CN106888084B - Quantum fort machine system and authentication method thereof - Google Patents
Quantum fort machine system and authentication method thereofDownload PDFInfo
- Publication number
- CN106888084B CN106888084BCN201710003788.5ACN201710003788ACN106888084BCN 106888084 BCN106888084 BCN 106888084BCN 201710003788 ACN201710003788 ACN 201710003788ACN 106888084 BCN106888084 BCN 106888084B
- Authority
- CN
- China
- Prior art keywords
- quantum
- key
- random number
- server
- bastion machine
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034methodMethods0.000titleclaimsabstractdescription41
- 230000006854communicationEffects0.000claimsabstractdescription155
- 238000004891communicationMethods0.000claimsabstractdescription154
- 238000012423maintenanceMethods0.000claimsdescription59
- 238000003860storageMethods0.000claimsdescription49
- 230000008569processEffects0.000claimsdescription23
- 230000006870functionEffects0.000claimsdescription15
- 238000009826distributionMethods0.000claimsdescription9
- 101100059544Arabidopsis thaliana CDC5 geneProteins0.000description7
- 101100244969Arabidopsis thaliana PRL1 geneProteins0.000description7
- 102100039558Galectin-3Human genes0.000description7
- 101100454448Homo sapiens LGALS3 geneProteins0.000description7
- 101150115300MAC1 geneProteins0.000description7
- 101150051246MAC2 geneProteins0.000description7
- 230000005540biological transmissionEffects0.000description7
- 238000007726management methodMethods0.000description7
- 230000002457bidirectional effectEffects0.000description6
- 238000013475authorizationMethods0.000description5
- 101100289995Caenorhabditis elegans mac-1 geneProteins0.000description3
- 238000012545processingMethods0.000description3
- 241000700605VirusesSpecies0.000description2
- 230000007123defenseEffects0.000description2
- 238000010586diagramMethods0.000description2
- 239000000463materialSubstances0.000description2
- 238000012550auditMethods0.000description1
- 230000006399behaviorEffects0.000description1
- 238000005520cutting processMethods0.000description1
- 238000001514detection methodMethods0.000description1
- 238000011161developmentMethods0.000description1
- 238000005516engineering processMethods0.000description1
- 230000006872improvementEffects0.000description1
- 230000004048modificationEffects0.000description1
- 238000012986modificationMethods0.000description1
- 230000006855networkingEffects0.000description1
- 230000008520organizationEffects0.000description1
- 238000004904shorteningMethods0.000description1
- 238000005728strengtheningMethods0.000description1
- 239000013589supplementSubstances0.000description1
- 238000012795verificationMethods0.000description1
Images
Classifications
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0852—Quantum cryptography
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Electromagnetism (AREA)
- Theoretical Computer Science (AREA)
- Computer And Data Communications (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
Description
Technical Field
The invention relates to the technical field of quantum communication, in particular to a quantum fort machine system and an authentication method thereof.
Background
With the continuous deepening of the social informatization degree, the information data increasingly becomes the core assets of each enterprise and public institution, and the important work of ensuring the safety of the information data is that each enterprise and public institution works extremely. The popularization of network firewall, virus firewall, intrusion detection and other hardware devices effectively prevents the internal network of the enterprise from being attacked from the outside and strengthens the external defense line of the enterprise.
However, the problems of information data theft and leakage, damage to the operation of important system servers and the like exist in enterprises, and the influence on the information security of the enterprises is far better than that of hackers and viruses. In particular, because enterprise IT operation and maintenance personnel or managers often deal with core IT assets, the chances of contacting core secrets are the most, and enterprise internal information security events gradually turn to security and confidentiality management of the IT operation and maintenance personnel and managers. How to reinforce an internal defense system of an internal network of an organization, and how to eliminate or reduce serious consequences of information stealing, data tampering, system damage and the like caused by internal hidden dangers become a new topic of the international information security industry in the intranet security field in recent years.
Against this background, fortress machine (also called a fortress host) technology capable of preventing and auditing access and operation of internal management personnel to IT asset equipment has emerged. The fortress machine is a special system host for controlling the access of IT operation and maintenance personnel to core IT assets. The method takes over the access of the terminal computer to the network and the server by cutting off the direct access of the terminal computer to the network and the server resources and adopting a protocol proxy mode.
The application of the fort machine enables operation and maintenance personnel to carry out all operation and maintenance operations on the server through the fort machine. And the fortress machine records the operation of the operation and maintenance personnel into a log file for the auditing personnel to carry out safety audit and accountability.
The single sign-on is one of the core functions of the classic bastion machine, and means that in an application system, a user can access all mutually trusted application systems only by logging on once. The identity authentication of the operation and maintenance personnel logging in the bastion machine link and the mutual trust link between the bastion machine and the core IT assets is particularly important, and the security of the whole internal network is the first guarantee. The identity authentication of the conventional bastion system is based on the public key cryptosystem in the conventional network. The basic principle of the asymmetric key system for realizing identity authentication can be described as follows: during communication, the private key of the user signs the application request and submits the certificate, and the receiver decrypts the certificate of the user by using the public key of the certificate authority to obtain the public key of the user, so that the signature of the user is verified, and the identity of the user is confirmed.
The security of the asymmetric cryptosystem is based on some specific complex mathematical operations, and with the development of quantum computers, the operation speed of the computers is exponentially multiplied, so that the classical asymmetric encryption algorithm is at risk of being cracked.
Disclosure of Invention
The invention provides a quantum fort machine system, which realizes the identity authentication process of each manager or operation and maintenance personnel of a quantum communication network service station through a quantum random number key so as to ensure the information security inside the quantum communication network service station and improve the security of a quantum communication network.
Therefore, the invention adopts the following technical scheme:
a quantum fort machine system comprises a terminal user, a quantum fort machine and a quantum communication network server resource;
the quantum bastion machine manages and controls the terminal user to access the quantum communication network server resource;
the system is also provided with a quantum key issuing center and a quantum key card, wherein the quantum key card is issued by a terminal user after being registered in the quantum key issuing center; the quantum key issuing center generates quantum random numbers and issues the quantum random numbers to the quantum key card, the quantum bastion machine and the quantum communication network server resource as quantum random number keys respectively;
the system realizes mutual authentication through quantum key cards and quantum bastion machines or quantum bastion machines and quantum communication network server resource corresponding quantum random number key pairs, and realizes access of terminal users to quantum bastion machines or quantum communication network server resources.
Optionally, the terminal users include bastion machine operation and maintenance users and server operation and maintenance users; the quantum communication network server resources are all servers which need to be monitored by the quantum bastion machine in the quantum communication network service station. Optionally, the quantum key fob is a device issued to a legal end user after being authorized by a quantum key issuing center, and includes a CPU, a memory, a storage, and an operating system.
When the legal terminal user is a personal computer, the preferred expression form of the quantum KEY fob is a USB KEY or a personal computer motherboard card; when the legitimate end user is a mobile terminal, the preferred representation of the quantum KEY fob is an SD KEY or a mobile terminal motherboard chip.
The quantum key card is used for ensuring the security of the quantum random number key from the source, and preventing the quantum random number key from being stolen or tampered, thereby ensuring the security of the whole bastion machine system.
Optionally, the system of the present invention further includes a firewall, a switch, and a router, which connect the end user, the quantum bastion machine, and the quantum communication network server resource.
Optionally, the quantum bastion machine includes a security encryption module, a key storage module and an authentication module;
the security encryption module is used for encrypting and decrypting the quantum random number key, so that the security of the quantum random number key in the processes of storage and use is ensured, and the expression form of the security encryption module is preferably a mainboard board card;
the key storage module is used for storing the quantum random number key encrypted by the security encryption module;
the authentication module is used for performing mutual authentication between the quantum key card and the quantum bastion machine and between the quantum bastion machine and each server of the quantum communication network server resource.
Optionally, each server in the quantum communication network server resources includes a secure encryption module, a key storage module, and an authentication module;
the security encryption module is used for encrypting and decrypting the quantum random number key to ensure the security of the quantum random number key in the storage and use processes;
the key storage module is used for storing the quantum random number key encrypted by the security encryption module;
the authentication module is used for mutual authentication between the quantum bastion machine and each server of the quantum communication network server resource.
Optionally, the quantum key issuing center generates quantum random numbers through a quantum random number generation server, and issues the quantum random numbers between each terminal user and the quantum bastion machine, and between the quantum bastion machine and the quantum communication network server resource, respectively, to form a shared quantum random number key pair. The invention also aims to solve the technical problem of providing an authentication method of the quantum fort machine system, which comprises the following steps:
s1, the terminal user is connected with the quantum fort machine, and the quantum fort machine is accessed to the quantum communication network server resource;
s2 the quantum key issuing center issues quantum random number key pairs to the terminal user and the quantum bastion machine, the quantum bastion machine and the quantum communication network server resource respectively;
and S3, the terminal user logs in the quantum bastion machine, and mutual authentication is realized through the corresponding quantum random number key pair of the terminal user and the quantum bastion machine or the quantum bastion machine and the quantum communication network server resource, so that the corresponding access right is obtained.
Optionally, the quantum key issuing center generates quantum random numbers through a quantum random number generation server, and issues the quantum random numbers between each terminal user and the quantum bastion machine, and between the quantum bastion machine and the resource of the quantum communication network server, respectively, to form a shared quantum random number key pair.
Furthermore, the terminal user has a quantum key fob corresponding to the identity of the terminal user, the quantum key fob is issued by the terminal user after being registered in a quantum key issuing center, and the quantum key fob and the quantum bastion machine share a corresponding quantum random number key; and the quantum bastion machine and the quantum communication network server resource share a corresponding quantum random number key.
Optionally, the authentication request between the terminal user and the quantum bastion machine carries user identification information of the terminal user, the quantum bastion machine authenticates the authentication request through the user identification information, the user identification information is from a quantum key fob corresponding to the identity of the terminal user, and the quantum key fob is issued by the terminal user after being registered in a quantum key issuing center.
Optionally, the terminal users include bastion machine operation and maintenance users and server operation and maintenance users, and the quantum communication network server resources are all servers which need to be monitored by the quantum bastion machine in the quantum communication network service station.
Furthermore, after the terminal user successfully authenticates the quantum bastion machine,
when the quantum fort machine determines that the terminal user is a fort machine operation and maintenance user, the terminal user performs corresponding operation on the quantum fort machine according to the role authority of the terminal user;
and the quantum bastion machine determines that the terminal user is a server operation and maintenance user, determines the server and all role authorities thereof in the quantum communication network server resource corresponding to the terminal user, respectively authenticates the quantum bastion machine and the server in the quantum communication network server resource corresponding to the terminal user according to all the role authorities corresponding to the terminal user, and after all the role authorities are successfully authenticated, the terminal user obtains the authority for accessing the server in the quantum communication network server resource corresponding to the terminal user.
Optionally, the quantum bastion machine includes a security encryption module, a key storage module and an authentication module;
the security encryption module is used for encrypting and decrypting the quantum random number key to ensure the security of the quantum random number key in the storage and use processes;
the key storage module is used for storing the quantum random number key encrypted by the security encryption module;
the authentication module is used for performing mutual authentication between the quantum key card and the quantum bastion machine and between the quantum bastion machine and each server of the quantum communication network server resource.
Optionally, the method for issuing the quantum random number key to the quantum bastion machine by the quantum key issuing center includes:
mode a, transmitting to the security encryption device via a mobile storage medium; or
The mode b is that the information is directly transmitted to the safety encryption device through a special communication line;
in the mode a and the mode b, the security encryption device encrypts the received quantum random number key and stores the encrypted quantum random number key in the key storage module of the quantum bastion machine.
The modes a and b are a local issuing mode and a remote issuing mode, wherein the quantum key issuing center issues a quantum random number key to the quantum bastion machine. The invention can select one of the issuing modes according to the actual situation.
Optionally, each server in the quantum communication network server resources includes a secure encryption module, a key storage module, and an authentication module;
the security encryption module is used for encrypting and decrypting the quantum random number key to ensure the security of the quantum random number key in the storage and use processes;
the key storage module is used for storing the quantum random number key encrypted by the security encryption module;
the authentication module is used for mutual authentication between the quantum bastion machine and each server of the quantum communication network server resource.
Optionally, the method for the quantum key issuing center to issue the quantum random number key to each server in the quantum communication network server resource includes:
mode a, transmitting to the security encryption device via a mobile storage medium; or
The mode b is that the information is directly transmitted to the safety encryption device through a special communication line;
in the modes a and b, the security encryption device encrypts the received quantum random number key and stores the encrypted quantum random number key in the key storage module of each server in the quantum communication network server resource.
The modes a and b are a local issuing mode and a remote issuing mode of the quantum key issuing center to each server in the quantum communication network server resources. The invention can select one of the issuing modes according to the actual situation.
When the quantum key issuing center issues the quantum bastion machine or each server in the quantum communication network server resource remotely, the communication special line is preferably a quantum communication network, the remote issuing of the quantum random number key depends on the quantum communication network, a bastion machine system with the security ensured by the quantum random number key and the quantum communication network is formed, and the purpose is to protect various core devices in the quantum communication network.
In the authentication process, the used secret key is the quantum random number generated by a quantum random number generation server, namely a true random number, and the whole process only uses a symmetric encryption algorithm and a digest algorithm for identity authentication, completely abandons the process of using an asymmetric algorithm in classical communication, and can resist the attack of a quantum computer on the asymmetric algorithm.
In the quantum bastion system of the invention, each end user needs to hold a quantum key card which is issued uniformly by a special trusted authority, namely a quantum key issuing center. The quantum key card is a unique identification of the identity of the end user, and is also a device for storing a quantum random number key shared by the end user and the quantum bastion machine. And the terminal user performs identity authentication with the quantum bastion machine by using the quantum random number key shared in the quantum key card. And the quantum bastion machine and each server in the quantum communication network server resource complete bidirectional identity authentication through the shared quantum random number key issued by the quantum key issuing center. The method has the advantages that the quantum random number keys representing the identities and the authorities of the servers in the resources of the user side, the quantum bastion machine and the quantum communication network server are uniformly authorized and issued by a special trusted authority, namely a quantum key issuing center, instead of the situation that the servers in the resources of the quantum bastion machine and the quantum communication network server respectively authorize the identity information of the users, the uniform management of the roles and the authorities of the whole system is realized, and the safety of internal network communication is ensured.
The quantum bastion machine can remotely control the quantum communication network server resources through the quantum communication network, and the safety of the quantum bastion machine is ensured by the quantum communication network, so that the scattered core IT assets can be safely and uniformly controlled.
Drawings
Fig. 1 is a networking diagram of the quantum bastion machine system.
Fig. 2 is a schematic diagram of a key issuance process according to the present invention.
FIG. 3 is a flow chart of bidirectional identity authentication according to the present invention.
Detailed Description
The invention is further elucidated with reference to the following figures.
The first embodiment is as follows:
as shown in fig. 1, the system of the present invention mainly includes:
and the terminal users are mainly divided into fortress machine operation and maintenance users and server operation and maintenance users. The fortress operation and maintenance user only logs in a terminal for operating the fortress, and the terminal comprises managers at all levels, auditors at all levels and the like of the fortress; the server operation and maintenance user can access the quantum communication network server resources and can send maintenance and operation instructions to each server, wherein the maintenance and operation instructions comprise managers at all levels, auditors at all levels and the like of each server.
The quantum bastion machine is a special system for managing and controlling the access of a server operation and maintenance user to quantum communication network server resources, and comprises a strategy management module, a security encryption module, a key storage module, an auditing module, an authentication module and the like. The strategy module is used for configuring a corresponding security strategy and the operation authority which the terminal user should have; the security encryption module is mainly used for encrypting and decrypting the quantum random number key to ensure the security of the quantum random number key in the processes of storage and use, and the expression form of the security encryption module is preferably a mainboard board card; the secret key storage module is used for storing the quantum random number secret key encrypted by the security encryption module; and the auditing module is used for recording and auditing the operation behavior of the terminal user for accessing the resources of the quantum bastion machine or the quantum communication network server, and can count, analyze and generate a report for the formed record.
The quantum communication network server resource is a general name of all target devices needing to be monitored by the quantum bastion machine in the quantum communication network service station, and in the following embodiment, each server in the quantum communication network server resource interacting with the bastion machine is called a server for short.
The quantum communication network server resource mainly comprises a main control center, an authentication server, a quantum random number generation server, a quantum random number key storage server, a quantum key distribution server, a quantum key management server and the like. The main control center is used for controlling the quantum communication network service station, and in addition, the main control center also has the functions of user registration, user access, various cryptology applications, user information storage, user key storage, user quantum key card issuance and the like; the authentication server is mainly used for finishing the identity authentication of the access user by utilizing an authentication protocol and authenticating whether the user is a legal quantum communication network user; the invention relates to a quantum random number generation server, which preferentially uses the quantum random number generation server and is used for generating quantum random numbers for users accessing a quantum communication network to obtain so as to form a shared quantum random number key between the users and a quantum communication network service station; a quantum random number key storage server for storing a quantum random number key generated by the quantum random number generation server; the quantum key distribution server is used for carrying out quantum key distribution so as to realize the quantum key shared in different places among quantum communication network service stations which are directly connected or connected through a relay; and the quantum key management server is responsible for storing, managing and the like the quantum key generated by the quantum key distribution server.
It should be emphasized that each server, in addition to its proper functional modules, also includes a secure encryption module, a key storage module and an authentication module, where the secure encryption module is a device for performing encryption and decryption operations on a quantum random number key, and its expression form is preferably a motherboard card; and the key storage module is used for storing and managing the quantum random number key encrypted by the security encryption module, and preferably selects various databases. The authentication module is used for performing mutual authentication between the quantum key card and the quantum bastion machine and between the quantum bastion machine and each server of the quantum communication network server resource.
The quantum key issuing center internally comprises a quantum random number generation module, an authentication and authorization module, an authority strategy module and the like. The invention relates to a quantum random number generation module, which preferentially uses a quantum random number generation server and is responsible for the functions of generation, storage, management and the like of quantum random numbers; the authentication and authorization module is mainly used for authorizing terminal users of all servers in the quantum communication network service station (including managers or operation and maintenance personnel of servers such as quantum bastion machines and quantum communication network server resources) and issuing quantum random number keys to all servers, quantum bastion machines and terminal users in the quantum communication network server resources so as to form shared quantum random number key pairs between all terminal users and the quantum bastion machines and between the quantum bastion machines and the quantum communication network server resources; and the authority strategy module is mainly used for making access roles, authority strategies and the like for servers such as the quantum bastion machine, the quantum communication network server resources and the like, distributing roles and authorities for terminal users according to the authority strategies and distributing authorities between the quantum bastion machine and the quantum communication network server resources.
The quantum key card is a device which is authorized by a quantum key issuing center and then issued to a legal terminal user. The internal structure of the system comprises a CPU, a memory, a storage and an operating system, and user information (mainly comprising user ID, user personal information, current key amount, key expiration time and the like), a quantum random number key, an encryption strategy and the like can be stored. Each holder of the quantum key fob has a user ID, i.e., user identification information, that uniquely identifies it. When the terminal of the legal user is a personal computer, the preferred expression form of the quantum KEY card is USB KEY or a personal computer mainboard board card; when the terminal of the legal user is a mobile terminal, the preferred expression form of the quantum KEY fob is SD KEY or a mobile terminal motherboard chip.
And the other network equipment is used for connecting the firewall, the switch, the router and the like of the resources of the end user, the quantum bastion machine and the quantum communication network server.
The quantum bastion machine is used as a part of a quantum communication network and is accessed to quantum communication network server resources through a switch and other network equipment, when an end user accesses the quantum communication network server resources through a classical network (an internal network or an external network), the quantum bastion machine is accessed firstly through a firewall strategy, and the quantum bastion machine is replaced by each server in the access quantum communication network server resources.
The quantum bastion machine can also remotely control the quantum communication network server resources through a quantum communication network.
Example two:
the embodiment provides an authentication method based on the quantum fort machine system, which specifically comprises the following steps:
1. quantum fort machine deployment
The quantum bastion machine accesses to the quantum communication network server resource through the network equipment bypass, when the terminal user accesses the quantum communication network server resource through a classical network (an internal network or an external network), the terminal user accesses the quantum bastion machine through a firewall strategy, and the quantum bastion machine is replaced by each server in the access quantum communication network server resource.
2. Quantum random number key pair issuance
As shown in fig. 2, the quantum key issuer is a trusted center that issues quantum random number keys to end users, quantum basters and quantum communication network server resources, where the end users need to go to the quantum key issuer to obtain the quantum random number keys, and the quantum basters and quantum communication network server resources can go to the quantum key issuer to obtain the quantum random number keys and can supplement the quantum random number keys through remote issuance.
In the invention, the end user and the quantum bastion machine, and the quantum bastion machine and each server in the quantum communication network server resource need to have a shared quantum random number key to mutually authenticate each other. Therefore, it is necessary to issue a quantum random number key pair to the end user and the quantum bastion machine and each server in the quantum bastion machine and quantum communication network server resources before authentication, which is done by the quantum key issuing center. The method comprises the following specific steps:
2.1 Process for issuing Quantum random number Key pairs to end-users and Quantum bastion machines
Issuing a quantum random number key to an end user is embodied in charging information such as a quantum random number key into the end user's quantum key fob. The final result of issuing the quantum random number key to the quantum bastion machine is to charge information such as the quantum random number key corresponding to the end user into a key storage module of the quantum bastion machine.
The terminal user applies for issuing the quantum random number key to the acceptance point appointed by the quantum key issuing center, and the specific process is as follows:
(1) and the terminal user carries the relevant materials to a quantum key issuing center to apply for authorization.
(2) And the authentication authorization module of the quantum key issuing center verifies the terminal user material, allocates a user ID for the user after the verification is passed, and determines the role authority of the user, the ID of the quantum bastion machine logged in by the user and other information to the authority strategy module.
(3) And the authentication and authorization module of the quantum key issuing center acquires the quantum random number keys of the quantity specified by the user from the quantum random number generation module. And writing key information such as user information (mainly comprising user ID, user personal information, current key amount, key expiration time and the like), quantum random number keys, encryption strategies and the like into the quantum key fob, and issuing the quantum key fob to the end user.
The quantum key issuing center issues key information such as user information (mainly comprising user ID, user personal information, current key amount, key expiration time and the like), a quantum random number key, an encryption strategy and the like to the quantum bastion machine while finishing issuing the quantum random number key to the terminal user so as to realize the shared quantum random number key between the quantum bastion machine and the terminal user.
The process of issuing the quantum random number key to the quantum bastion machine by the quantum key issuing center is divided into two types:
1 if the data transmission between the quantum bastion machine and the quantum key issuing center is within an acceptable physical distance, corresponding key information can be copied from a mobile medium to a designated acceptance point of the quantum key issuing center, the obtained key information is taken to the quantum bastion machine, and the key information is encrypted by a security encryption module of the quantum bastion machine and then stored in a key storage module. Such an issuance within a metro network is also referred to as a local issuance, and the mobile medium is preferably a reliable mobile hard disk or a flash disk or the like held by a trusted person.
2 if the data transmission between the quantum bastion machine and the quantum key issuing center is within the acceptable physical distance, in addition to issuing the data locally to the designated acceptance point with more cost than the acceptable cost, the quantum bastion machine can issue the quantum random number key remotely, and the transmission of the quantum random number key passes through the quantum communication network. The specific process of remote issuance is as follows:
(1) the quantum key issuing center encrypts user information (mainly comprising user ID, user personal information, current key amount, key expiration time and the like), quantum random number keys, encryption strategies and other key information by using quantum keys generated by a quantum key distribution server in a local quantum communication network service station to obtain ciphertext data, and sends the ciphertext data. Among them, the method of encrypting the quantum random number key using the quantum key is preferably a one-time pad.
(2) The ciphertext data is transmitted to a quantum communication network service station local to the quantum bastion machine through a communication network.
(3) And the local quantum communication network service station of the quantum bastion machine decrypts the ciphertext data by using the shared quantum key generated by the quantum key distribution server to obtain key information, directly transmits the key information to a security encryption module of the quantum bastion machine through a secure private line, encrypts the key information by the security encryption module and stores the encrypted key information in a key storage module. The safe special line can be protected by special measures, such as strengthening the safety of a machine room, arranging special personnel, or shortening the distance of the special line.
(4) And the key storage module of the quantum bastion machine successfully stores the key information and returns a successful issuing message to the quantum key issuing center.
So far, the quantum key issuing center completes the issuing of quantum random number key pairs to the quantum bastion machine and the terminal user. And the terminal user shares the quantum random number key with the quantum bastion machine through the quantum key card. The quantum key fob is the only credential for the end user to log into the quantum bastion machine.
2.2 Process for issuing Quantum random number Key pairs to Quantum baster and Quantum communication network Server resources
Quantum key issuing center on quantum bastion machine and quantumBefore the communication network server resource issues the quantum random number key pair, the authority policy module needs to divide the role authorities of all operation and maintenance accounts of each server in the quantum communication network server resource according to corresponding policies. And dividing all operation and maintenance accounts of each server into different roles according to different authorities. The quantum key issuing center issues quantum random number key pairs by taking the roles of all operation and maintenance accounts of all servers in quantum communication network server resources as units. For example, the following steps are carried out: if the quantum communication network server resource has N target access servers and all operation and maintenance accounts of the ith target access server have
The quantum key issuing center issues the resources of the quantum bastion machine and the quantum communication network server according to the roles with different authorities
For a shared quantum random number key. The quantum random number key is stored in the key storage module of each server in the quantum bastion machine and quantum communication network server resources.
The quantum key issuing center issues quantum random number key pairs to the quantum bastion machine and the quantum communication network server resource, and the process is divided into local issuing and remote issuing. If the data transmission between a certain server in the quantum bastion machine or the quantum communication network server resource and the quantum key issuing center is within an acceptable physical distance, the corresponding quantum random number key can be copied to the designated acceptance point of the quantum key issuing center through the mobile medium, the obtained quantum random number key is taken to the quantum bastion machine or the quantum communication network server resource, and the quantum random number key is encrypted by the security encryption module of the certain server in the quantum bastion machine or the quantum communication network server resource and then stored in the key storage module. The removable medium is preferably a trusted removable hard disk or flash disk or the like held by a trusted person. If the data transmission between a certain server in the quantum bastion machine or the quantum communication network server resource and the quantum key issuing center is within the acceptable physical distance, the quantum random number key can be issued to the certain server in the quantum bastion machine or the quantum communication network server resource remotely, besides the local issuing to the appointed acceptance point with more cost than the acceptable cost, and the transmission of the quantum random number key passes through the quantum communication network. In the following, taking the quantum bastion machine and the quantum communication network server resource as an example of remote issuing, a specific process that the quantum key issuing center issues a shared quantum random number key to a role of a certain server in the quantum bastion machine and the quantum communication network server resource is described:
1) and the permission strategy module in the quantum key issuing center divides all operation and maintenance accounts of each server in the quantum communication network server resources into a plurality of roles according to the corresponding strategy protocol. And assigns a server ID to each server and a role ID to each role of each server. I.e. the role right assignment of each server is completed.
2) The quantum key issuing center obtains a certain amount of quantum random number keys from the quantum random number generation module, encrypts key information such as the server ID, the role ID, the quantum random number keys and the like by using quantum keys generated by a quantum key distribution server in a local quantum communication network service station to obtain ciphertext data, and sends the ciphertext. Among them, the method of encrypting the quantum random number key using the quantum key is preferably a one-time pad.
3) The ciphertext data is transmitted to a quantum communication network service station local to the quantum bastion machine or a quantum communication network service station where the quantum communication network server resource is located through a communication network.
4) The quantum communication network service station local to the quantum bastion machine or the quantum communication network service station where the quantum communication network server resource is located decrypts the ciphertext data by using the shared quantum key to obtain key information, the key information is directly transmitted to the security encryption module of the server appointed by the quantum bastion machine or the server ID through a secure dedicated line, and the key information is encrypted by the security encryption module and then stored in the key storage module.
The quantum random number key pairs of all roles of all servers in the resources of the quantum bastion machine and the quantum communication network server are issued by the method.
Therefore, quantum bastion machine and each server in the quantum communication network server resource realize quantum random number key sharing, and the quantum random number key shared by quantum bastion machine and each server is accurate to different roles of the server.
3. Process for logging in quantum fort machine system by terminal user
The terminal users are divided into two types, the first type is the operation and maintenance users of the bastion machine, including managers and auditors at all levels of the bastion machine, and the target access equipment is the quantum bastion machine. The second type is a server operation and maintenance user, including all levels of administrators and all levels of operation and maintenance personnel of the server, and the target access device is each server in the quantum communication network server resource.
In the invention, the server operation and maintenance user must log in the quantum bastion machine first, and the quantum bastion machine replaces the server operation and maintenance user to complete the authentication with each server in the quantum communication network server resource, thereby acquiring the authority of accessing the corresponding server.
Therefore, the user of the bastion machine operation and maintenance and the user of the server operation and maintenance only need to complete the authentication with the quantum bastion machine, and the authentication is preferably bidirectional identity authentication completed by a shared quantum random number key. The specific process is as follows:
(1) the end user sends the user ID, the IP port of the logged-in bastion machine, the authority information and the like as request messages to the quantum bastion machine through the quantum key card.
(2) And after receiving the request message, the quantum bastion machine generates a random number N1 and returns the random number to the end user.
(3) The end user receives the random number N1. First, the authentication code MAC1 is obtained by an authentication function using the quantum random number key K1 and the random number N1 shared with the quantum baster. The end user then generates a random number N2. Finally, the random number N2 and the authentication code MAC1 are returned to the quantum baster.
(4) The quantum bastion machine receives the random number N2 and the authentication code MAC 1. First, the quantum baster finds the quantum random number key K1 ' shared with the end user by the user ID, and passes K1 ' and the random number N1 through an authentication function to obtain MAC1 '.
Comparing MAC1 and MAC1 ', if MAC1= MAC 1' indicates that the quantum baster successfully authenticates the end user, the quantum baster returns a message of successful authentication to the end user. If the MAC1 is not equal to the MAC 1', the authentication failure of the quantum bastion machine to the terminal user is indicated, and the quantum bastion machine returns a message of authentication failure to the terminal user. If the quantum bastion machine successfully authenticates the end user, the quantum bastion machine uses a quantum random number key K2 shared by the end user to perform authentication function processing on a random number N2 to obtain an authentication code MAC2, and returns the authentication code MAC2 to the end user.
(5) The end user receives the authentication code MAC2 and performs an authentication function on the random number N2 using the quantum random number key K2 'shared with the quantum baster to obtain the authentication code MAC 2'.
MAC2 and MAC2 'are compared and if MAC2= MAC 2', a message is indicated that the end user successfully authenticated the quantum baster and returned to the quantum baster that the authentication was successful. If MAC2 ≠ MAC 2', it indicates that the end-user failed authentication with the quantum bastion machine and returns a message of authentication failure to the quantum bastion machine.
The authentication function used for generating the authentication code in the present invention is preferably an HMAC algorithm.
The bidirectional identity authentication between the quantum bastion machine and the terminal user is completed through the steps.
After the authentication is successful, the quantum bastion machine will completely determine the information of the type, role authority and the like of the end user, as shown in figure 3. If the terminal user is the operation and maintenance user of the bastion machine, the terminal user can perform corresponding safe operation on the quantum bastion machine according to the role authority of the terminal user. If the terminal user is a server operation and maintenance user, the quantum bastion machine determines the role authority of each server in the quantum communication network server resources owned by the server operation and maintenance user according to the role authority.
The quantum bastion machine finds quantum random number keys shared with different roles of the servers according to the role permissions of the servers owned by the server operation and maintenance user, completes bidirectional identity authentication with the different roles of the servers through the quantum random number keys, and shows that the server operation and maintenance user obtains the permission to access certain functions of the corresponding servers after the authentication is successful. The authentication process of the quantum bastion machine and a role authority is as follows:
a) after the quantum bastion machine and the server operation and maintenance user complete identity authentication, the identity of the user, the role authority and other information are determined, wherein the information comprises the ID of each server and the role ID thereof in the access quantum communication network server resource owned by the user.
b) The quantum bastion machine obtains a quantum random number key shared with the server ID and the role ID thereof from the key storage module through the security encryption module, and sends the server ID, the role ID and the like as request messages to the server corresponding to the server ID through the quantum key card.
c) After receiving the request message, the server generates a random number N3 and returns the random number to the quantum bastion machine.
d) The quantum baster receives the random number N3. First, the authentication code MAC3 is obtained by an authentication function using the quantum random number key K3 and the random number N3 shared with the server ID and its role ID. The quantum fort machine then generates a random number N4. Finally, the random number N4 and the authentication code MAC3 are returned to the server corresponding to the server ID.
e) The server corresponding to the server ID receives the random number N4 and the authentication code MAC 3. First, the server finds the shared quantum random number key K3 ' by role ID and gets the MAC3 ' by passing K3 ' and the random number N3 through the authentication function. Comparing MAC3 with MAC3 ', if MAC3= MAC 3' indicates that the server successfully authenticates the quantum baster, the server returns a message of authentication success to the quantum baster. If the MAC3 is not equal to the MAC 3', the authentication failure of the server to the quantum bastion machine is indicated, and the server returns a message of authentication failure to the quantum bastion machine. If the server successfully authenticates the quantum bastion machine, the server uses a quantum random number key K4 shared by the role ID to perform authentication function processing on a random number N4 to obtain an authentication code MAC4, and returns the authentication code MAC4 to the quantum bastion machine.
f) The quantum bastion machine receives the authentication code MAC4, and performs authentication function processing on the random number N4 by using the quantum random number key K4 'shared by the role IDs to obtain the authentication code MAC 4'. Comparing MAC4 with MAC4 ', if MAC4= MAC 4', it indicates that the quantum baster successfully authenticates the server and returns a message of authentication success to the server. If the MAC4 ≠ MAC 4', it indicates that the quantum baster failed to authenticate with the server and returns a message of authentication failure to the server.
g) And after the authentication is completed, the operation and maintenance user of the server can operate the server in the quantum communication network server resources according to the appointed authority strategy through the quantum bastion machine.
The identity authentication which needs to be completed by sharing the quantum random number key in the invention is preferably the bidirectional identity authentication. However, the present invention is not limited to the above two-way authentication, and may be a one-way authentication, and all the authentication relying on the shared quantum random number key falls within the protection scope of the present invention.
In the invention, the remote data communication process between any two of the quantum bastion machine, each server in the quantum communication network server resource and the quantum key issuing center can carry out data encryption transmission through the quantum communication network.
It should be noted that the description of the embodiments of the present invention is for illustration only and is not intended to limit the scope of the claims of the present invention. Meanwhile, any modification, improvement or equivalent replacement of the present invention by a person with ordinary skill in the art belongs to the protection scope of the present invention.
Claims (4)
1. A quantum bastion machine system is characterized in that the system comprises a terminal user, a quantum bastion machine, a quantum communication network server resource and a quantum key issuing center;
the terminal users comprise bastion machine operation and maintenance users and server operation and maintenance users, the quantum communication network server resources are all servers needing to be monitored by the quantum bastion machine in the quantum communication network service station, and the quantum bastion machine manages and controls the terminal users to access the quantum communication network server resources;
the quantum key issuing center issues quantum random number keys between the terminal user and the quantum bastion machine and between the quantum bastion machine and each server in the quantum communication network server resources;
the quantum key issuing center issues the shared quantum random number key for the terminal user and the quantum bastion machine, and the steps are as follows:
a terminal user applies for issuing a quantum random number key to an acceptance point specified by a quantum key issuing center, the quantum key issuing center allocates a user ID for the terminal user and determines the role authority of the user and the ID of a quantum bastion machine logged in by the user, then quantum random number keys in the quantity specified by the user are generated, user information, the quantum random number keys and an encryption strategy are written into a quantum key card, and the quantum key card is issued to the terminal user; the quantum key issuing center encrypts user information, the quantum random number key and the encryption strategy into ciphertext data and then issues the ciphertext data to the quantum bastion machine while issuing the quantum random number key to the terminal user, and the quantum bastion machine decrypts the ciphertext data to obtain the user information, the quantum random number key and the encryption strategy;
the quantum key issuing center issues the shared quantum random number key for each server in the quantum bastion machine and quantum communication network server resources, and the steps are as follows: the quantum key issuing center divides all operation and maintenance accounts of each server into different roles according to different authorities, and issues quantum random number key pairs by taking the roles of all operation and maintenance accounts of each server in quantum communication network server resources as units;
the terminal user and the bastion machine perform identity authentication based on a symmetric key and a message authentication code according to a shared quantum random number key, after the authentication is completed, the quantum bastion machine determines the type and role authority of the terminal user, and if the terminal user is an operation and maintenance user of the bastion machine, the terminal user can perform corresponding safe operation on the quantum bastion machine according to the role authority of the terminal user; if the terminal user is a server operation and maintenance user, the quantum bastion machine determines the role authority of each server in the quantum communication network server resources owned by the server operation and maintenance user according to the role authority, finds quantum random number keys shared with different roles of the servers according to the role authority of each server owned by the server operation and maintenance user, completes identity authentication based on symmetric keys and message authentication codes between the quantum random number keys and different roles of the servers, and the server operation and maintenance user obtains the authority for accessing certain functions of the corresponding servers after the authentication is successful; the quantum bastion machine comprises a security encryption module, a key storage module and an authentication module, wherein the security encryption module in the quantum bastion machine is used for encrypting a quantum random number key, the key storage module in the quantum bastion machine is used for storing the quantum random number key encrypted by the security encryption module, and the authentication module is used for mutually authenticating a quantum key card and the quantum bastion machine and servers of quantum bastion machine and quantum communication network server resources;
each server in the quantum communication network server resource comprises a security encryption module, a key storage module and an authentication module; the security encryption module in the server is used for encrypting the quantum random number key, the key storage module in the server is used for storing the quantum random number key encrypted by the security encryption module, and the authentication module is used for mutual authentication between the quantum bastion machine and each server of the quantum communication network server resource.
2. An authentication method of a quantum fort machine system is characterized by comprising the following steps:
s1, the terminal user is connected with the quantum fort machine, and the quantum fort machine is accessed to the quantum communication network server resource; the terminal users comprise bastion machine operation and maintenance users and server operation and maintenance users, and the quantum communication network server resources are all servers needing to be monitored by the quantum bastion machine in the quantum communication network service station; the quantum key issuing center is used for generating quantum random numbers through the quantum random number generating server and respectively issuing the quantum random numbers to the positions between each terminal user and the quantum bastion machine and between the quantum bastion machine and the quantum communication network server resource to form a shared quantum random number key pair; the quantum bastion machine comprises a security encryption module, a key storage module and an authentication module, wherein the security encryption module is used for encrypting a quantum random number key; the secret key storage module is used for storing the quantum random number secret key encrypted by the security encryption module; the authentication module is used for performing mutual authentication between the quantum key card and the quantum bastion machine and between the quantum bastion machine and each server of the quantum communication network server resource;
s2 the quantum key issuing center issues quantum random number key pairs to the terminal user and the quantum bastion machine, the quantum bastion machine and the quantum communication network server resource respectively; wherein,
the quantum key issuing center issues the shared quantum random number key for the terminal user and the quantum bastion machine, and the steps are as follows:
a terminal user applies for issuing a quantum random number key to an acceptance point specified by a quantum key issuing center, the quantum key issuing center allocates a user ID for the terminal user and determines the role authority of the user and the ID of a quantum bastion machine logged in by the user, then quantum random number keys in the quantity specified by the user are generated, user information, the quantum random number keys and an encryption strategy are written into a quantum key card, and the quantum key card is issued to the terminal user;
the quantum key issuing center issues quantum random number keys to the quantum bastion machine in two processes, wherein one process is local issuing, namely copying corresponding key information to a designated acceptance point of the quantum key issuing center through a mobile medium, bringing the acquired key information to the quantum bastion machine, encrypting the key information by a security encryption module of the quantum bastion machine, and storing the encrypted key information in a key storage module; the other is remote issuing, and the specific process is as follows: the quantum key issuing center encrypts user information, a quantum random number key and an encryption strategy by using a quantum key generated by a quantum key distribution server in a local quantum communication network service station to obtain ciphertext data and sends the ciphertext data out; the cipher text data are transmitted to a quantum communication network service station local to the quantum bastion machine through a communication network, the quantum communication network service station local to the quantum bastion machine decrypts the cipher text data by using a shared quantum key generated by a quantum key distribution server to obtain key information, the key information is directly transmitted to a safety encryption module of the quantum bastion machine through a safe special line, and the key information is stored in a key storage module after being encrypted by the safety encryption module; after the key information is successfully stored by the key storage module of the quantum bastion machine, returning a message of successful issuing to the quantum key issuing center;
the quantum key issuing center issues the shared quantum random number key for each server in the quantum bastion machine and quantum communication network server resources, and the steps are as follows: the quantum key issuing center divides all operation and maintenance accounts of each server into different roles according to different authorities, and issues quantum random number key pairs by taking the roles of all operation and maintenance accounts of each server in quantum communication network server resources as units;
s3, the terminal user logs in the quantum fort machine, and the identity authentication based on the symmetric key and the message authentication code is carried out through the quantum random number key shared by the terminal user and the quantum fort machine;
after the terminal user successfully authenticates the quantum bastion machine, the quantum bastion machine determines the type and role authority of the terminal user, and if the terminal user is a bastion machine operation and maintenance user, the terminal user can perform corresponding safe operation on the quantum bastion machine according to the role authority of the terminal user; if the terminal user is a server operation and maintenance user, the quantum bastion machine determines the role authority of each server in the quantum communication network server resources owned by the server operation and maintenance user according to the role authority, finds the quantum random number keys shared with different roles of the servers according to the role authority of each server owned by the server operation and maintenance user, completes identity authentication based on the symmetric keys and the message authentication codes between the terminal user and the different roles of the servers through the quantum random number keys, and the server operation and maintenance user obtains the authority for accessing certain functions of the corresponding servers after the authentication is successful.
3. The quantum bastion system authentication method of claim 2, wherein each server in the quantum communication network server resource comprises a security encryption module, a key storage module and an authentication module, the security encryption module in the server is used for encrypting the encrypted quantum random number key issued to the server by the quantum key issuing center, the key storage module in the server is used for storing the quantum random number key encrypted by the security encryption module, and the authentication module is used for mutual authentication between the quantum bastion machine and each server in the quantum communication network server resource.
4. The authentication method of the quantum bastion system as claimed in claim 3, wherein the manner of issuing the quantum random number key to each server in the server resources of the quantum communication network by the quantum key issuing center includes:
mode a, transmitting to the security encryption module via a mobile storage medium; or
The mode b is that the information is directly transmitted to the security encryption module through a special communication line;
in the mode a and the mode b, the security encryption module encrypts the received quantum random number key and stores the encrypted quantum random number key in the key storage module of each server in the quantum communication network server resource.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710003788.5ACN106888084B (en) | 2017-01-04 | 2017-01-04 | Quantum fort machine system and authentication method thereof |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710003788.5ACN106888084B (en) | 2017-01-04 | 2017-01-04 | Quantum fort machine system and authentication method thereof |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106888084A CN106888084A (en) | 2017-06-23 |
| CN106888084Btrue CN106888084B (en) | 2021-02-19 |
Family
ID=59176209
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710003788.5AActiveCN106888084B (en) | 2017-01-04 | 2017-01-04 | Quantum fort machine system and authentication method thereof |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106888084B (en) |
Families Citing this family (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110505063B (en)* | 2018-05-17 | 2022-08-02 | 广东国盾量子科技有限公司 | Method and system for ensuring security of financial payment |
| CN109213603B (en)* | 2018-05-31 | 2021-04-06 | 合肥本源量子计算科技有限责任公司 | Cloud platform operation method for butting quantum computer and user |
| CN109450859A (en)* | 2018-10-15 | 2019-03-08 | 成都安恒信息技术有限公司 | A kind of cipher code protection method applied to plaintext agency by agreement in O&M auditing system |
| CN109660338B (en)* | 2018-11-19 | 2021-07-27 | 如般量子科技有限公司 | Anti-quantum computation digital signature method and system based on symmetric key pool |
| CN109495250B (en)* | 2018-12-03 | 2021-08-10 | 如般量子科技有限公司 | Quantum-computation-resistant intelligent home communication method and system based on key fob |
| CN109495251B (en)* | 2018-12-03 | 2021-08-10 | 如般量子科技有限公司 | Anti-quantum-computation intelligent home cloud storage method and system based on key fob |
| CN110719277B (en)* | 2019-09-30 | 2022-01-04 | 北京网瑞达科技有限公司 | System and method for secure access of network device based on one-time access credential |
| CN110719276B (en)* | 2019-09-30 | 2021-12-24 | 北京网瑞达科技有限公司 | Network equipment safety access system based on cache password and working method thereof |
| CN110933039A (en)* | 2019-11-05 | 2020-03-27 | 河南智业科技发展有限公司 | Soldier investigation system for safely transferring data |
| CN112187451B (en)* | 2020-08-20 | 2023-03-24 | 如般量子科技有限公司 | Quantum computation resistant communication method, device, equipment and storage medium |
| CN113037708B (en)* | 2021-02-02 | 2023-08-25 | 中国人民解放军战略支援部队信息工程大学 | Method and system for unified management of quantum device hardware resources based on application layer protocol |
| CN113346990B (en)* | 2021-05-11 | 2022-12-23 | 科大讯飞股份有限公司 | Secure communication method and system, and related equipment and device |
| CN114244604B (en)* | 2021-12-16 | 2024-03-29 | 杭州乒乓智能技术有限公司 | Integrated authority management method and system suitable for fort machine, electronic equipment and readable storage medium |
| CN114339741B (en)* | 2021-12-30 | 2024-11-01 | 江苏亨通问天量子信息研究院有限公司 | Mobile encryption communication method and system based on quantum memory card |
| CN114826574B (en)* | 2022-04-19 | 2024-10-18 | 中国电子科技集团公司第三十研究所 | Smart home security communication system and communication method |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103338448A (en)* | 2013-06-07 | 2013-10-02 | 国家电网公司 | Wireless local area network security communication method based on quantum key distribution |
| EP2555466B1 (en)* | 2011-08-05 | 2014-07-02 | SELEX ES S.p.A. | System for distributing cryptographic keys |
| WO2016112086A1 (en)* | 2015-01-08 | 2016-07-14 | Alibaba Group Holding Limited | Quantum key distribution system, method and apparatus based on trusted relay |
| CN105812367A (en)* | 2016-03-15 | 2016-07-27 | 浙江神州量子网络科技有限公司 | Authentication system and authentication method of network access device in quantum network |
| WO2016177332A1 (en)* | 2015-05-05 | 2016-11-10 | 科大国盾量子技术股份有限公司 | Cloud storage method and system |
Family Cites Families (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7391867B2 (en)* | 2004-04-22 | 2008-06-24 | Magiq Technologies, Inc. | Graphical display of QKD system statistics |
| US20100298050A1 (en)* | 2009-05-06 | 2010-11-25 | Crabdish Inc., Dba Umapper.Com | Map-authoring applications and geogames |
| CN102196425B (en)* | 2011-07-01 | 2013-04-03 | 安徽量子通信技术有限公司 | Quantum-key-distribution-network-based mobile encryption system and communication method thereof |
| CN104243143B (en)* | 2013-06-08 | 2017-03-29 | 科大国盾量子技术股份有限公司 | A mobile secure communication method based on quantum key distribution network |
| CN104243419B (en)* | 2013-06-18 | 2018-04-27 | 腾讯科技（深圳）有限公司 | Data processing method, apparatus and system based on safety shell protocol |
| CN103475727A (en)* | 2013-09-18 | 2013-12-25 | 浪潮电子信息产业股份有限公司 | Database auditing method based on bridged mode |
| US20160300223A1 (en)* | 2015-04-08 | 2016-10-13 | Portable Data Corporation | Protected data transfer across disparate networks |
- 2017
- 2017-01-04CNCN201710003788.5Apatent/CN106888084B/enactiveActive
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP2555466B1 (en)* | 2011-08-05 | 2014-07-02 | SELEX ES S.p.A. | System for distributing cryptographic keys |
| CN103338448A (en)* | 2013-06-07 | 2013-10-02 | 国家电网公司 | Wireless local area network security communication method based on quantum key distribution |
| WO2016112086A1 (en)* | 2015-01-08 | 2016-07-14 | Alibaba Group Holding Limited | Quantum key distribution system, method and apparatus based on trusted relay |
| WO2016177332A1 (en)* | 2015-05-05 | 2016-11-10 | 科大国盾量子技术股份有限公司 | Cloud storage method and system |
| CN105812367A (en)* | 2016-03-15 | 2016-07-27 | 浙江神州量子网络科技有限公司 | Authentication system and authentication method of network access device in quantum network |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106888084A (en) | 2017-06-23 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106888084B (en) | Quantum fort machine system and authentication method thereof | |
| US7155616B1 (en) | Computer network comprising network authentication facilities implemented in a disk drive | |
| US8856530B2 (en) | Data storage incorporating cryptographically enhanced data protection | |
| US8971537B2 (en) | Access control protocol for embedded devices | |
| US6073237A (en) | Tamper resistant method and apparatus | |
| EP3585023B1 (en) | Data protection method and system | |
| CN109361668A (en) | A method of reliable data transmission | |
| CN101605137B (en) | Safe distribution file system | |
| IL266535A (en) | System and method for transparent multi-factor authentication and security posture checking | |
| CN104756127A (en) | Secure data handling by a virtual machine | |
| CN103220141B (en) | A kind of protecting sensitive data method and system based on group key strategy | |
| JP2004509398A (en) | System for establishing an audit trail for the protection of objects distributed over a network | |
| CN103001976A (en) | A Safe Network Information Transmission Method | |
| CN104767731A (en) | Identity authentication protection method of Restful mobile transaction system | |
| CN106027473A (en) | Identity card reading terminal and cloud authentication platform data transmission method and system | |
| CN113098697A (en) | Block chain data writing and accessing method and device | |
| CN118484793A (en) | Identity security authentication method for energy storage equipment | |
| Said et al. | A multi-factor authentication-based framework for identity management in cloud applications | |
| CN115021927B (en) | Administrator identity management and control method and system for cryptographic machine cluster | |
| CN114826702B (en) | Database access password encryption method and device and computer equipment | |
| CN120017380A (en) | A power information security system and method | |
| CN106992978A (en) | Network safety managing method and server | |
| CN103944721A (en) | Method and device for protecting terminal data security on basis of web | |
| CN112347440B (en) | User access authority division system of industrial control equipment and application method thereof | |
| CN117294489A (en) | Self-adaptive dynamic access control method and system based on authorization policy |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |