System upgrade bottlenecks: Traditional system upgrades often require both the central and edge sides to possess quantum-resistant capabilities, leading to stagnation in quantum-resistant migration of the entire system without modifications to the centralized cryptographic infrastructure. 2) High risk of edge data exposure: Edge devices (such as local servers and business terminals) are often in uncontrolled physical environments, making them highly susceptible to theft. 3) Uncertainty regarding quantum-resistant algorithm specifications: Chip implementation requires significant and lengthy modifications and is difficult to meet all operating environments. Independent software cryptographic libraries lack standardized management of the entire key lifecycle, making them prone to data loss due to key loss or alteration. 4) Conflict between compliance and cutting-edge protection: Current compliance frameworks are still primarily based on national cryptographic standards (such as the SM2 algorithm), making it impossible to enhance edge-side quantum-resistant security on the premise of existing centralized cryptographic infrastructure (which only supports national cryptographic standards). Summary of the Invention

[0006] In view of this, the purpose of this application is to provide a key management and data security protection method, apparatus, device, and medium that can directly utilize existing centralized cryptographic infrastructure (such as a cryptographic service platform) to enhance the quantum security of end-side business data without requiring quantum-resistant modifications to the cryptographic service platform. This reduces modification costs and solves the problems of high overall system modification costs and long cycles, as well as the stagnation of overall quantum-resistant migration due to the lack of modification to the centralized cryptographic infrastructure. It achieves secure key management and improves the security of business data. The specific solution is as follows: Firstly, this application discloses a key management and data security protection method applied to an end-side device, wherein the end-side device is equipped with software cryptographic components and has a business application system deployed thereon, including: A pre-quantum asymmetric key pair is generated using a software cryptographic component, and the first public key in the pre-quantum symmetric key pair is registered to the cryptographic service platform. The software cryptographic component generates a first asymmetric key pair and a second asymmetric key pair with quantum resistance properties, and stores the second private key in the first asymmetric key pair and the third private key in the second asymmetric key pair within the software cryptographic component. A digital envelope distribution request is sent to the cryptographic service platform to generate a first quantum-resistant working key through the cryptographic service platform, and the first quantum-resistant working key is encapsulated using the local first public key to obtain a first digital envelope, and then the first digital envelope is sent to the software cryptographic component; The first digital envelope is decapsulated using the software cryptographic component and the first private key to obtain the first quantum-resistant working key, and the first quantum-resistant working key is encrypted using the second public key to obtain the key ciphertext. When it is detected that the business application system needs to encrypt business data, the target business data is encrypted using the software cryptographic component and the first quantum-resistant working key obtained by decrypting the key ciphertext to obtain the business data ciphertext, and the business data ciphertext is sent to the business application system.

[0007] Optionally, the generation of pre-quantum asymmetric key pairs via software cryptographic components includes: A pre-quantum asymmetric key pair is obtained by generating an asymmetric key pair using a software cryptographic component and a pre-quantum asymmetric cryptographic algorithm.

[0008] Optionally, generating the first and second asymmetric key pairs with quantum-resistant properties through the software cryptographic component includes: The software cryptographic component generates a first asymmetric key pair for key encapsulation and a second asymmetric key pair for digital signature using a quantum-resistant cryptographic algorithm.

[0009] Optionally, the step of generating a first quantum-resistant working key through the cryptographic service platform and encapsulating the first quantum-resistant working key using the local first public key to obtain a first digital envelope includes: The first quantum-resistant symmetric working key is obtained by generating a symmetric working key through the cryptographic service platform and using a quantum-resistant symmetric cryptographic algorithm. The first quantum-resistant symmetric working key is then asymmetrically encrypted using the local first public key to obtain a first digital envelope.

[0010] Optionally, the key management and data security protection method further includes: When the generation or modification of business data is detected, the software cryptographic component performs a digest calculation on the newly generated or modified business data to obtain a hash digest. The third private key stored locally in the software cryptographic component is used to perform a digital signature operation on the hash digest to obtain a signature value, and the signature value is bound and stored with the newly generated business data or the changed business data; When the business application system is detected to be loading business data, the software cryptographic component is used to verify the signature of the business data to be loaded using the locally stored third public key and the signature value, and the verification result is obtained. If the signature verification result shows that the signature verification fails, a blocking instruction is generated to prevent the business application system from loading the corresponding business data. If the signature verification result indicates that the signature has been verified, the business application system is allowed to continue loading the corresponding business data.

[0011] Optionally, the step of using the software cryptographic component and the first quantum-resistant working key obtained by decrypting the key ciphertext to encrypt the target business data using quantum-resistant symmetry to obtain the business data ciphertext includes: The first quantum-resistant working key is obtained by decapsulating the key ciphertext using the software cryptographic component and the locally stored second private key. The first quantum-resistant symmetry working key is used as the working master key, and the business attribute factor corresponding to the target business data to be encrypted is obtained through the software cryptographic component. Based on the business attribute factors, the working master key is used to derive a data encryption working key; The target business data to be encrypted is symmetrically encrypted using the data encryption working key to obtain the ciphertext of the business data.

[0012] Optionally, the key management and data security protection method further includes: After the cryptographic service platform is upgraded to support post-quantum cryptographic service capabilities, the second public key is registered to the upgraded cryptographic service platform through the software cryptographic component; A digital envelope distribution request is sent to the cryptographic service platform to generate a second quantum-resistant working key through the cryptographic service platform, and the second quantum-resistant working key is encapsulated using the local second private key to obtain a second digital envelope, which is then distributed to the software cryptographic component. When it is detected that the business application system needs to encrypt business data, the second digital envelope is decapsulated using the software cryptographic component and the second private key stored locally to obtain the second quantum-resistant working key. The second quantum-resistant working key is then used to perform quantum-resistant encryption on the business data to be encrypted to obtain the encrypted business data. The encrypted business data is then sent to the business application system. The first quantum-resistant working key is used to decrypt the ciphertext of the service data to obtain the target service data, and the second quantum-resistant working key is used to encrypt the target service data to obtain new ciphertext data.

[0013] Secondly, this application discloses a key management and data security protection device applied to an end-side device, wherein the end-side device is equipped with software cryptographic components and has a business application system deployed thereon, including: The first generation module is used to generate a pre-quantum asymmetric key pair through a software cryptographic component and register the first public key in the pre-quantum symmetric key pair to the cryptographic service platform. The second generation module is used to generate a first asymmetric key pair and a second asymmetric key pair with quantum-resistant properties through the software cryptographic component. A storage module is used to store the second private key in the first asymmetric key pair and the third private key in the second asymmetric key pair within the software cryptographic component; The request sending module is used to send a digital envelope distribution request to the cryptographic service platform to generate a first quantum-resistant working key through the cryptographic service platform, and to encapsulate the first quantum-resistant working key using the local first public key to obtain a first digital envelope, and then send the first digital envelope to the software cryptographic component. The decapsulation module is used to decapsulate the first digital envelope using the software cryptographic component and the first private key to obtain the first quantum-resistant working key, and to encrypt the first quantum-resistant working key using the second public key to obtain the key ciphertext. The encryption and transmission module is used to, when it is detected that the business application system needs to encrypt business data, use the software cryptographic component and the first quantum-resistant working key obtained by decrypting the key ciphertext to perform quantum-resistant encryption on the target business data to obtain the business data ciphertext, and then send the business data ciphertext to the business application system.

[0014] Thirdly, this application discloses an electronic device, including a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the aforementioned key management and data security protection method.

[0015] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned key management and data security protection method.

[0016] As can be seen, this application is applied to an edge device, which is equipped with a software cryptographic component and a business application system. This system first generates a pre-quantum asymmetric key pair using the software cryptographic component and registers the first public key of the pre-quantum symmetric key pair with a cryptographic service platform. Next, it generates a first asymmetric key pair and a second asymmetric key pair with quantum-resistant properties using the software cryptographic component, and stores the second private key from the first asymmetric key pair and the third private key from the second asymmetric key pair within the software cryptographic component. Then, it sends a digital envelope distribution request to the cryptographic service platform to generate a first quantum-resistant working key, and uses the local first public key to... The first quantum-resistant working key is encapsulated to obtain a first digital envelope, which is then sent to the software cryptographic component. The software cryptographic component decapsulates the first digital envelope using a first private key to obtain the first quantum-resistant working key, and encrypts the first quantum-resistant working key using a second public key to obtain key ciphertext. When it is detected that the business application system needs to encrypt business data, the software cryptographic component uses the first quantum-resistant working key obtained after decrypting the key ciphertext to perform quantum-resistant encryption on the target business data to obtain business data ciphertext, which is then sent to the business application system.

[0017] This application generates a pre-quantum asymmetric key pair through a software cryptographic component located in the end-side device, registers the public key of the pre-quantum symmetric key pair with a cryptographic service platform, and then generates two quantum-resistant asymmetric key pairs through the software cryptographic component, storing the private keys of the two asymmetric key pairs within the cryptographic component. Next, a digital envelope distribution request is sent to the cryptographic service platform to generate a quantum-resistant working key through the service platform, and the public key from the locally stored pre-quantum asymmetric key pair is used to encapsulate the quantum-resistant working key. The encapsulated digital envelope is then sent to the software cryptographic component so that the software cryptographic component can decapsulate the digital envelope using the locally stored private key. Finally, the decapsulated quantum-resistant working key is used to encrypt the business data to be encrypted. As can be seen, this application can directly utilize existing centralized cryptographic infrastructure (such as a cryptographic service platform) to achieve secure protection of business data through independent edge-side software cryptographic components without requiring quantum-resistant modifications to the cryptographic service platform. This approach enhances the quantum-resistant security of edge-side business data, achieving zero modification to the cryptographic service platform, reducing modification costs, and effectively solving the problems of high system-wide modification costs, long cycles, and overall quantum-resistant migration stagnation due to the lack of modification to the centralized cryptographic infrastructure. Furthermore, the cryptographic service platform and the edge-side software cryptographic components (located on the edge devices) adopt a heterogeneous distributed cryptographic architecture, which can fully utilize edge computing power, offloading high-frequency, high-consumption data encryption operations to the edge devices for processing, thereby avoiding the massive data overhead borne by the current cryptographic service platform and network. In addition, the symmetric working key used to encrypt business data is decrypted within a secure area inside the software cryptographic component, ensuring that the plaintext of the working key does not leave the component, achieving secure key management, and thus improving the security of business data. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0019] Figure 1 This is a flowchart of a key management and data security protection method disclosed in this application; Figure 2 This is a flowchart of a specific key management and data security protection method disclosed in this application; Figure 3 This is a schematic diagram of the structure of a key management and data security protection device disclosed in this application; Figure 4This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0020] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] This application discloses a key management and data security protection method applied to an end-side device. The end-side device has a software cryptographic component installed and a business application system deployed. See [link to relevant documentation]. Figure 1 As shown, the method includes: Step S11: Generate a pre-quantum asymmetric key pair using a software cryptographic component, and register the first public key of the pre-quantum symmetric key pair to the cryptographic service platform.

[0022] It should be noted that the key management and data security protection method proposed in this application is specifically applied to end-side devices equipped with software cryptographic components and deployed business application systems. These devices can be deployed locally or remotely on PCs, servers (such as edge servers), local industrial control computers, intelligent business terminals, etc. This application can fully utilize existing centralized cryptographic infrastructure (such as centralized cryptographic service platforms, KMS systems (Key Management Systems), and hardware cryptographic machine clusters). Without requiring quantum-resistant modifications to the centralized cryptographic service platform (which can be deployed in the cloud or headquarters data center, and before upgrades only supports traditional asymmetric algorithms (such as the SM2 algorithm)), the software cryptographic components in independently deployed end-side devices enhance the quantum-resistant security of end-side business data (such as business data in multiple systems including ERP (Enterprise Resource Planning), warehousing, logistics, and procurement in supply chain management scenarios). This achieves low-cost, long-cycle, step-by-step quantum-resistant smooth migration, while simultaneously realizing distributed key management and secure protection of end-side business data.

[0023] The cryptographic service platform and software cryptographic components are deployed using a heterogeneous distributed cryptographic architecture. Additionally, business data can include e-commerce retail data such as payment conversion rate, add-to-cart rate, refund rate, return rate, inventory days, inventory-to-sales ratio, and repurchase rate; or financial credit data such as application approval rate, loan disbursement rate, delinquency rate, bad debt rate, repeat borrowing rate, capital turnover days, customer acquisition cost, and net interest margin.

[0024] In this embodiment, the end device first generates an asymmetric key pair using local software cryptographic components and pre-quantum encryption algorithms, such as the SM2 algorithm (a public-key cryptographic algorithm based on elliptic curve cryptography) and the ECC algorithm (Elliptic Curve Cryptography), to obtain a pre-quantum asymmetric key pair (including a first public key and a first private key). Then, the first public key in the generated pre-quantum symmetric key pair is registered to an existing cryptographic service platform.

[0025] Specifically, generating a pre-quantum asymmetric key pair via a software cryptographic component can include: generating an asymmetric key pair using a software cryptographic component and a pre-quantum asymmetric cryptographic algorithm to obtain a pre-quantum asymmetric key pair. In this embodiment, an asymmetric key pair (including an SM2 public key and an SM2 private key) can be obtained by generating an asymmetric key pair using a software cryptographic component located in the end-side device and the SM2 algorithm.

[0026] Step S12: Generate a first asymmetric key pair and a second asymmetric key pair with quantum resistance properties through the software cryptographic component, and store the second private key in the first asymmetric key pair and the third private key in the second asymmetric key pair in the software cryptographic component.

[0027] In this embodiment, after registering the first public key of the pre-quantum symmetric key pair to the cryptographic service platform, two asymmetric key pairs capable of resisting quantum computer attacks are further generated through a software cryptographic component and a quantum-resistant cryptographic algorithm. These are the first asymmetric key pair and the second asymmetric key pair. Then, the second public key from the first asymmetric key pair and the third public key from the second asymmetric key pair are permanently stored in the software cryptographic component; that is, the second and third public keys are stored locally on the end device. The quantum-resistant cryptographic algorithm includes, but is not limited to, the ML-KEM algorithm (a post-quantum key encapsulation algorithm used to resist quantum computer attacks and establish a secure shared key) and the ML-DSA algorithm (a modular lattice-based quantum-resistant digital signature algorithm).

[0028] Specifically, generating a first asymmetric key pair and a second asymmetric key pair with quantum-resistant properties through the software cryptographic component can include: generating a first asymmetric key pair for key encapsulation and a second asymmetric key pair for digital signature using the software cryptographic component and a quantum-resistant cryptographic algorithm, respectively. In this embodiment, two asymmetric key pairs can be generated first and second using the software cryptographic component and a quantum-resistant cryptographic algorithm; the first asymmetric key pair is used for key encapsulation, and the second asymmetric key pair is used for digital signature. The quantum-resistant cryptographic algorithm includes, but is not limited to, ML-KEM and ML-DSA algorithms based on lattice cryptography. For example, the ML-KEM algorithm can be used to generate an asymmetric key pair resistant to quantum computer cracking, resulting in a first asymmetric key pair (for key encapsulation), and then the ML-DSA algorithm can be used to generate another asymmetric key pair resistant to quantum computer cracking, resulting in a second asymmetric key pair (for digital signature).

[0029] Step S13: Send a digital envelope distribution request to the cryptographic service platform to generate a first quantum-resistant working key through the cryptographic service platform, and encapsulate the first quantum-resistant working key using the local first public key to obtain a first digital envelope, and then distribute the first digital envelope to the software cryptographic component.

[0030] In this embodiment, a digital envelope distribution request can be sent to the cryptographic service platform through the software cryptographic component. When the cryptographic service platform receives the request, it generates a symmetric working key (i.e., a session key or a data encryption key) using a quantum-resistant cryptographic algorithm to obtain a first quantum-resistant symmetric working key. Then, it calls the first public key stored locally on the platform to perform asymmetric encryption on the first quantum-resistant symmetric working key to encapsulate and generate a first digital envelope, and then sends the first digital envelope to the software cryptographic component.

[0031] In this embodiment, the step of generating a first quantum-resistant symmetric working key through the cryptographic service platform and encapsulating the first quantum-resistant symmetric working key using the local first public key to obtain a first digital envelope specifically includes: generating a symmetric working key through the cryptographic service platform using a quantum-resistant symmetric cryptographic algorithm to obtain a first quantum-resistant symmetric working key, and then performing asymmetric encryption on the first quantum-resistant symmetric working key using the local first public key to obtain the first digital envelope. In this embodiment, the cryptographic service platform can generate a symmetric working key using a quantum-resistant symmetric cryptographic algorithm, and then perform asymmetric encryption on the first quantum-resistant symmetric working key using the local first public key (such as an SM2 public key) to encapsulate and generate a digital envelope. The quantum-resistant symmetric cryptographic algorithm includes, but is not limited to, the AES-256 algorithm.

[0032] Step S14: Decapsulate the first digital envelope using the software cryptographic component and the first private key to obtain the first quantum-resistant working key, and encrypt the first quantum-resistant working key using the second public key to obtain the key ciphertext.

[0033] In this embodiment, when the software cryptographic component receives the first digital envelope, it first decrypts it using the first private key (such as the SM2 private key) from the locally stored pre-quantum asymmetric key pair to extract the plaintext of the first quantum-resistant working key. Then, it re-encapsulates the first quantum-resistant working key using its own stored second public key to obtain the ciphertext key used for data encryption, thereby blocking quantum attack threats against the locally stored key and persistently storing the ciphertext key locally. It should be noted that the entire process is performed within the secure area of ​​the software cryptographic component, thus ensuring that the plaintext of the first quantum-resistant working key does not leave the component.

[0034] Step S15: When it is detected that the business application system needs to encrypt business data, the target business data is encrypted using the software cryptographic component and the first quantum-resistant working key obtained by decrypting the key ciphertext to obtain the business data ciphertext, and the business data ciphertext is sent to the business application system.

[0035] In this embodiment, when a business data encryption request (including the target business data to be encrypted and the aforementioned key ciphertext) is received from the business application system, the key ciphertext can be decrypted using the second public key stored in the software cryptographic component to obtain the first quantum-resistant working key plaintext. Then, based on the decrypted first quantum-resistant working key plaintext, a quantum-resistant cryptographic algorithm (such as AES-256) is used to encrypt the target business data using quantum-resistant cryptography to obtain the business data ciphertext. The business data ciphertext is then sent to the business application system and persistently stored within it. Specifically, the business application system can be deployed in the cloud or a headquarters central computer room, responsible for handling specific business logic, and can use the cryptographic services provided by the cryptographic service platform to complete the encryption and decryption operations of the business data.

[0036] In addition, the key management and data security protection method may further include: when business data is detected to be generated or changed, performing a hash digest calculation on the newly generated or changed business data using the software cryptographic component; performing a digital signature operation on the hash digest using the third private key stored locally by the software cryptographic component to obtain a signature value, and binding and storing the signature value with the newly generated or changed business data; when business application system is detected to load business data, verifying the business data to be loaded using the software cryptographic component and the locally stored third public key and the signature value to obtain a verification result; if the verification result shows that the verification fails, generating a blocking instruction to prohibit the business application system from loading the corresponding business data; if the verification result shows that the verification passes, allowing the business application system to continue loading the corresponding business data. In this embodiment, when new business data is generated or existing business data is changed (e.g., modifying existing business data), a hash digest can be calculated using a software cryptographic component. Then, without relying on a cryptographic service platform, a locally stored third private key (i.e., a quantum-resistant private key) can be used to perform a quantum-resistant digital signature operation on the hash digest, generating a signature value. This signature value is then strongly bound to the newly generated or changed business data and stored. When the business application system loads business data, the business data to be loaded can be linked to the bound signature value. The data is sent to the local software cryptographic component. The software cryptographic component retrieves the locally stored third public key, recalculates the hash digest of the incoming business data, and uses the third public key to decrypt the signature value to restore the original hash digest. The two digests are compared and verified. If they match, the signature verification is successful, and the business application system is allowed to load the data normally. If the digests do not match, it indicates that the data has been tampered with, forged, or the signature has expired. The component can immediately issue a blocking command to the business application system to refuse data loading. The entire signature and verification process is completed autonomously by the local key on the client side, without any interaction with the remote cryptographic service platform.

[0037] Furthermore, the key management and data security protection method may further include: after the cryptographic service platform is upgraded to support post-quantum cryptographic service capabilities, registering the second public key to the upgraded cryptographic service platform through the software cryptographic component; sending a digital envelope distribution request to the cryptographic service platform to generate a second quantum-resistant working key through the cryptographic service platform, and encapsulating the second quantum-resistant working key using the local second private key to obtain a second digital envelope, and then distributing the second digital envelope to the software cryptographic component; when it is detected that the business application system needs to encrypt business data, decapsulating the second digital envelope through the software cryptographic component and using the locally stored second private key to obtain the second quantum-resistant working key, and using the second quantum-resistant working key to perform quantum-resistant encryption on the business data to be encrypted to obtain encrypted business data, and then sending the encrypted business data to the business application system; decrypting the ciphertext of the business data using the first quantum-resistant working key to obtain the target business data, and encrypting the target business data using the second quantum-resistant working key to obtain new ciphertext data. In this embodiment, when the central cryptographic infrastructure is equipped with quantum-resistant upgrade capabilities, the hardware and software of the central cryptographic service platform, cryptographic machine, and other cryptographic infrastructure can be upgraded to support quantum-resistant cryptographic algorithms, thereby entering the quantum-resistant smooth transition stage. At this time, a self-generated second public key can be registered with the upgraded cryptographic service platform through a local software cryptographic component, and a digital envelope distribution request can be sent to the cryptographic service platform. This allows the cryptographic service platform to generate a second quantum-resistant symmetric working key, which is then encapsulated using the local second public key to obtain a second digital envelope. This second digital envelope is then distributed to the software cryptographic component. Upon receiving the second digital envelope, the software cryptographic component persistently stores it. When a business application system sends a business data encryption request, the software cryptographic component can decapsulate the second digital envelope using the locally stored second private key to extract the plaintext of the second quantum-resistant symmetric working key. This second quantum-resistant symmetric working key is then used to perform quantum-resistant symmetric encryption on the business data to be encrypted, resulting in encrypted business data, which is then sent to the business application system. For the original ciphertext of business data, the local software cryptographic component can use the original first quantum-resistant working key to decrypt the stored ciphertext of business data to obtain the target business data, and immediately use the newly generated second quantum-resistant working key to encrypt the plaintext target business data, thereby completing the data encryption operation and obtaining the stored ciphertext data based on the new quantum-resistant cryptographic algorithm.

[0038] As can be seen, in this embodiment, a pre-quantum asymmetric key pair is generated by a software cryptographic component located in the end-side device, and the public key of the pre-quantum symmetric key pair is registered with the cryptographic service platform. Then, two asymmetric key pairs with quantum resistance properties are generated by the software cryptographic component, and the private key of the two asymmetric key pairs is stored in the cryptographic component. Next, a digital envelope distribution request is sent to the cryptographic service platform to generate a quantum-resistant working key through the service platform. The public key of the pre-quantum asymmetric key pair stored locally is used to encapsulate the quantum-resistant working key. The encapsulated digital envelope is then sent to the software cryptographic component so that the software cryptographic component can decapsulate the digital envelope using the private key stored locally. Finally, the quantum-resistant working key obtained after decapsulation is used to encrypt the business data to be encrypted. As can be seen, the embodiments of this application can directly utilize existing centralized cryptographic infrastructure (such as a cryptographic service platform) to achieve secure protection of business data through independent edge-side software cryptographic components without requiring quantum-resistant modifications to the cryptographic service platform. This enhances the quantum-resistant security of edge-side business data, achieving zero modification to the cryptographic service platform, reducing modification costs, and effectively solving the problems of high system-wide modification costs, long cycles, and overall quantum-resistant migration stagnation due to the lack of modification to the centralized cryptographic infrastructure. Furthermore, the cryptographic service platform and the edge-side software cryptographic components (located on the edge device) adopt a heterogeneous distributed cryptographic architecture, which can fully utilize edge computing power and offload high-frequency, high-consumption data encryption operations to the edge device for processing, thereby avoiding the huge data overhead borne by the current cryptographic service platform and network. In addition, the symmetric working key used to encrypt business data is decrypted within a secure area inside the software cryptographic component, thus ensuring that the plaintext of the working key does not leave the component, achieving secure key management, and thereby improving the security of business data.

[0039] This application discloses a specific key management and data security protection method applied to an end-side device. The end-side device has a software cryptographic component installed and a business application system deployed. See [link to relevant documentation]. Figure 2 As shown, the method includes: Step S21: Generate a pre-quantum asymmetric key pair using a software cryptographic component, and register the first public key of the pre-quantum symmetric key pair to the cryptographic service platform.

[0040] Step S22: Generate a first asymmetric key pair and a second asymmetric key pair with quantum resistance properties through the software cryptographic component, and store the second private key in the first asymmetric key pair and the third private key in the second asymmetric key pair in the software cryptographic component.

[0041] Step S23: Send a digital envelope distribution request to the cryptographic service platform to generate a first quantum-resistant working key through the cryptographic service platform, and encapsulate the first quantum-resistant working key using the local first public key to obtain a first digital envelope, and then distribute the first digital envelope to the software cryptographic component.

[0042] Step S24: Decapsulate the first digital envelope using the software cryptographic component and the first private key to obtain the first quantum-resistant working key, and encrypt the first quantum-resistant working key using the second public key to obtain the key ciphertext.

[0043] Step S25: When it is detected that the business application system needs to encrypt business data, the key ciphertext is decapsulated using the software cryptographic component and the second private key stored locally to obtain the first quantum-resistant working key. The first quantum-resistant working key is used as the working master key, and the business attribute factor corresponding to the target business data to be encrypted is obtained through the software cryptographic component.

[0044] In this embodiment, when a data encryption request containing target business data and key ciphertext is received from a business application system, the key ciphertext can be decapsulated first through a software cryptographic component using a locally stored second private key to obtain a first quantum-resistant working key plaintext (K_m). Then, the first quantum-resistant working key (K_m) is used as the working master key, and the business attribute factor corresponding to the target business data to be encrypted is obtained through the software cryptographic component.

[0045] Step S26: Derivate the working master key based on the business attribute factor to obtain the data encryption working key.

[0046] In this embodiment, in order to prevent the key from being overused and causing security degradation, the business application system does not directly use the working key to encrypt data. Instead, it can perform key derivation / derivation on the working master key based on the above-mentioned business attribute factors to obtain a new working key, namely the data encryption working key.

[0047] The specific derivation process can be as follows: The business application system inputs specific business attribute factors, such as the current timestamp, device MAC address, file unique identifier ID, or user ID, along with the working master key (i.e., K_m), into a key derivation function (such as HKDF, SM3-KDF, etc.) to obtain the data encryption working key (K_d). For example, K_d = KDF (K_m, business attribute factors}.

[0048] Step S27: Use the data encryption working key to perform symmetric encryption on the target business data to be encrypted to obtain the business data ciphertext, and send the business data ciphertext to the business application system.

[0049] In this embodiment, the business data ciphertext can be obtained by using the above-mentioned data encryption working key (K_d) and the algorithm to perform symmetric encryption on the target business data to be encrypted, and then the business data ciphertext can be sent to the business application system.

[0050] For more detailed processing procedures of steps S21 to S24, please refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0051] As can be seen, in this embodiment, when the business application system detects that business data encryption is required, the key ciphertext is decapsulated using a software cryptographic component and a locally stored second private key to obtain a first quantum-resistant symmetric working key. This first quantum-resistant symmetric working key is used as the working master key. The software cryptographic component obtains the business attribute factor corresponding to the target business data to be encrypted, and then performs key derivation on the working master key based on the business attribute factor to obtain a data encryption working key. Finally, the data encryption working key is used to perform symmetric encryption on the target business data to be encrypted to obtain the business data ciphertext, which is then sent to the business application system. Therefore, this application can leverage existing centralized cryptographic infrastructure and edge-side quantum-resistant enhancement capabilities to achieve a low-cost, zero-disruption smooth migration of a quantum-resistant cryptographic system: initially, it completely reuses the existing centralized cryptographic service platform that has not undergone quantum-resistant modification, achieving zero modification on the central side, limiting the scope of modification to a finite domain, and placing quantum-resistant protection at the data-generating edge, thereby effectively solving the problems of high modification costs and the overall stagnation of quantum-resistant migration due to the lack of modification to the centralized cryptographic infrastructure. Furthermore, this application reduces the threat risk of storing and then decrypting: by immediately using the quantum-resistant public key repackaging on the receiving end after sending, the security of the long-term ciphertext key stored on disk on the end side is guaranteed, thereby reducing the exposure surface and exposure time of quantum security threats; in addition, this application alleviates the central performance pressure through the separation of cryptographic responsibilities: by making full use of local end-side computing power, high-frequency and high-consumption data encryption operations are pushed down to the end-side local processing, avoiding the cryptographic service platform and network bearing huge data overhead.

[0052] Accordingly, this application also discloses a key management and data security protection device applied to an end-side device. The end-side device is equipped with software cryptographic components and has a business application system deployed thereon. (See also...) Figure 3 As shown, the device includes: The first generation module 11 is used to generate a pre-quantum asymmetric key pair through a software cryptographic component and register the first public key in the pre-quantum symmetric key pair to the cryptographic service platform. The second generation module 12 is used to generate a first asymmetric key pair and a second asymmetric key pair with quantum-resistant properties through the software cryptographic component. Storage module 13 is used to store the second private key in the first asymmetric key pair and the third private key in the second asymmetric key pair in the software cryptographic component; The request sending module 14 is used to send a digital envelope distribution request to the cryptographic service platform to generate a first quantum-resistant working key through the cryptographic service platform, and to encapsulate the first quantum-resistant working key using the local first public key to obtain a first digital envelope, and then send the first digital envelope to the software cryptographic component. The decapsulation module 15 is used to decapsulate the first digital envelope using the software cryptographic component and the first private key to obtain the first quantum-resistant working key, and to encrypt the first quantum-resistant working key using the second public key to obtain the key ciphertext. The encryption and transmission module 16 is used to, when it is detected that the business application system needs to encrypt business data, use the software cryptographic component and the first quantum-resistant working key obtained after decrypting the key ciphertext to perform quantum-resistant encryption on the target business data to obtain the business data ciphertext, and send the business data ciphertext to the business application system.

[0053] The specific workflow of each of the above modules can be found in the relevant content disclosed in the foregoing embodiments, and will not be repeated here.

[0054] Furthermore, embodiments of this application also disclose an electronic device, Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0055] Figure 4 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the key management and data security protection methods disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0056] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0057] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0058] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs capable of performing the key management and data security protection methods disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0059] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed key management and data security protection method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0060] Furthermore, embodiments of this application also disclose a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the key management and data security protection method disclosed above.

[0061] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0062] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0063] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0064] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0065] The foregoing has provided a detailed description of a key management and data security protection method, apparatus, device, and medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for key management and data security protection, characterized in that, The method, applied to an end-side device equipped with a software cryptographic component and a deployed business application system, includes: A pre-quantum asymmetric key pair is generated using a software cryptographic component, and the first public key in the pre-quantum symmetric key pair is registered to the cryptographic service platform. The software cryptographic component generates a first asymmetric key pair and a second asymmetric key pair with quantum resistance properties, and stores the second private key in the first asymmetric key pair and the third private key in the second asymmetric key pair within the software cryptographic component. A digital envelope distribution request is sent to the cryptographic service platform to generate a first quantum-resistant working key through the cryptographic service platform, and the first quantum-resistant working key is encapsulated using the local first public key to obtain a first digital envelope, and then the first digital envelope is sent to the software cryptographic component; The first digital envelope is decapsulated using the software cryptographic component and the first private key to obtain the first quantum-resistant working key, and the first quantum-resistant working key is encrypted using the second public key to obtain the key ciphertext. When it is detected that the business application system needs to encrypt business data, the target business data is encrypted using the software cryptographic component and the first quantum-resistant working key obtained by decrypting the key ciphertext to obtain the business data ciphertext, and the business data ciphertext is sent to the business application system.

2. The key management and data security protection method according to claim 1, characterized in that, The generation of pre-quantum asymmetric key pairs via software cryptographic components includes: A pre-quantum asymmetric key pair is obtained by generating an asymmetric key pair using a software cryptographic component and a pre-quantum asymmetric cryptographic algorithm.

3. The key management and data security protection method according to claim 1, characterized in that, The generation of a first asymmetric key pair and a second asymmetric key pair with quantum resistance properties through the software cryptographic component includes: The software cryptographic component generates a first asymmetric key pair for key encapsulation and a second asymmetric key pair for digital signature using a quantum-resistant cryptographic algorithm.

4. The key management and data security protection method according to claim 1, characterized in that, The process of generating a first quantum-resistant working key through the cryptographic service platform and encapsulating the first quantum-resistant working key using the local first public key to obtain a first digital envelope includes: The first quantum-resistant symmetric working key is obtained by generating a symmetric working key through the cryptographic service platform and using a quantum-resistant symmetric cryptographic algorithm. The first quantum-resistant symmetric working key is then asymmetrically encrypted using the local first public key to obtain a first digital envelope.

5. The key management and data security protection method according to claim 1, characterized in that, Also includes: When the generation or modification of business data is detected, the software cryptographic component performs a digest calculation on the newly generated or modified business data to obtain a hash digest. The third private key stored locally in the software cryptographic component is used to perform a digital signature operation on the hash digest to obtain a signature value, and the signature value is bound and stored with the newly generated business data or the changed business data; When the business application system is detected to be loading business data, the software cryptographic component is used to verify the signature of the business data to be loaded using the locally stored third public key and the signature value, and the verification result is obtained. If the signature verification result shows that the signature verification fails, a blocking instruction is generated to prevent the business application system from loading the corresponding business data. If the signature verification result indicates that the signature has been verified, the business application system is allowed to continue loading the corresponding business data.

6. The key management and data security protection method according to claim 5, characterized in that, The step of using the software cryptographic component and the first quantum-resistant working key obtained by decrypting the key ciphertext to encrypt the target business data using quantum-resistant symmetry to obtain the business data ciphertext includes: The first quantum-resistant working key is obtained by decapsulating the key ciphertext using the software cryptographic component and the locally stored second private key. The first quantum-resistant symmetry working key is used as the working master key, and the business attribute factor corresponding to the target business data to be encrypted is obtained through the software cryptographic component. Based on the business attribute factors, the working master key is used to derive a data encryption working key; The target business data to be encrypted is symmetrically encrypted using the data encryption working key to obtain the ciphertext of the business data.

7. The key management and data security protection method according to any one of claims 1 to 6, characterized in that, Also includes: After the cryptographic service platform is upgraded to support post-quantum cryptographic service capabilities, the second public key is registered to the upgraded cryptographic service platform through the software cryptographic component; A digital envelope distribution request is sent to the cryptographic service platform to generate a second quantum-resistant working key through the cryptographic service platform, and the second quantum-resistant working key is encapsulated using the local second private key to obtain a second digital envelope, which is then distributed to the software cryptographic component. When it is detected that the business application system needs to encrypt business data, the second digital envelope is decapsulated using the software cryptographic component and the second private key stored locally to obtain the second quantum-resistant working key. The second quantum-resistant working key is then used to perform quantum-resistant encryption on the business data to be encrypted to obtain the encrypted business data. The encrypted business data is then sent to the business application system. The first quantum-resistant working key is used to decrypt the ciphertext of the service data to obtain the target service data, and the second quantum-resistant working key is used to encrypt the target service data to obtain new ciphertext data.

8. A key management and data security protection device, characterized in that, An apparatus for use in edge devices, wherein the edge device is equipped with software cryptographic components and deploys a business application system, the apparatus comprising: The first generation module is used to generate a pre-quantum asymmetric key pair through a software cryptographic component and register the first public key in the pre-quantum symmetric key pair to the cryptographic service platform. The second generation module is used to generate a first asymmetric key pair and a second asymmetric key pair with quantum-resistant properties through the software cryptographic component. A storage module is used to store the second private key in the first asymmetric key pair and the third private key in the second asymmetric key pair within the software cryptographic component; The request sending module is used to send a digital envelope distribution request to the cryptographic service platform to generate a first quantum-resistant working key through the cryptographic service platform, and to encapsulate the first quantum-resistant working key using the local first public key to obtain a first digital envelope, and then send the first digital envelope to the software cryptographic component. The decapsulation module is used to decapsulate the first digital envelope using the software cryptographic component and the first private key to obtain the first quantum-resistant working key, and to encrypt the first quantum-resistant working key using the second public key to obtain the key ciphertext. The encryption and transmission module is used to, when it is detected that the business application system needs to encrypt business data, use the software cryptographic component and the first quantum-resistant working key obtained by decrypting the key ciphertext to perform quantum-resistant encryption on the target business data to obtain the business data ciphertext, and then send the business data ciphertext to the business application system.

9. An electronic device, characterized in that, It includes a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the key management and data security protection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein, when the computer programs are executed by a processor, they implement the key management and data security protection method as described in any one of claims 1 to 7.

Images