CN-121984676-A - Server quantum key storage system combined with trusted computing module

CN121984676ACN 121984676 ACN121984676 ACN 121984676ACN-121984676-A

Abstract

The invention discloses a server quantum key storage system combined with a trusted computing module, which relates to the technical field of quantum communication network security and comprises a server main board; the system comprises a server main board, a deep fusion trusted computing module, a key storage unit and a key management engine, wherein the deep fusion trusted computing module is integrated on the server main board, the key storage unit is arranged on or in communication connection with the server main board, and the key management engine is used for managing the key. The server quantum key storage system combined with the trusted computing module fundamentally avoids the risk that key data is exposed in a plaintext form in an external interface or a system memory. Meanwhile, a closed-loop management model based on a dynamic security state machine, which is implemented by the system, applies multiple independent verification and verification rules to each state migration of key generation, storage, use, backup, recovery and destruction, so that the security constraint on single key operation is strengthened, and active and consistent management and control on the whole life cycle of the key is realized.

Inventors

LIANG GUOCHUN
MA ZHENXIAO

Assignees

东方森太科技集团有限公司

Dates

Publication Date: 20260505
Application Date: 20260303

Claims (10)

1. A server quantum key storage system incorporating a trusted computing module, comprising: A server motherboard; the trusted computing module is integrated on the server main board; the key storage unit is arranged on the server main board or is in communication connection with the server main board; a key management engine; the deep fusion trusted computing module is connected with the central processing unit and the memory controller of the server main board through an on-chip bus; The key management engine operates in the deeply converged trusted computing module; the key storage unit stores session key ciphertext encrypted by the deeply converged trusted computing module; The deep fusion trusted computing module is configured to receive a session key issued by a key issuing center, complete encryption operation on the session key in the session key issuing center and send the obtained session key ciphertext to the key storage unit for storage; and responding to the communication request of the server main board, finishing decryption of the session key ciphertext in the deep fusion trusted computing module to obtain a session key plaintext, and executing encryption and decryption operation by using the session key plaintext; the session key plaintext only appears inside the deeply fused trusted computing module; The key management engine is configured to create and maintain a dynamic security state machine for each key instance in the system, the dynamic security state machine comprising a plurality of predetermined states, the key management engine controlling each key instance to transition between different states of its dynamic security state machine according to preset verification and validation rules, the plurality of predetermined states comprising at least a generation state, a storage ready state, an in-use state, and a destruction state.
2. The server quantum key storage system of claim 1 wherein the deep converged trusted computing module is a hardware security module integrated in a chipset or a system on a chip of the server motherboard in the form of a silicon intellectual property core.
3. The server quantum key storage system combined with the trusted computing module as claimed in claim 2, wherein the on-chip bus is a high-speed interconnection bus located inside the chipset or the on-chip system and is directly connected with the deep-converged trusted computing module, the central processing unit and the memory controller.
4. The server quantum key storage system of claim 3 in combination with a trusted computing module, wherein the deep converged trusted computing module comprises: the hardware encryption and decryption engine is used for executing the encryption and decryption operation; A true random number generator for generating a random number; a physically secured secure storage area for protectively storing critical secure data.
5. The server quantum key storage system of claim 4 in combination with a trusted computing module wherein the key management engine is configured such that said controlling each key instance to transition between different states of its dynamic security state machine comprises: When the key instance is in the generate state, performing a first multiple independent verification before allowing it to transition to a store ready state; When the key instance is in a storage ready state and receives a use request, before the key instance is allowed to be transferred to a use state, executing a second multiple independent verification and verification, and after the use is completed, executing a closed-loop verification for use, and then transferring the key instance to the storage ready state or to a destruction state; The key management engine also controls the transfer of the key instance from the storage ready state to the backup state and the restore transfer from the to-be-restored state to the storage ready state, and performs a verification loop after the restore transfer.
6. The server quantum key storage system of claim 5 in combination with a trusted computing module wherein the performing a first plurality of independent verifications comprises: the true random number generator fuses at least two independent physical entropy sources to generate a key seed; The hardware encryption and decryption engine generates a target key based on the key seed; After the target key is generated, the key management engine immediately calls hash functions of two different algorithms, respectively calculates fingerprints of the target key, and stores the obtained two fingerprints in the physically protected safe storage area.
7. The server quantum key storage system of claim 6 in combination with a trusted computing module wherein the performing a second plurality of independent verifications and the using a closed loop verification comprises: when a request for use of a particular session key in a storage ready state is received, the key management engine first checks the current state of the particular session key and verifies the integrity of its fingerprint stored in the physically secured secure storage area; After verification is passed, the key management engine controls the deeply fused trusted computing module to decrypt the ciphertext of the specific session key, and loads the obtained plaintext into a composite secure enclave, wherein the composite secure enclave is constructed by a hardware secure enclave provided by the central processing unit and the deeply fused trusted computing module; the hardware encryption and decryption engine executes encryption and decryption operation of a request in the composite secure enclave by using a plaintext of the specific session key; after the operation is finished, before outputting a result, the composite secure enclave sends an integrity certification to the key management engine; The key management engine verifies the integrity certification, and after the verification is passed, the party allows the operation result to be output and updates the state of the specific session key into the in-use state; after the specific session key is used, the key management engine updates its state back to a storage ready state.
8. The server quantum key storage system of claim 7 in combination with a trusted computing module wherein the transition of the control key instance from the storage ready state to the backup state and the recovery transition from the to-be-recovered state to the storage ready state comprises: when a target key needs to be backed up, the key management engine controls the hardware encryption and decryption engine to split a plaintext of the target key into a plurality of fragments by using a threshold secret sharing algorithm; encrypting each fragment by using a plurality of different encryption keys, and storing the encrypted fragments in a plurality of independent storage nodes in communication connection with the server main board in a scattered manner; When the target key needs to be recovered, collecting at least the encrypted fragments reaching the threshold number from the plurality of independent storage nodes, and transmitting the encrypted fragments to the deeply fused trusted computing module; The hardware encryption and decryption engine decrypts the collected encrypted fragments by using the corresponding encryption keys in the deep-fusion trusted computing module and obtains the plaintext of the target key again; after the recombination, the key management engine controls the hardware encryption and decryption engine to immediately execute a complete encryption and decryption self-test cycle by using the plaintext key obtained by the recombination; After the self-test loop is successfully completed, the key management engine side sets the state of the target key to be a storage ready state.
9. The server quantum key storage system of claim 8 wherein the performing a first multiple independent verification further comprises the key management engine controlling the deep converged trusted computing module to perform a challenge-response protocol with a key distribution center for secondary liveness authentication in addition to verifying the digital signature of the key when the target key is an externally injected key.
10. The server quantum key storage system combined with the trusted computing module according to claim 9, wherein the key storage unit is a solid state disk, a mechanical hard disk or a network storage device.

Description

Server quantum key storage system combined with trusted computing module Technical Field The invention relates to the technical field of quantum communication network security, in particular to a server quantum key storage system combined with a trusted computing module. Background At present, the key use mode mainly comprises two modes of software encryption and hardware encryption, wherein the software encryption depends on a server to finish encryption and decryption operations, but the key can appear in a server memory in a plaintext form at a certain moment, and risks of being stolen by malicious programs or attackers exist, the hardware encryption is realized through special hardware such as an encryption card, the traditional hardware encryption scheme depends on a classical public key infrastructure PKI, the root key of the traditional hardware encryption scheme is usually stored in the encryption card in a plaintext form, and the security strength is difficult to meet the high security requirement of a quantum communication system on key management. Patent document with the authority of CN206611427U discloses a "key storage management system based on a trusted computing device", which realizes the encrypted storage and secure use of session keys through the trusted computing device, and the keys only appear in plaintext form inside the trusted computing device, thereby improving the security of key storage and use. The scheme solves the leakage risk of the secret key in the process of storage and use to a certain extent, but the design is more focused on the combination of the universal trusted computing terminal and the secret key using device, and the high-frequency, large-capacity and high-integration storage and management requirements of the quantum secret key in the server environment are not fully optimized. In a server system, how to deeply integrate a trusted computing module with server hardware, realize efficient collaboration of key storage and use, and support flexible expansion and maintenance at the same time, is still a technical problem to be solved. In addition, the existing key storage scheme mostly adopts a fixed storage structure, the backup and recovery mechanism of the key often depends on external storage equipment, unified and safe key management and quick recovery are difficult to realize in a server cluster or a distributed system, and the requirements on space layout and maintenance convenience in an embedded or high-density server deployment scene cannot be met. Therefore, it is necessary to provide a quantum key storage system designed for a server environment and deeply fused with a trusted computing module, so that the integration level, maintainability and expandability of the system are further improved on the premise of ensuring the key storage and use safety, and the development needs of a quantum communication network in a large-scale and high-performance application scene are met. Disclosure of Invention The present invention is directed to a server quantum key storage system combined with a trusted computing module, so as to solve the problems set forth in the background art. In order to solve the technical problems, the invention provides the following technical scheme that a server quantum key storage system combined with a trusted computing module comprises: A server motherboard; the trusted computing module is integrated on the server main board; the key storage unit is arranged on the server main board or is in communication connection with the server main board; a key management engine; the deep fusion trusted computing module is connected with the central processing unit and the memory controller of the server main board through an on-chip bus; The key management engine operates in the deeply converged trusted computing module; the key storage unit stores session key ciphertext encrypted by the deeply converged trusted computing module; The deep fusion trusted computing module is configured to receive a session key issued by a key issuing center, complete encryption operation on the session key in the session key issuing center and send the obtained session key ciphertext to the key storage unit for storage; and responding to the communication request of the server main board, finishing decryption of the session key ciphertext in the deep fusion trusted computing module to obtain a session key plaintext, and executing encryption and decryption operation by using the session key plaintext; the session key plaintext only appears inside the deeply fused trusted computing module; The key management engine is configured to create and maintain a dynamic security state machine for each key instance in the system, the dynamic security state machine comprising a plurality of predetermined states, the key management engine controlling each key instance to transition between different states of its dynamic security state machine according to preset verification an