METHOD, APPARATUS, AND SYSTEM FOR CLOUD-BASED ENCRYPTION MACHINE KEY INJECTION

• US 20160315768A1
• Filed: 04/20/2016
• Published: 10/27/2016
• Est. Priority Date: 04/22/2015
• Status: Active Grant

• Current Assignee: Alibaba Group Holding Ltd.
• Original Assignee: Alibaba Group Holding Ltd.
• Inventors: FU, Yingfang, LIU, Shuanlin
• Granted Patent: US 10,305,688 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0852 Quantum cryptography transmission systems employing electromagnetic waves other than radio waves, e.g. light, infrared H04B10/00; wavelength-division multiplex systems H04J14/02; WDM arrangements H04J14/03

Abstract

A cloud-based encryption machine key injection system includes at least one key injection sub-system including a key generation device and a quantum key distribution device connected with the key generation device, and a cloud-based encryption machine hosting sub-system including an encryption machine carrying a virtual encryption device and a quantum key distribution device connected with the encryption machine. The key injection sub-system and the encryption machine hosting sub-system are connected with each other through their respective quantum key distribution devices. The key generation device may generate a root key component of the virtual encryption device and transmit the root key component to the encryption machine. The encryption machine may receive root key components from one or more key generation devices and synthesize a root key of the virtual encryption device in accordance with the received root key components.

Claims

1. A cloud-based encryption machine key injection system, comprising:

at least one key injection sub-system including a key generation device and a quantum key distribution device connected with the key generation device; and

a cloud-based encryption machine hosting sub-system including an encryption machine carrying a virtual encryption device and a quantum key distribution device connected with the encryption machine, wherein;

the key injection sub-system and the encryption machine hosting sub-system are connected with each other through their respective quantum key distribution devices,

the key generation device generates a root key component and sends the root key component via the quantum key distribution devices to the encryption machine, and

the encryption machine receives root key components from one or more key generation devices and synthesizes a root key of the virtual encryption device in accordance with the received root key components.

2. The cloud-based encryption machine key injection system of claim 1, wherein:

the quantum key distribution devices negotiate a shared key pair between the key generation device and the encryption machine, and

the quantum key distribution device of the at least one key injection sub-system uses a negotiated shared key to perform encryption transmission of the root key component to the encryption machine.

3. The cloud-based encryption machine key injection system of claim 1, wherein the at least one key injection sub-system includes one key injection sub-system;

and

the key generation device of the key injection sub-system generates a number of root key components for the virtual encryption device and sends the root key components via the quantum key distribution devices to the encryption machine.

4. The cloud-based encryption machine key injection system of claim 1, wherein:

the encryption machine further generates one root key component for the virtual encryption device and synthesizes the root key of the virtual encryption device in accordance with the received root key components from the at least one key injection sub-system and from the encryption machine.

5. The cloud-based encryption machine key injection system of claim 4, wherein:

the at least one key injection sub-system comprises a cloud-based management sub-system and a user sub-system located at a client terminal;

the management sub-system comprises a quantum key distribution device and a management device including the key generation device; and

the user sub-system comprises a quantum key distribution device and a terminal device including the key generation device.

6. The cloud-based encryption machine key injection system of claim 5, wherein the terminal device of the user sub-system further generates a user master key and transmits the user master key to the encryption machine.

7. The cloud-based encryption machine key injection system of claim 6, wherein the terminal device of the user sub-system further generates a user work key and transmits the user work key to the encryption machine.

8. The cloud-based encryption machine key injection system of claim 1, wherein the quantum key distribution device comprises a quantum encryption machine having a data encryption and decryption function.

9. The cloud-based encryption machine key injection system of claim 1, wherein the encryption machine synthesizes a root key of the virtual encryption device in accordance with the received root key components by using a secret reconstruction algorithm based on a threshold secret sharing mechanism.

10. A key injection method for an encryption machine comprising:

receiving, by the encryption machine, root key components, from at least one key injection sub-system; and

synthesizing, by the encryption machine, a root key in accordance with the received root key components from the at least one key injection sub-system.

11. The key injection method of claim 10, wherein:

the encryption machine includes a virtual encryption device; and

the root key is for the virtual encryption device.

12. The key injection method of claim 10, wherein each root key component is generated by a key generation device of the at least one key injection sub-system.

13. The key injection method of claim 10, further comprising generating a root key component by the encryption machine, and synthesizing, by the encryption machine, the root key in accordance with the received root key components from the at least one key injection sub-systems comprising:

synthesizing, by the encryption machine, a root key in accordance with the received root key components from the at least one key injection sub-systems and the root key component generated by the encryption machine.

14. The key injection method of claim 10, further comprising negotiating, by the encryption machine with each of the at least one key injection sub-system a shared key pair, and wherein the root key components from the at least one key injection sub-systems are encrypted with a key in the shared key pair.

15. The key injection method of claim 10, wherein:

the encryption machine is connected to a quantum key distribution device;

each of the at least one key injection sub-system includes a quantum key distribution device; and

receiving, by an encryption machine, root key components, from the at least one key injection sub-systems comprises receiving, by an encryption machine, via the quantum key distribution devices, root key components, from the at least one key injection sub-systems comprises.

16. The key injection method claim 10, wherein:

the at least one key injection sub-system comprises a cloud-based management sub-system and a user sub-system located at a client terminal, the cloud-based management sub-system including a key generation device, and the user sub-system including a key generation device.

17. The key injection method claim 16, further comprising:

receiving a user master key generated by the user sub-system from the user sub-system.

18. The key injection method claim 16, further comprising:

receiving a user work key generated by the user sub-system from the user sub-system.

19. The key injection method claim 10, further comprising, verifying identities of the at least one key injection sub-system.

20. The key injection method of claim 10, wherein synthesizing, by the encryption machine, the root key in accordance with the received root key components from the at least one key injection sub-systems comprises:

synthesizing, by the encryption machine, a root key in accordance with the received root key components from the at least one key injection sub-systems by using a secret reconstruction algorithm based on a threshold secret sharing mechanism.

21. A key injection apparatus for an encryption machine, comprising:

a shared key pair negotiation unit that negotiates a shared key pair with at least one key injection sub-system;

a root key component generation unit that generates a root key component for a virtual encryption device on the encryption machine; and

a root key synthesis unit that synthesizes a root key in accordance with the root key component generated by the root key component generation unit and root key components received from the at least one key injection sub-system.

22. The key injection apparatus of claim 21, wherein the root key components received from the at least one key injection sub-system are received through quantum key distribution devices respectively connected to the at least one key injection sub-system and the encryption machine.

23. The key injection apparatus of claim 21, wherein:

the root key components received from the at least one key injection sub-system are encrypted with a key in the shared key pair.

24. The key injection apparatus of claim 21, wherein:

the at least one key injection sub-system includes a cloud-based management sub-system including a key generation device and a user sub-system including a key generation device located at a client terminal.

25. The key injection apparatus of claim 21, wherein the root key synthesis unit synthesizes the root key by using a secret reconstruction algorithm based on a threshold secret sharing mechanism.