An encryption management platform for network information security

Abstract

The application discloses a kind of encryption management platform of network information security, the present application relates to network information security technical field, including password asset perception module, double-track key management module, zero-trust dynamic key management module and ciphertext field calculation key control module, password asset perception module periodic inventory business node encryption algorithm capability forms password bill of materials, double-track key management module is calculated compatibility score between nodes accordingly, it realizes that classical algorithm and post-quantum cryptography algorithm double-track key adaptive negotiation and smooth switching, zero-trust dynamic key management module is based on behavior, equipment fingerprint, traffic characteristics and environmental context calculates trust confidence, implements hierarchical dynamic management to key, ciphertext field calculation key control module is based on the authorization level of computing power node and threshold secret sharing scheme, realizes the distributed issue and dynamic cancellation of bootstrap key and evaluation key.

Description

Technical Field

[0001] This invention relates to the field of network information security technology, specifically to an encrypted management platform for network information security. Background Technology

[0002] With the deepening of digital transformation and the continuous breakthroughs in quantum computing power, traditional network security encryption architectures are facing unprecedented challenges. Currently, public key encryption systems represented by RSA and ECC are at risk of being cracked in the face of quantum computing attacks. Quantum-resistant cryptographic migration has become an industry trend. At the same time, zero-trust security architecture is gradually becoming an industry consensus for enterprise security construction. Its core idea is to continuously evaluate the trust status of any access subject rather than granting authorization once. In addition, privacy computing technologies such as fully homomorphic encryption and multi-party secure computation are moving from academic research to commercial application, becoming an important technical support for scenarios where data is available but not visible. As the root of trust and scheduling center of the entire encryption system, the key management system undertakes the full lifecycle management responsibilities of key generation, distribution, storage, rotation, revocation and destruction, and is the key infrastructure for the implementation of the above-mentioned technological trends.

[0003] Currently, in the industry and in published patent literature, encryption management platform solutions that are relatively close to this invention usually consist of a key generation module, a key storage module implemented based on a hardware security module, a key distribution module, and a policy management module. Their operating logic is as follows: the administrator pre-configures the key's algorithm type, validity period, and applicable scope in the policy management module.

[0004] The key generation module calls the underlying cryptographic machine to generate a key according to a preset strategy and stores it in the key storage module.

[0005] The key distribution module distributes keys to business nodes through a pre-configured secure channel;

[0006] When a key reaches its preset validity period, the system triggers a rotation process according to a fixed cycle, generates a new key to replace the old key, and marks the expired key through a certificate revocation list or online certificate status protocol.

[0007] The existing solutions mentioned above have the following shortcomings: First, the key algorithm system of such platforms typically only supports a single classical cryptographic algorithm family, lacking an automated inventory mechanism for the cryptographic capabilities of all nodes in the network. When some nodes in the network have acquired post-quantum cryptographic capabilities while others remain at the classical algorithm stage, the platform cannot perceive this heterogeneous coexistence state, and therefore cannot provide a key negotiation strategy adapted to the capabilities of each node. If a forced uniform replacement of the encryption algorithm is implemented, it is highly likely to cause protocol incompatibility between the old and new nodes and trigger business communication interruptions. Second, the key lifecycle scheduling of such platforms relies entirely on pre-set time thresholds, and the key validity judgment depends only on the time dimension without considering the user. Contextual risks such as behavior, device status, and traffic characteristics mean that even when the trust status of the accessing subject has deteriorated, the issued keys can still be used normally, thus creating a security blind spot where identity trust has decreased but the keys are still valid. Thirdly, the key management objects of such platforms are limited to regular keys used to protect the static storage or transmission of data. They do not have the ability to specifically manage computational keys such as bootstrap keys and evaluation keys in fully homomorphic encryption scenarios. The generation and use of such keys are accompanied by high computing power overhead and cross-domain collaboration requirements. Existing key models cannot cover their authorization, issuance, and cancellation logic, which restricts the large-scale engineering implementation of privacy computing technologies such as homomorphic encryption. Summary of the Invention

[0008] The technical problems to be solved by this invention include three aspects:

[0009] First, during the transition period from classical cryptography to post-quantum cryptography, how can we achieve automated perception of the cryptographic capabilities of all network encryption nodes and smooth distribution, negotiation, and switching of dual-track keys for classical and post-quantum cryptography algorithms, avoiding business interruptions and interoperability issues caused by inconsistent node upgrade progress?

[0010] Second, under the zero-trust architecture, how can the lifecycle management of keys be freed from the constraints of static allocation and periodic rotation mode, and how can real-time risk perception be achieved based on contextual information such as user behavior, device fingerprints and traffic characteristics, and accordingly, dynamic de-weighting, forced renegotiation or fine-grained revocation of issued keys?

[0011] Third, how to construct a distributed management and control mechanism that adapts to the high computing overhead and cross-domain collaborative computing characteristics of computational keys such as bootstrapping keys and evaluation keys, which are unique in ciphertext domain computing scenarios such as homomorphic encryption.

[0012] To address the aforementioned technical problems, this invention provides a network information security encryption management platform, comprising a cryptographic asset awareness module, a dual-track key governance module, a zero-trust dynamic key governance module, a ciphertext domain computation key control module, and a standardized protocol access module. The cryptographic asset awareness module deploys cryptographic capability probes on multiple business nodes, periodically collecting the encryption algorithms, key lengths, and protocol versions currently supported by each business node to form a set of encryption algorithms for that business node. It dynamically updates the global cryptographic material list by comparing differences with historical baseline records. The dual-track key governance module calculates the cryptographic capability compatibility score between communicating nodes based on the global cryptographic material list. Based on the score result and the support for post-quantum cryptography algorithms, it selects one of three processing methods: establishing a session key using a post-quantum cryptography algorithm, generating classical and post-quantum cryptography session keys in parallel, or maintaining the classical algorithm to establish the session key. This achieves adaptive matching between the key negotiation strategy and the actual cryptographic capabilities of the nodes. The zero-trust dynamic key governance module... The management module collects multi-dimensional features of the accessing entity through behavior probes, device fingerprint probes, and traffic feature probes. It calculates a comprehensive risk score by combining the context score of the access environment and obtains the trust confidence level of the accessing entity. Based on the trust confidence level range, it performs one of the following governance actions on the issued keys: maintain activity, reduce authority, force renegotiation, or revoke. This achieves dynamic binding between the key trust status and the real-time trust status of the identity. The encrypted domain computing key management module receives the registration request of the computing power node and evaluates its authorization level. It adopts a threshold secret sharing scheme to divide the computing key to be issued into multiple key fragments and distribute them to the computing power nodes that meet the authorization conditions. The complete key can only be reconstructed when the number of nodes participating in the operation reaches a preset threshold value. The module also triggers the dynamic cancellation of key fragments when it detects changes in the authorization status of nodes or when the task is completed. The standardized protocol access module performs unified format conversion of key exchange messages transmitted between various modules, business nodes, and computing power nodes based on the key management interoperability protocol, realizing standardized collaboration between heterogeneous nodes.

[0013] The present invention also provides a network information security encryption management method corresponding to the above-mentioned encryption management platform. Its technical solution corresponds to the processing logic executed by the functional modules of the above-mentioned platform, and will not be described in detail here.

[0014] Compared with the prior art, the beneficial effects of the present invention by adopting the above technical solution are as follows:

[0015] 1. This invention automates the inventory of cryptographic capabilities of all network nodes through a cryptographic asset awareness module, and establishes an adaptive negotiation and smooth switching channel for dual-track keys of classical and post-quantum cryptographic algorithms through a dual-track key governance module. This eliminates the protocol incompatibility problem caused by inconsistent node upgrade progress during cryptographic migration, and achieves agile encryption upgrades that are imperceptible to the business.

[0016] 2. This invention deeply couples key lifecycle scheduling with multi-dimensional context risk scoring through a zero-trust dynamic key governance module, enabling key de-weighting, renegotiation, and revocation to respond promptly based on changes in trust confidence, eliminating the security blind spot in the traditional static key management model where the identity is no longer trustworthy but the key is still valid.

[0017] 3. This invention constructs a distributed management pool for computational keys such as bootstrapping keys and evaluation keys through a key management module for ciphertext domain computation. It achieves independent key distribution and dynamic deregistration according to the authorization level and threshold secret sharing scheme of computing power nodes, ensuring a secure closed loop for the entire process of cross-domain ciphertext computation, and providing key management support for the industrial application of privacy computing technologies such as homomorphic encryption. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the overall platform architecture in an embodiment of the present invention;

[0019] Figure 2 This is a schematic diagram of the cryptographic asset awareness + dual-track key negotiation process in an embodiment of the present invention;

[0020] Figure 3 This is a schematic diagram of the zero-trust dynamic key governance process in an embodiment of the present invention. Detailed Implementation

[0021] The following is in conjunction with the appendix Figure 1-3 The specific embodiments of the present invention will be further described below. It should be noted that the description of these embodiments is for the purpose of helping to understand the present invention, but does not constitute a limitation of the present invention.

[0022] The following detailed description of the specific implementation of the encryption management platform for network information security of the present invention, in conjunction with the technical solution of the present invention, will enable those skilled in the art to implement the present invention accordingly.

[0023] The encryption management platform provided by this invention consists of five parts in its overall architecture: a cryptographic asset awareness module, a dual-track key governance module, a zero-trust dynamic key governance module, a ciphertext domain computation key control module, and a standardized protocol access module. In a specific deployment embodiment, the cryptographic asset awareness module, the dual-track key governance module, the zero-trust dynamic key governance module, and the ciphertext domain computation key control module can be deployed as independent software services in the core processing cluster of the platform, and they can interact with each other through an internal message bus.

[0024] The standardized protocol access module performs unified format conversion of key exchange messages between upper-layer functional modules and lower-layer classical business nodes, post-quantum cryptography business nodes, heterogeneous transition nodes, and fully homomorphic encryption computing power nodes based on the key management interoperability protocol. This shields the differences in key exchange message formats between different types of nodes. The lowest layer of the platform can also be configured with hardware security modules that support classical and post-quantum cryptography algorithms for secure key storage and cryptographic operations. The platform's policy and presentation layer provides a key lifecycle visualization dashboard, policy configuration interface, and audit log interface for administrators to perform unified policy configuration and security event tracing. The processing results of each module can be presented through this layer, forming a complete closed loop of perception, decision-making, execution, and auditing.

[0025] Regarding the specific implementation of the cryptographic asset awareness module and the dual-track key governance module, this invention deploys lightweight cryptographic capability probes at each business node. The probes periodically collect the triplet representing the name of the encryption algorithm currently supported by the node, the key length, and the protocol version, forming a representation of the... The set of encryption algorithms with the cryptographic capabilities of each node is denoted by the index of set A. The probe will report the collected set to the cryptographic asset awareness module through a secure channel. The module will compare the newly reported set with the historical baseline record of the node. If a new or changed algorithm capability is detected, the global cryptographic material list will be updated and the subsequent compatibility scoring process will be triggered.

[0026] If no change is detected, the current data collection process ends without triggering subsequent processing. With nodes When a communication request is initiated between the two nodes, the dual-key governance module reads the encryption algorithm set of both nodes from the global cryptographic material list and calculates the cryptographic capability compatibility score according to the following formula:

[0027] ;

[0028] in, Represents a node With nodes The cryptographic compatibility score between them ranges from 0 to 1;

[0029] and Representing nodes respectively With nodes A collection of encryption algorithms;

[0030] This represents the set of encryption algorithms commonly supported by both nodes. This represents the number of algorithmic elements contained in the set.

[0031] This represents the union of the encryption algorithms supported by the two nodes. The number of algorithmic elements contained in the set; for example, if the node... The supported algorithm set includes four algorithmic elements: nodes. The supported algorithm set contains five algorithm elements, three of which are supported by both nodes. The cryptographic capability compatibility score of the two nodes is the ratio of three divided by the number of elements in the union of the six algorithm elements.

[0032] The dual-key governance module determines whether the set of encryption algorithms jointly supported by the two nodes includes post-quantum cryptography algorithms: if it does, the post-quantum cryptography algorithm family is selected first to generate the session key and complete the key distribution.

[0033] If the set of commonly supported encryption algorithms contains only classical algorithms, but one of them has post-quantum cryptography capabilities, then the dual-track parallel processing branch is entered, and classical session keys and post-quantum cryptography session keys are generated at the same time, and the two are sent to the communicating parties together according to the preset priority labels.

[0034] The party with post-quantum cryptography parsing capability will first attempt to establish a session based on the post-quantum cryptography session key. If the other party fails to respond to the post-quantum cryptography negotiation message within the preset handshake timeout period, it will automatically downgrade to establish a classical session using the classical session key, thereby ensuring uninterrupted communication.

[0035] If neither node supports the post-quantum cryptography algorithm, then the classical algorithm communication will be maintained, and the node will be marked as an upgrade target. The dual-track key governance module will write the results of this round of key negotiation, including the algorithm track used, key identifier and validity period, into the key ledger, and periodically backtrack to check the capability upgrade status of the classical node.

[0036] Once a classical node is detected to have added post-quantum cryptography capabilities, the compatibility scoring and dual-track negotiation process will be automatically re-executed, triggering a smooth switch of the node's communication link from the classical track to the post-quantum cryptography track, until all nodes in the network have completed the unification of quantum cryptography capabilities.

[0037] Regarding the specific implementation of the zero-trust dynamic key governance module, this invention abandons the static allocation and periodic rotation key management model. It uses three sub-modules—behavior probe, device fingerprint probe, and traffic feature probe—to collect data on the access subject's operational behavior within a preset time window, device hardware and software fingerprint information, and statistical characteristics of network traffic. Normalized quantitative scores are output for each, denoted as behavior anomaly score, device fingerprint anomaly score, and traffic feature anomaly score. All three scores range from 0 to 1, with higher values ​​indicating a higher degree of anomaly in the corresponding dimension. The risk scoring engine reads the three probe scores and combines them with the context score of the current access environment. The context score can be determined based on factors such as whether the access time is during an abnormal period or whether there has been a sudden change in the access geographical location. The comprehensive risk score of the access subject is calculated using the following weighted formula:

[0038] ;

[0039] in, This indicates the overall risk score of the accessing entity, with a value ranging from 0 to 1;

[0040] Indicates a score for abnormal behavior. This indicates an abnormal fingerprint score for the device. Indicates anomaly score for traffic characteristics. Indicates environmental context score;

[0041] , , , The weight coefficients for the four dimensions—behavior, device fingerprint, traffic characteristics, and environmental context—are respectively, satisfying the following:

[0042] ;

[0043] In one specific embodiment, The value is 0.35. The value is 0.25. The value is 0.25. The value is 0.15. The above weighting coefficient can be determined to be other values ​​after training based on historical security event samples. The aforementioned value is only a specific implementation method given for illustrative purposes. The risk scoring engine calculates the trust confidence level according to the complementary relationship between trust confidence level and comprehensive risk score:

[0044] ;

[0045] in, This indicates the current trust confidence level of the accessing entity, ranging from 0 to 1. A higher value indicates a higher level of trust. The key governance decision module compares this trust confidence level with a preset first threshold. Second threshold Comparison, among which Greater than In one specific embodiment, The value is 0.7. The value is 0.4.

[0046] If the trust confidence level is not less than the first threshold, it is determined to maintain the status quo, and the key continues to remain active.

[0047] If the trust confidence level is not less than the second threshold and less than the first threshold, it is determined that the key is downgraded. The system restricts the authorized operation scope of the key, for example, only allowing read operations and not allowing write operations, and records the event log.

[0048] If the trust confidence level is less than the second threshold, the system further judges based on the rate of change of the risk score. If the score decreases within the preset time window without exceeding the preset mutation threshold, it is determined that the score is decreasing gradually, and a forced renegotiation process is triggered to immediately cancel the original key and regenerate the session key according to the aforementioned dual-track key negotiation process.

[0049] If the score drops more than the preset mutation threshold within the preset time window, it is determined to be a sudden drop in score. The key will be revoked directly, the key will be added to the revocation list and synchronized to the micro-segmentation strategy engine to block related access paths. After the key is generated and distributed, it will enter the active state. In the active state, it will be converted to the degraded state or the forced renegotiation state according to the trust confidence interval. After the forced renegotiation is completed, it will return to the active state.

[0050] When the trust confidence level falls below the second threshold and is judged to be a sharp drop in score, the key is immediately switched to the revocation state regardless of its current status. The key is added to the revocation list and no longer participates in any encryption or decryption operations. Finally, it flows to the destruction state. The key governance decision module writes the decision result, triggering basis and timestamp of this round into the audit log and writes the latest key status back to the key lifecycle state machine for subsequent risk assessment cycles to read and compare, forming a continuous closed loop.

[0051] Regarding the specific implementation of the ciphertext domain computation key management module, this invention addresses the special management needs of computational keys such as bootstrap keys and evaluation keys in fully homomorphic encryption scenarios. It constructs a distributed management pool based on the authorization level of computing power nodes. Computing power nodes submit registration requests to the management pool, which assesses their authorization level based on the node's hardware security capability proof, historical compliance records, and the security domain it belongs to, denoted as the [number missing]. Authorization level of each computing node The authorization level can be any element from a preset set of discrete levels, such as basic, standard, and high-privilege levels. When an upper-layer service initiates a ciphertext domain computation task, the control pool determines the type of computation key required for the task. This computation key type includes at least one of a bootstrap key and an evaluation key. The control pool then reads the authorization level threshold required by the task, denoted as... The control pool selects those that meet the requirements. A set of candidate computing power nodes is selected based on the given conditions, and the computing key to be issued is divided into segments using a threshold secret sharing scheme. Each key fragment has a threshold value. The complete key can be reconstructed from each key fragment, where... This represents the total number of candidate nodes participating in this computation task. The preset reconstruction threshold is satisfied. Not greater than In one specific embodiment, The value is 5. A value of 3 means that the key fragments held by any three nodes in the candidate computing power node set can collaboratively reconstruct the complete computing key. No single node or any two nodes can obtain the complete key information independently, thus improving the computing key's resistance to single-point leakage. The control pool will... Each key fragment is distributed to the corresponding computing power node through an independent secure channel. Each node only holds its local fragment and does not have complete key information.

[0052] When the homomorphic operation task is started, each participating node completes the ciphertext domain operation collaboratively based on local fragments. During the operation, the complete key is only temporarily reconstructed in a trusted execution environment that meets the threshold conditions. After the operation is completed, the reconstruction result is destroyed immediately. The control pool continuously monitors the authorization status and task completion status of each computing power node. If it detects that a computing power node has any of the three situations: authorization level downgrade, leaving the trusted security domain, or the corresponding computing task has been completed, the cancellation instruction of the key fragment held by the node is immediately triggered. After receiving the instruction, the node executes the fragment destruction and sends the destruction confirmation back to the control pool.

[0053] After the control pool aggregates the destruction confirmations of all nodes, it marks the lifecycle status of the computing key as terminated, thus completing the key control closed loop.

[0054] Regarding the specific implementation of the standardized protocol access module, this module extends the structure fields of the key management interoperability protocol to uniformly connect the key exchange message format between the upper-layer functional modules and the lower-layer classic business nodes, post-quantum cryptography business nodes, heterogeneous transition nodes, and fully homomorphic encryption computing power nodes. This enables different types of nodes to interact with the platform's core functional layer using a unified message structure, avoiding protocol parsing failures caused by node heterogeneity.

[0055] In another embodiment of the present invention, the risk score calculation of the zero-trust dynamic key governance module can also be implemented in another deployment method, that is, the preliminary anomaly detection of behavior, device fingerprint and traffic characteristics is carried out locally by each probe. The probe only reports the risk label after preliminary processing rather than the original feature data. The comprehensive risk score is then obtained by the risk scoring engine after secondary fusion and adjudication. This implementation method can reduce the data processing load of the core processing cluster and protect the privacy of the original data on the terminal side to a certain extent. It can be used as a supplement to the aforementioned dynamic key governance implementation method.

[0056] In another embodiment of the present invention, key negotiation for heterogeneous node communication can also be achieved by a hybrid key encapsulation method, that is, the output results of the classical key exchange algorithm and the post-quantum cryptography key encapsulation algorithm are combined into a single hybrid session key through a key derivation function. As long as one of the algorithms used by the two communicating parties is not compromised, the overall security of the hybrid key can be guaranteed.

[0057] This implementation method only requires maintaining a single hybrid key record at the key ledger level, and can serve as a supplement to the aforementioned dual-track key negotiation implementation method.

[0058] In summary, this invention achieves an upgrade in encryption agility during the cryptographic migration process through the collaborative processing of the cryptographic asset awareness module and the dual-track key governance module.

[0059] The zero-trust dynamic key governance module enables dynamic binding between key trust status and real-time identity trust status.

[0060] Through the encrypted domain computing key management module, a secure closed-loop management system for the entire lifecycle of computing keys is achieved. Together, these three components constitute the main technical solution of the encryption management platform for network information security of this invention, which can provide effective technical support for data security in scenarios such as enterprise networks, cloud computing environments, the Internet of Things, and the Industrial Internet.

[0061] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of the present invention. Therefore, any modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the protection scope defined by the claims of the present invention.

Claims

1. A network information security encryption management platform, characterized in that, include: The cryptographic asset awareness module is used to deploy cryptographic capability probes on multiple business nodes. The cryptographic capability probes periodically collect the encryption algorithms, key lengths and protocol versions currently supported by the corresponding business nodes to form a set of encryption algorithms for the corresponding business nodes. The newly collected set of encryption algorithms is compared with the historical baseline records of the corresponding business nodes. When a change in the set of encryption algorithms is detected, the global cryptographic material list is updated. The dual-track key governance module, connected to the cryptographic asset awareness module, is used to obtain the encryption algorithm set of the first business node to be communicated and the encryption algorithm set of the second business node based on the global cryptographic material list, and to calculate the cryptographic capability compatibility score between the first business node and the second business node. When the set of encryption algorithms jointly supported by the first service node and the second service node includes a post-quantum cryptography algorithm, the post-quantum cryptography algorithm is used to generate the session key; When the set of encryption algorithms jointly supported by the first business node and the second business node does not include post-quantum cryptography algorithms, and one of the first business node and the second business node individually supports post-quantum cryptography algorithms, classical session keys and post-quantum cryptography session keys are generated in parallel and distributed according to a preset priority. When neither the first service node nor the second service node supports post-quantum cryptography, a classical algorithm is used to generate the session key. The zero-trust dynamic key governance module is used to collect behavioral characteristics, device fingerprint characteristics and traffic characteristics of the access subject through multi-dimensional probes, calculate the comprehensive risk score of the access subject by combining the contextual characteristics of the access environment, and obtain the trust confidence level of the access subject based on the comprehensive risk score. Based on the range of the trust confidence level, perform one of the following governance actions on the issued keys: maintain activity, reduce privileges, force renegotiation, or revoke; The encrypted domain computing key management module is used to receive registration requests from computing power nodes and assess the authorization level of the computing power nodes based on the hardware security capability proof of the computing power nodes. Under the condition of meeting the authorization level, the computing key to be issued is divided into multiple key fragments using a threshold secret sharing scheme, and the key fragments are issued to computing power nodes that meet the authorization level. When the number of computing power nodes participating in the operation reaches a preset threshold value, the complete computing key is reconstructed. The standardized protocol access module is communicatively connected to the cryptographic asset awareness module, the dual-track key governance module, the zero-trust dynamic key governance module, and the ciphertext domain computing key control module, respectively. It is used to perform unified format conversion of key exchange messages transmitted between each module and the business node and the computing power node based on the key management interoperability protocol.

2. The encryption management platform according to claim 1, characterized in that, The dual-key governance module calculates the cryptographic capability compatibility score according to the following formula: ； in, This represents the cryptographic capability compatibility score between the first service node and the second service node, with a value ranging from 0 to 1. This represents the set of encryption algorithms for the first service node. This represents the set of encryption algorithms for the second service node; This represents the set of encryption algorithms jointly supported by the first service node and the second service node. This indicates the number of algorithm elements contained in the set; This represents the union of the encryption algorithms supported by the first service node and the second service node. This indicates the number of algorithm elements contained in the set.

3. The encryption management platform according to claim 1, characterized in that, After generating classical session keys and post-quantum cryptographic session keys in parallel, the dual-track key governance module controls the party with post-quantum cryptographic parsing capabilities to attempt to establish a session based on the post-quantum cryptographic session keys. If no response to the post-quantum cryptography negotiation message is received from the other end within the preset handshake timeout period, the two parties controlling the communication establish a classical session using the classical session key. The dual-track key governance module is also used to write the algorithm track, key identifier and validity period used in this round of key negotiation into the key ledger, and periodically detect whether the set of encryption algorithms marked as nodes to be upgraded has changed. When it is detected that the node to be upgraded has added support for post-quantum cryptography algorithms, the corresponding communication link is triggered to switch from the classical algorithm track to the post-quantum cryptography algorithm track.

4. The encryption management platform according to claim 1, characterized in that, The zero-trust dynamic key governance module includes a behavior probe, a device fingerprint probe, and a traffic feature probe, which are used to collect the operation behavior, device status, and traffic pattern of the access subject within a preset time window, and output normalized behavior anomaly score, device fingerprint anomaly score, and traffic feature anomaly score, respectively. The zero-trust dynamic key governance module calculates the comprehensive risk score according to the following formula: ； in, This represents the overall risk score of the accessing entity, with a value ranging from 0 to 1; This indicates the score for the abnormal behavior. This indicates the fingerprint anomaly score of the device. The traffic flow characteristic anomaly score is represented by all three values, which range from 0 to 1. The context score represents the access environment and ranges from 0 to 1. , , , The weighting coefficients for the behavioral anomaly score, the device fingerprint anomaly score, the traffic feature anomaly score, and the context score are respectively, and satisfy the following: ； The zero-trust dynamic key governance module calculates the trust confidence level according to the following formula: ； in, This represents the trust confidence level of the accessing entity, with a value ranging from 0 to 1.

5. The encryption management platform according to claim 4, characterized in that, The value is 0.

35. The value is 0.

25. The value is 0.

25. The value is 0.15; The zero-trust dynamic key management module presets a first threshold. With the second threshold ,and Greater than ; The level of trust confidence is not less than At that time, control the corresponding key to maintain an active state; The level of trust confidence is not less than and less than At that time, the scope of authorized operations for the corresponding key is restricted; The level of trust confidence is less than If the decrease in the trust confidence level within a preset time does not exceed a preset mutation threshold, the corresponding key is invalidated and a new session key is generated. The level of trust confidence is less than If the decrease in the trust confidence level exceeds a preset mutation threshold within a preset time period, the corresponding key will be added to the revocation list and the relevant access path will be blocked.

6. The encryption management platform according to claim 1, characterized in that, The ciphertext field computing key management module is also used to determine the type of computing key to be issued, wherein the type of computing key includes at least one of bootstrapping key and evaluation key; The ciphertext domain computing key management module reads the authorization level threshold required by the current ciphertext domain computing task, filters out a set of candidate computing power nodes whose authorization level reaches the authorization level threshold, and segments the computing key into... Each key fragment has a threshold value. Each of the aforementioned key fragments can reconstruct the complete computational key, wherein This represents the total number of candidate computing nodes participating in the current ciphertext domain computation task. The preset reconstruction threshold value, and Not greater than ; The ciphertext field calculation key management module will... Each key fragment is distributed to the corresponding candidate computing power node through an independent secure channel, and each candidate computing power node only holds its local key fragment; When the ciphertext domain computation task is started, the candidate computing nodes participating in the computation reconstruct the complete computation key in the trusted execution environment based on local key fragmentation to complete the computation, and destroy the reconstructed complete key after the computation is completed.

7. The encryption management platform according to claim 6, characterized in that, The ciphertext domain computing key management module continuously monitors the authorization status of the candidate computing power nodes and the completion status of the ciphertext domain computing tasks. When a candidate computing power node is detected to have experienced any of the following three scenarios: authorization level downgrade, departure from a preset trusted security domain, or completion of a ciphertext domain computing task, a key fragment cancellation command is issued to the candidate computing power node to control the candidate computing power node to perform local key fragment destruction. After receiving destruction confirmation from all candidate computing power nodes, the lifecycle status of the computing key is marked as terminated.

8. A method for encrypted management of network information security, characterized in that, include: Deploy cryptographic capability probes on multiple business nodes. Periodically collect the encryption algorithms, key lengths and protocol versions currently supported by the corresponding business nodes through the cryptographic capability probes to form a set of encryption algorithms for the corresponding business nodes. Compare the newly collected set of encryption algorithms with the historical baseline records of the corresponding business nodes. When a change in the set of encryption algorithms is detected, update the global cryptographic material list. Based on the global cryptographic material list, obtain the encryption algorithm set of the first service node to be communicated and the encryption algorithm set of the second service node, and calculate the cryptographic capability compatibility score between the first service node and the second service node; When the set of encryption algorithms jointly supported by the first service node and the second service node includes a post-quantum cryptography algorithm, the post-quantum cryptography algorithm is used to generate the session key; When the set of encryption algorithms jointly supported by the first business node and the second business node does not include post-quantum cryptography algorithms, and one of the first business node and the second business node individually supports post-quantum cryptography algorithms, classical session keys and post-quantum cryptography session keys are generated in parallel and distributed according to a preset priority. When neither the first service node nor the second service node supports post-quantum cryptography, a classical algorithm is used to generate the session key. The behavior characteristics, device fingerprint characteristics, and traffic characteristics of the access subject are collected by multi-dimensional probes. The comprehensive risk score of the access subject is calculated by combining the contextual characteristics of the access environment, and the trust confidence level of the access subject is obtained based on the comprehensive risk score. Based on the range of the trust confidence level, perform one of the following governance actions on the issued keys: maintain activity, reduce privileges, force renegotiation, or revoke; Receive registration requests from computing power nodes and assess the authorization level of the computing power nodes based on their hardware security capability certifications; Under the condition of meeting the authorization level, the computing key to be issued is divided into multiple key fragments using a threshold secret sharing scheme, and the key fragments are issued to computing power nodes that meet the authorization level. When the number of computing power nodes participating in the operation reaches a preset threshold value, the complete computing key is reconstructed. Based on the key management interoperability protocol, the key exchange messages transmitted between the processing entities involved in the above steps and the business nodes and computing power nodes are uniformly converted in format.

9. The encryption management method according to claim 8, characterized in that, The step of calculating the cryptographic capability compatibility score is implemented according to the following formula: ； in, This represents the cryptographic capability compatibility score between the first service node and the second service node, with a value ranging from 0 to 1. This represents the set of encryption algorithms for the first service node. This represents the set of encryption algorithms for the second service node; This represents the set of encryption algorithms jointly supported by the first service node and the second service node. This indicates the number of algorithm elements contained in the set; This represents the union of the encryption algorithms supported by the first service node and the second service node. This indicates the number of algorithm elements contained in the set.

10. The encryption management method according to claim 8, characterized in that, The steps for calculating the comprehensive risk score are implemented according to the following formula: ； in, This represents the overall risk score of the accessing entity, with a value ranging from 0 to 1; This represents the normalized score for behavioral abnormalities. This represents the normalized device fingerprint anomaly score. The normalized traffic feature anomaly score is represented by all three values, which range from 0 to 1. The context score represents the access environment and ranges from 0 to 1. , , , These are the corresponding weight coefficients, and they satisfy: ； The step of obtaining the confidence level is implemented according to the following formula: ； in, This represents the trust confidence level of the accessing entity, with a value ranging from 0 to 1.

Images