Anti-quantum secure communication method, device and equipment applied to public network channel

Abstract

The embodiment of the invention discloses an anti-quantum secure communication method, device and equipment applied to a public network channel. A specific embodiment of the method comprises the following steps: sending user authentication information to a communication receiving end; generating public and private key information of a sending end; based on public and private key information of a sending end, the following steps are executed: generating a sending end random number pair; sending the sending end public key information and a receiving end public key information request to a communication receiving end; performing public key scheme encryption on the random number pair of the sending end to obtain encrypted information of the sending end; generating master secret information; in response to determining that the current time meets the period time bar, based on the master secret information, executing a second loop step: determining a temporary session key and a temporary session effective duration; and in response to determining that the current communication duration is less than or equal to the valid duration of the temporary session key, performing encryption processing on the communication information. According to the embodiment, on the basis of resisting quantum attacks, the storage resource overhead of both communication parties can be reduced, and the communication encryption security can be improved.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular to quantum-resistant secure communication methods, devices, and apparatuses applied to public network channels. Background Art

[0002] When users communicate information through public network channels or when enterprises transmit data through public network channels, there is a need to protect personal privacy or prevent data leakage. In addition, with the development of quantum computing technology, classical public key cryptographic algorithms can no longer continue to protect the communication security of public network channels in the future, and a transition plan from classical secure communication to quantum-resistant secure communication is urgently needed. At present, when using conventional quantum-resistant encryption methods to encrypt communication information, the method usually adopted is: the communicating parties need to pre-agree on the national cryptographic standard encryption algorithm and use a preset set of shared keys for communication encryption.

[0003] However, when the above method is used for communication encryption, the following technical problems often occur: In actual network communications, each communication end often has multiple communication partners, so each communication end needs to agree with multiple communication partners and store independent shared keys, as well as record the corresponding relationship between multiple shared keys, which increases the storage overhead of both parties. In addition, there is also a risk of leakage of the shared key during the process of the two parties agreeing on the shared key (for example, in person, by email or social software), which reduces the security of communication encryption.

[0004] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the invention

[0005] The content of this disclosure is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this disclosure is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0006] Some embodiments of the present disclosure propose quantum-resistant secure communication methods, devices and apparatuses applied to public network channels to solve one or more of the technical problems mentioned in the above background technology section.

[0007] In a first aspect, some embodiments of the present disclosure provide a quantum-resistant secure communication method applied to a public network channel, the method comprising: sending user authentication information and an encryption confirmation request to a communication receiving end through a public network channel, wherein the user authentication information comprises: sender identity information and a first information list, the first information in the first information list represents a description of an encryption algorithm used to encrypt information; in response to receiving target encryption information confirmed by the communication receiving end, generating sender public and private key information according to the target encryption information, wherein the target encryption information is the first information confirmed by the communication receiving end from the first information list after receiving the encryption confirmation request, and the sender public and private key information comprises sender public key information and sender private key information; based on the sender public and private key information, executing the following first loop steps: generating a sender random number pair; sending the sender public and private key information to the communication receiving end through the public network channel. public key information and receiving end public key information request; in response to receiving the receiving end public key information sent by the above-mentioned communication receiving end, according to the above-mentioned receiving end public key information, the sending end random number pair is encrypted by the public key scheme to obtain the encrypted information of the sending end; according to the sending end random number pair and the above-mentioned sending end private key information, the master secret information is generated, wherein the above-mentioned master secret information corresponds to the generation time; in response to determining that the current time does not meet the preset time period condition corresponding to the generation time, the above-mentioned first loop step is executed again; in response to determining that the current time meets the period time bar corresponding to the generation time, based on the master secret information, the following second loop step is executed: according to the master secret information, a temporary session key and a temporary session validity period are determined; in response to determining that the current communication duration is less than or equal to the temporary session key validity period, the communication information is encrypted according to the temporary session key; in response to determining that the current communication duration is greater than the temporary session key validity period, the above-mentioned second loop step is executed again.

[0008] In a second aspect, some embodiments of the present disclosure provide a quantum-resistant secure communication device applied to a public network channel, the device comprising: a sending unit, configured to send user authentication information and an encryption confirmation request to a communication receiving end through a public network channel, wherein the user authentication information comprises: sender identity information and a first information list, the first information in the first information list represents a description of an encryption algorithm used to encrypt information; a generating unit, configured to generate sender public and private key information in response to receiving target encryption information confirmed by the communication receiving end, according to the target encryption information, wherein the target encryption information is the first information confirmed by the communication receiving end from the first information list after receiving the encryption confirmation request, and the sender public and private key information comprises sender public key information and sender private key information; an executing unit, configured to generate a sender random number pair; and send the sender public and private key information to the communication receiving end through the public network channel. In response to receiving the public key information of the receiving end sent by the above-mentioned communication receiving end, according to the above-mentioned public key information of the receiving end, the public key scheme is used to encrypt the random number pair of the sending end to obtain the encrypted information of the sending end; according to the random number pair of the sending end and the above-mentioned private key information of the sending end, the master secret information is generated, wherein the above-mentioned master secret information corresponds to the generation time; in response to determining that the current time does not meet the preset time period condition corresponding to the generation time, the above-mentioned first loop step is executed again; in response to determining that the current time meets the period time bar corresponding to the generation time, based on the master secret information, the following second loop step is executed: according to the master secret information, a temporary session key and a temporary session validity period are determined; in response to determining that the current communication duration is less than or equal to the validity period of the temporary session key, the communication information is encrypted according to the temporary session key; in response to determining that the current communication duration is greater than the validity period of the temporary session key, the above-mentioned second loop step is executed again.

[0009] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner of the above-mentioned first aspect.

[0010] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation manner of the above-mentioned first aspect is implemented.

[0011] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: through the quantum-resistant secure communication method applied to the public network channel of some embodiments of the present disclosure, the storage resource overhead of both parties of the communication can be reduced while resisting quantum attacks, and the security of communication encryption can be further improved. Specifically, the reason for the increase in storage overhead of both parties of the communication and the reduction in encryption security is that in actual network communication, each communication end often has multiple communication objects, so each communication end needs to agree with multiple communication objects and store mutually independent shared keys, and record the corresponding relationship of multiple shared secret keys, which leads to an increase in the storage overhead of the communication sending end. In addition, there is also a risk of leakage of the shared key in the process of the two parties of the communication agreeing on the shared key (for example, face-to-face or email), which leads to a reduction in the security of communication encryption. Based on this, the quantum-resistant secure communication method applied to the public network channel of some embodiments of the present disclosure, first, through the public network channel, sends user authentication information and encryption determination request to the communication receiving end. Among them, the above-mentioned user authentication information includes: the identity information of the sending end and the first information list. The first information in the above-mentioned first information list represents the description of the encryption algorithm used for information encryption. Thus, when initiating network communication, the communication sending end can send user authentication information and encryption confirmation request to the communication receiving end, so that the communication receiving end can perform identity authentication and agree on the encryption algorithm used for subsequent communication encryption. Then, in response to receiving the target encryption information confirmed by the above-mentioned communication receiving end, the sending end public and private key information is generated according to the above-mentioned target encryption information. Among them, the above-mentioned target encryption information is the first information confirmed by the above-mentioned communication receiving end from the first information list after receiving the above-mentioned encryption confirmation request. The above-mentioned sending end public and private key information includes the sending end public key information and the sending end private key information. Thus, when the communication sending end receives the encryption algorithm selected by the communication receiving end, two pairs of public and private keys for encryption can be generated. Finally, based on the above-mentioned sending end public and private key information, the following first loop step is performed: the first step is to generate a sending end random number pair. Thus, randomness can be added to the encryption of communication information by generating random numbers, thereby improving the security of communication encryption. The second step is to send the above-mentioned sending end public key information and the receiving end public key information request to the above-mentioned communication receiving end through a public network channel. The third step is to, in response to receiving the public key information of the receiving end sent by the above-mentioned communication receiving end, encrypt the random number pair of the sending end according to the public key information of the receiving end, and obtain the encrypted information of the sending end. In this way, the two communicating parties can exchange public keys and encrypt their respective random numbers with each other's public keys to obtain the encrypted information of the sending end and the encrypted information of the receiving end. The fourth step is to generate the master secret information according to the random number pair of the sending end and the above-mentioned private key information of the sending end. Among them, the generated master secret information corresponds to the generation time. In this way, the master secret information with timeliness and used to generate the communication encryption key can be generated through the interaction of random encrypted information between the communication sending end and the communication receiving end.In the fifth step, in response to determining that the current time does not meet the preset time period condition corresponding to the generation time, the first loop step is executed again. Thus, the timeliness of the generated master key information can be determined, and the master secret information is regenerated when it expires. In the sixth step, in response to determining that the current time meets the periodic time bar corresponding to the generation time, based on the master secret information, the following second loop step is executed: the first sub-step, according to the master secret information, the temporary session key and the temporary session validity period are determined. Thus, through the generated master secret information, the temporary session key and the effective period of the communication session with high complexity, randomness and timeliness can be finally determined. The second sub-step, in response to determining that the current communication duration is less than or equal to the effective period of the temporary session key, the communication information is encrypted according to the temporary session key. Thus, the communication information can be encrypted using the temporary session key, which greatly improves the security of communication encryption. The third sub-step, in response to determining that the current communication duration is greater than the effective period of the temporary session key, the second loop step is executed again. This is because the communicating parties will only select a random encryption algorithm when initiating network communication, and exchange random encrypted information through the selected encryption algorithm, and finally generate a temporary session key with extremely high complexity and randomness. Even when a temporary session key expires or there is a risk of leakage, attackers cannot crack the communication information encrypted by other temporary session keys, further improving the security of the communication session. At the end of the communication session, neither party needs to store the expired temporary session key. Since the encryption algorithm selected by the two ends of the communication includes the post-quantum cryptographic algorithm type, it can reduce the storage resource overhead of the two parties on the basis of resisting quantum attacks, and improve the security of communication encryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0013] Figure 1 is a flow chart of some embodiments of a quantum-resistant secure communication method applied to a public network channel according to the present disclosure;

[0014] Figure 2 It is a schematic diagram of the structure of some embodiments of the quantum-resistant secure communication device applied to a public network channel according to the present disclosure;

[0015] Figure 3 is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure;

[0016] Figure 4is a schematic communication flow chart of a quantum-resistant secure communication method applied to a public network channel according to the present disclosure;

[0017] Figure 5 A schematic system functional architecture diagram of a quantum-resistant secure communication method applied to a public network channel according to the present disclosure. DETAILED DESCRIPTION

[0018] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0019] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0020] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0021] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0022] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0023] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0024] Figure 1 The process 100 of some embodiments of the quantum-resistant secure communication method applied to a public network channel according to the present disclosure is shown. The quantum-resistant secure communication method applied to a public network channel comprises the following steps:

[0025] Step 101, sending user authentication information and an encryption confirmation request to a communication receiving end through a public network channel.

[0026] In some embodiments, the execution subject (such as a computing device) of the quantum-resistant secure communication method applied to a public network channel can send user authentication information and an encryption determination request to the communication receiving end through the public network channel. Among them, the above-mentioned user authentication information includes: the identity information of the sending end and the first information list. Each first information in the above-mentioned first information list represents a description of an encryption algorithm used for information encryption. For example, the first information in the above-mentioned first information list may be the algorithm name of the encryption algorithm. The above-mentioned sending end identity information may be information representing the identity of the above-mentioned execution subject (i.e., the communication sending end). The above-mentioned sending end identity information may be, but is not limited to, the serial number of the communication sending end device or the network IP address of the communication sending end. The above-mentioned encryption determination request may be a request for the above-mentioned communication receiving end to determine the target encryption algorithm.

[0027] Step 102, in response to receiving the target encryption information confirmed by the communication receiving end, generate the sending end public and private key information according to the target encryption information.

[0028] In some embodiments, the execution subject may generate the public and private key information of the sender according to the target encryption information in response to receiving the target encryption information confirmed by the communication receiving end. The target encryption information is the first information confirmed by the communication receiving end from the first information list after receiving the encryption confirmation request. The sender public and private key information includes the sender public key information and the sender private key information. The target encryption information may include: the first encryption information and the second encryption information. The sender public key information may include: the first sender public key and the second sender public key. The sender private key information may include: the first sender private key and the second sender private key. The first encryption information may represent the encryption algorithm corresponding to the first type of encryption algorithm type selected by the communication receiving end user. The second encryption information may represent the encryption algorithm corresponding to the second type of encryption algorithm type selected by the communication receiving end user. The first type of encryption algorithm type may be a classical encryption algorithm. The second type of encryption algorithm type may be a post-quantum encryption algorithm. Classical encryption algorithms may include, but are not limited to, symmetric encryption algorithms and asymmetric encryption algorithms. Post-quantum cryptographic algorithms may include, but are not limited to: lattice-based cryptographic algorithms, encoding-based cryptographic algorithms, multivariate-based cryptographic algorithms, hash function-based cryptographic algorithms, and curve homology-based cryptographic algorithms. The first sender public key and the first sender private key may be a pair of public-private keys generated by the execution subject using the first type of encryption algorithm represented by the first encryption information. The second sender public key and the second sender private key may be a pair of public-private keys generated by the execution subject using the second type of encryption algorithm represented by the second encryption information.

[0029] In some optional implementations of some embodiments, the execution subject may generate the sender public and private key information and the sender random number pair according to the target encryption information through the following steps:

[0030] The first step is to generate the first sender public key information and the first sender private key information according to the first encrypted information. In practice, the execution subject can generate the first sender public key information and the first sender private key information by the first type of encryption algorithm represented by the first encrypted information. For example, the first type of encryption algorithm represented by the first encrypted information is the SM2 algorithm (elliptic curve public key cryptography algorithm), and the execution subject can generate a pair of SM2 public and private keys as the first sender public key information and the first sender private key information respectively.

[0031] The second step is to generate the second sender public key information and the second sender private key information according to the second encrypted information. In practice, the execution subject can generate the second sender public key information and the second sender private key information by the second type of encryption algorithm represented by the second encrypted information. For example, the second type of encryption algorithm represented by the second encrypted information is a lattice-based post-quantum encryption algorithm (CRYSTALS-Kyber encryption algorithm), and the execution subject can generate a pair of CRYSTALS-Kyber public and private keys as the second sender public key information and the second sender private key information respectively.

[0032] The third step is to determine the first sender public key information and the second sender public key information as the sender public key information included in the sender public and private key information.

[0033] In the fourth step, the first sender private key information and the second sender private key information are determined as the sender private key information included in the sender public and private key information.

[0034] Step 103: Based on the public and private key information of the sender, the following first loop steps are executed:

[0035] Step 1031, generate a sending end random number pair.

[0036] In some embodiments, the execution subject may generate a pair of random numbers at the transmitting end. In practice, first, the execution subject may generate two random numbers with a number greater than or equal to a preset number of bits as the first transmitting end random number and the second transmitting end random number, respectively. The first transmitting end random number and the second transmitting end random number are independent of each other. Then, the execution subject may determine the first transmitting end random number and the second transmitting end random number as a pair of random numbers at the transmitting end. As an example, the preset number of bits is 256 bits.

[0037] Step 1032: Send the sender's public key information and the receiver's public key information request to the communication receiver through the public network channel.

[0038] In some embodiments, the execution subject may send the sender public key information and the receiver public key information request to the communication receiving end through a public network channel, wherein the receiver public key information request may be used to request the receiver public key information generated by the communication receiving end.

[0039] Step 1033, in response to receiving the receiving end public key information sent by the communication receiving end, the sending end random number pair is encrypted according to the receiving end public key information to obtain the sending end encrypted information.

[0040] In some embodiments, the execution subject may, in response to receiving the receiving end public key information sent by the communication receiving end, perform public key scheme encryption on the sending end random number pair according to the receiving end public key information to obtain the sending end encrypted information.

[0041] Optionally, the receiving end public key information may be generated by the communication receiving end by executing the following steps based on the target encryption information:

[0042] The first step is to generate the first receiving end public key information according to the first encryption information included in the target encryption information. In practice, the communication receiving end can generate the first receiving end public key information and the first receiving end private key information by the first type of encryption algorithm represented by the first encryption information.

[0043] The second step is to generate the second receiving end public key information according to the second encryption information included in the target encryption information. In practice, the communication receiving end can generate the second receiving end public key information and the second receiving end private key information by the second type of encryption algorithm represented by the second encryption information.

[0044] The third step is to determine the first receiving end public key information and the second receiving end public key information as the receiving end public key information. In addition, after receiving the receiving end public key information request, the communication receiving end can also generate two random numbers as the first receiving end random number and the second receiving end random number. The first receiving end random number and the second receiving end random number are independent of each other.

[0045] In some optional implementations of some embodiments, the execution subject may perform the following steps to encrypt the random number pair of the sending end according to the public key information of the receiving end, so as to obtain the encrypted information of the sending end:

[0046] In the first step, according to the public key information of the first receiving end, the first sending end random number is encrypted by a public key scheme to obtain the first sending end encrypted information. In practice, the execution subject can perform a public key scheme to encrypt the first sending end random number by a public key encryption function of the first type of encryption algorithm represented by the public key information of the first receiving end and the first encrypted information to obtain the first sending end encrypted information.

[0047] The second step is to perform a public key scheme encryption on the second sending end random number according to the second receiving end public key information to obtain the second sending end encrypted information. In practice, the above-mentioned execution subject can perform a public key scheme encryption on the second sending end random number through the second receiving end public key information and the public key encryption function of the second type of encryption algorithm represented by the above-mentioned second encrypted information to obtain the second sending end encrypted information.

[0048] In the third step, the first sending end encrypted information and the second sending end encrypted information are determined as the sending end encrypted information.

[0049] Step 1034, generating master secret information according to the sender random number pair and the sender private key information.

[0050] In some embodiments, the execution subject may generate master secret information based on the sending end random number pair and the sending end private key information. The generated master secret information corresponds to a generation time. The generated master secret information may include: first master secret information, second master secret information and third master secret information. The master secret information may be used to generate a temporary session key.

[0051] In the process of adopting technical solutions to solve the problems mentioned in the background technology, the following problems are often accompanied: the communicating parties usually use random numbers as session keys. The generated session keys are relatively simple and have a high risk of being cracked by attacks, which leads to a decrease in communication security.

[0052] In the face of the above technical problems, the inventors decided to adopt the following solutions:

[0053] In some optional implementations of some embodiments, the execution subject may generate the master secret information according to the sending end random number pair and the sending end private key information through the following steps:

[0054] The first step is to send the encrypted information of the sending end and the encrypted information request of the receiving end to the communication receiving end through the public network channel. The encrypted information request of the receiving end is used to request the encrypted information of the receiving end from the communication receiving end. The encrypted information of the receiving end includes: the first encrypted information of the receiving end and the second encrypted information of the receiving end.

[0055] In the second step, in response to receiving the encrypted receiving information sent by the above-mentioned communication receiving end, the first receiving end encrypted information included in the receiving end encrypted information is decrypted by a public key scheme according to the above-mentioned first sending end private key information to obtain a first receiving end random number. It should be noted that the above-mentioned first receiving end encrypted information is obtained by encrypting the first receiving end random number by the above-mentioned communication receiving end using the first type of encryption algorithm represented by the first sending end public key information and the first encryption information. And the encryption algorithm represented by the first encryption information agreed upon by the communication receiving end and the communication sending end is the same. Therefore, in practice, the above-mentioned execution subject can decrypt the first receiving end encrypted information included in the receiving end encrypted information by a public key scheme through the public key decryption function of the first type of encryption algorithm represented by the above-mentioned first sending end private key information and the first encryption information to obtain the first receiving end random number.

[0056] In the third step, according to the second sending end private key information, the second receiving end encrypted information included in the receiving end encrypted information is decrypted by a public key scheme to obtain a second receiving end random number. In practice, the execution subject can decrypt the second receiving end encrypted information included in the receiving end encrypted information by a public key decryption function of the second type of encryption algorithm represented by the second sending end private key information and the second encrypted information to obtain a second receiving end random number.

[0057] Step 4: Generate first master secret information based on the first sending end random number and the first receiving end random number. In practice, the execution master performs bitwise XOR processing on the first sending end random number and the first receiving end random number to generate the first master secret information.

[0058] Step 5: Generate second master secret information based on the second sending end random number and the second receiving end random number. In practice, the above execution master performs bitwise XOR processing on the second sending end random number and the second receiving end random number to generate the second master secret information.

[0059] Step 6: Generate third master secret information based on the first master secret information and the second master secret information. In practice, the execution master performs bitwise XOR processing on the first master secret information and the second master secret information to generate the third master secret information.

[0060] Optionally, the encrypted information of the receiving end is obtained by the communication receiving end according to the public key information of the sending end through the following steps:

[0061] In the first step, according to the first sender public key information included in the sender public key information, the first receiving end random number is encrypted by a public key scheme to obtain the first receiving end encrypted information. In practice, the communication receiving end can perform a public key scheme to encrypt the first receiving end random number by a public key encryption function of the first type of encryption algorithm represented by the first sender public key information and the first encrypted information to obtain the first receiving end encrypted information.

[0062] In the second step, according to the second sender public key information included in the above sender public key information, the second receiving end random number is encrypted by a public key scheme to obtain the second receiving end encrypted information. In practice, the above communication receiving end can perform a public key scheme to encrypt the second receiving end random number by a public key encryption function of the second type of encryption algorithm represented by the second sender public key information and the above second encrypted information to obtain the second receiving end encrypted information.

[0063] In the third step, the first receiving end encrypted information and the second receiving end encrypted information are determined as the receiving end encrypted information.

[0064] The above technical solution and its related contents, as an inventive point of an embodiment of the present disclosure, solve the technical problem that "the communicating parties usually use a generated random number as a session key. The generated session key is relatively simple, and the risk of attack and cracking is high, which leads to a decrease in communication security". The factors that lead to a decrease in communication security are often as follows: the communicating parties usually use a generated random number as a session key. The generated session key is relatively simple, and the risk of attack and cracking is high, which leads to a decrease in communication security. If the above factors are solved, the effect of improving the security of network communications can be achieved. In order to achieve this effect, in this application, the communication sending end and the communication receiving end exchange information through the random number pairs generated by each of them, so that each of them generates a master secret information. And a single-end session key is generated based on the master secret information and the random number. Finally, the communication sending end and the communication receiving end generate a temporary session key by exchanging the session keys generated by each of them. The session key generated by the above method has high randomness and complexity, thereby improving the security of the communication session.

[0065] Step 1035, in response to determining that the current time does not satisfy the preset time period condition corresponding to the generated time, the first loop step is executed again.

[0066] In some embodiments, the execution subject may execute the first loop step again in response to determining that the current time does not satisfy the preset time period condition corresponding to the generation time. The preset time period condition corresponding to the generation time may be that the current time is within the cycle time range corresponding to the generation time. For example, the preset time period is 7 days. The generation time may be "2024-10-12-08:00", and the cycle time range corresponding to the generation time may be "2024-10-12-08:00" to "2024-10-19-08:00".

[0067] Step 1036, in response to determining that the current time satisfies the periodic time bar corresponding to the generation time, based on the master secret information, the following second loop steps are performed:

[0068] Step 10361, determine the temporary session key and the validity period of the temporary session based on the master secret information.

[0069] In some embodiments, the execution subject may determine the temporary session key and the temporary session validity period based on the master secret information. The temporary session key is a temporary key for encrypting communication information. The temporary session validity period may be the validity period of the current communication session. The maximum value of the temporary session validity period may be 64 (minutes).

[0070] In the process of adopting technical solutions to solve the problems mentioned in the background technology, the following problems are often accompanied: when multiple communications are carried out in a public network, there is a risk of leakage when using fixed session keys, which leads to a decrease in communication security and privacy.

[0071] In the face of the above technical problems, the inventors decided to adopt the following solutions:

[0072] In some optional implementations of some embodiments, the execution subject may determine the temporary session key and the temporary session validity period according to the master secret information through the following steps:

[0073] The first step is to determine the target master secret information based on the master secret information. In practice, the execution subject can randomly select a master secret information from the first master secret information, the second master secret information and the third master secret information included in the master secret information to determine it as the target master secret information. It should be noted that the first master secret information, the second master secret information and the third master secret information each correspond to prefix information with a preset number of digits to distinguish the three. The preset number of digits of the prefix information corresponding to the master secret information agreed upon by the communicating parties is the same. For example, the preset number of digits can be 2. The prefix information corresponding to the first master secret information can be 00. The prefix information corresponding to the second master secret information can be 01. The prefix information corresponding to the third master secret information can be 11.

[0074] The second step is to generate a sender session key. In practice, the execution subject may generate a random number with a bit number greater than or equal to the preset bit number as the sender session key.

[0075] The third step is to concatenate the sender session key and the sender session valid duration to obtain the concatenated sender session key. In practice, the above-mentioned execution entity can concatenate the binary string corresponding to the sender session valid duration to the end of the sender session key to obtain the concatenated sender session key. It should be noted that the above-mentioned sender session valid duration can be a user-defined setting of the communication sender. The binary string corresponding to the above-mentioned sender session valid duration has a fixed number of bits. If the number of bits is not enough, 0 can be filled in the head of the binary string. As an example, the fixed number of bits can be 6 bits.

[0076] The fourth step is to symmetrically encrypt the concatenated sender session key according to the target master secret information to obtain the encrypted session key. In practice, the above execution subject can use the target master secret information as a symmetric key to symmetrically encrypt the concatenated sender session key (for example, SymEnc() symmetric encryption function) to obtain the encrypted session key.

[0077] The fifth step is to concatenate the encrypted session key according to the prefix information corresponding to the target master secret to obtain the sender's target session key. In practice, the above execution entity can concatenate the prefix information corresponding to the target master secret to the head of the encrypted session key to obtain the sender's target session key.

[0078] Step 6: Send the sender target session key and the receiver target session key request to the communication receiving end through the public network channel. The receiver target session key request is used to request the receiver target session key from the communication receiving end.

[0079] Step 7. In response to receiving the receiving end target session key sent by the above communication receiving end, the receiving end target session key is decrypted to obtain the decrypted session key information, wherein the decrypted session key information includes: the receiving end session key and the receiving end session validity period, and the receiving end target session key is the key generated by the above communication receiving end based on the encrypted information of the sending end. The generation steps of the above receiving end target session key can refer to the implementation steps of the sender target session secret key, the implementation steps of the two are symmetrical and the symmetric encryption function used is the same (for example, the above communication receiving end can use the receiving end private key information to decrypt the encrypted information of the sending end to obtain the first sending end random number and the second sending end random number. Then, the main secret information of the receiving end is generated based on the first sending end random number, the second sending end random number and the receiving end random number. Finally, the receiving end target session key is generated based on the main secret information of the receiving end). In practice, first, the above execution subject can delete the bits of the preset number of bits in the header of the receiving end target session key. Then, a symmetric decryption function (e.g., SymDec() symmetric decryption function) can be used to decrypt the deleted receiving end target session key to obtain the decrypted receiving end session key. In addition, since the number of bits of the binary strings corresponding to the effective session durations of the communication receiving end and the communication sending end is the same and the concatenation method is the same, the receiving end session key and the receiving end session effective duration can be directly determined by the decrypted receiving end session key.

[0080] Step 8: Determine a temporary session key based on the receiving end session key and the sending end session key. In practice, the execution master determines the result of bitwise XOR processing of the receiving end session key and the sending end session key as the temporary session key.

[0081] The ninth step is to determine the temporary session validity period according to the receiving end session validity period and the sending end session validity period. In practice, the above execution subject can determine the minimum value of the receiving end session validity period and the sending end session validity period as the temporary session validity period.

[0082] The above technical solution and its related contents, as an inventive point of an embodiment of the present disclosure, solve the technical problem that "when multiple communications are carried out in a public network, the use of fixed session keys has the risk of leakage, resulting in reduced communication security and privacy". The factors that lead to reduced communication security and privacy are often as follows: only a set of fixed session keys are agreed upon with the communication object, and during the public network communication process, the session keys are at risk of leakage, resulting in the risk of cracking the communication information encrypted by the session keys during the communication process. If the above factors are solved, the effect of improving the security and privacy of network communications can be achieved. In order to achieve this effect, in the present application, the communication sending end and the communication receiving end exchange information through the random number pairs generated by each of them, so that each of them generates a master secret information. And a single-end session key is generated based on the master secret information and the random number. Finally, the communication sending end and the communication receiving end generate a temporary session key by exchanging the session keys generated by each of them. By adopting the above method, a temporary session key will be generated by both parties during each communication in the public network, so that the encryption key used in each communication is different. Even when a temporary session key expires or there is a risk of leakage, attackers cannot crack the communication information encrypted by other temporary session keys, thereby improving the security and privacy of public network communication sessions.

[0083] Step 10362, in response to determining that the current communication duration is less than or equal to the validity duration of the temporary session key, encrypt the communication information according to the temporary session key.

[0084] In some embodiments, the above-mentioned execution subject may encrypt the communication information according to the temporary session key in response to determining that the current communication duration is less than or equal to the validity duration of the temporary session key. In practice, the above-mentioned execution subject may use the temporary session key as a symmetric encryption key to symmetrically encrypt the communication information. For example, the symmetric encryption algorithm used may be the AES algorithm. It should be noted that the implementation steps of generating a temporary session key at the communication receiving end may refer to the steps of generating a temporary session key at the communication sending end, which will not be repeated here.

[0085] Step 10363, in response to determining that the current communication duration is greater than the validity period of the temporary session key, the second loop step is executed again.

[0086] In some embodiments, the execution subject may execute the second loop step again in response to determining that the current communication duration is greater than the validity duration of the temporary session key.

[0087] It should be noted that the communication process between the communication receiving end and the communication sending end is as follows: Figure 4 As shown by Figure 4 It can be seen that the relevant encryption processing steps performed by the communication receiving end and the communication sending end are symmetrical. In addition, Figure 4 There is no specific limitation on the actual communication order between the two ends of the communication. For example, when the communication receiving end generates the receiving end public and private key information first, the receiving end public key information can be sent to the communication sending end first. For another example, when the communication receiving end completes the encryption processing of the receiving end random number pair first, the encrypted information of the receiving end can be sent to the communication sending end first.

[0088] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: through the quantum-resistant secure communication method applied to the public network channel of some embodiments of the present disclosure, the storage resource overhead of both parties of the communication can be reduced while resisting quantum attacks, and the security of communication encryption can be further improved. Specifically, the reason for the increase in storage overhead of both parties of the communication and the reduction in encryption security is that in actual network communication, each communication end often has multiple communication objects, so each communication end needs to agree with multiple communication objects and store mutually independent shared keys, and record the corresponding relationship of multiple shared secret keys, which leads to an increase in the storage overhead of the communication sending end. In addition, there is also a risk of leakage of the shared key in the process of the two parties of the communication agreeing on the shared key (for example, face-to-face or email), which leads to a reduction in the security of communication encryption. Based on this, the quantum-resistant secure communication method applied to the public network channel of some embodiments of the present disclosure, first, through the public network channel, sends user authentication information and encryption determination request to the communication receiving end. Among them, the above-mentioned user authentication information includes: the identity information of the sending end and the first information list. The first information in the above-mentioned first information list represents the description of the encryption algorithm used for information encryption. Thus, when initiating network communication, the communication sending end can send user authentication information and encryption confirmation request to the communication receiving end, so that the communication receiving end can perform identity authentication and agree on the encryption algorithm used for subsequent communication encryption. Then, in response to receiving the target encryption information confirmed by the above-mentioned communication receiving end, the sending end public and private key information is generated according to the above-mentioned target encryption information. Among them, the above-mentioned target encryption information is the first information confirmed by the above-mentioned communication receiving end from the first information list after receiving the above-mentioned encryption confirmation request. The above-mentioned sending end public and private key information includes the sending end public key information and the sending end private key information. Thus, when the communication sending end receives the encryption algorithm selected by the communication receiving end, two pairs of public and private keys for encryption can be generated. Finally, based on the above-mentioned sending end public and private key information, the following first loop step is performed: the first step is to generate a sending end random number pair. Thus, randomness can be added to the encryption of communication information by generating random numbers, thereby improving the security of communication encryption. The second step is to send the above-mentioned sending end public key information and the receiving end public key information request to the above-mentioned communication receiving end through a public network channel. The third step is to, in response to receiving the public key information of the receiving end sent by the above-mentioned communication receiving end, encrypt the random number pair of the sending end according to the public key information of the receiving end, and obtain the encrypted information of the sending end. In this way, the two communicating parties can exchange public keys and encrypt their respective random numbers with each other's public keys to obtain the encrypted information of the sending end and the encrypted information of the receiving end. The fourth step is to generate the master secret information according to the random number pair of the sending end and the above-mentioned private key information of the sending end. Among them, the generated master secret information corresponds to the generation time. In this way, the master secret information with timeliness and used to generate the communication encryption key can be generated through the interaction of random encrypted information between the communication sending end and the communication receiving end.In the fifth step, in response to determining that the current time does not meet the preset time period condition corresponding to the generation time, the first loop step is executed again. Thus, the timeliness of the generated master key information can be determined, and the master secret information is regenerated when it expires. In the sixth step, in response to determining that the current time meets the periodic time bar corresponding to the generation time, based on the master secret information, the following second loop step is executed: the first sub-step, according to the master secret information, the temporary session key and the temporary session validity period are determined. Thus, through the generated master secret information, the temporary session key and the effective period of the communication session with high complexity, randomness and timeliness can be finally determined. The second sub-step, in response to determining that the current communication duration is less than or equal to the effective period of the temporary session key, the communication information is encrypted according to the temporary session key. Thus, the communication information can be encrypted using the temporary session key, which greatly improves the security of communication encryption. The third sub-step, in response to determining that the current communication duration is greater than the effective period of the temporary session key, the second loop step is executed again. This is because the communicating parties will only select a random encryption algorithm when initiating network communication, and exchange random encrypted information through the selected encryption algorithm, and finally generate a temporary session key with extremely high complexity and randomness. Even when a temporary session key expires or there is a risk of leakage, attackers cannot crack the communication information encrypted by other temporary session keys, further improving the security of the communication session. At the end of the communication session, neither party needs to store the expired temporary session key. Since the encryption algorithm selected by the two ends of the communication includes the post-quantum cryptographic algorithm type, it can reduce the storage resource overhead of the two parties on the basis of resisting quantum attacks, and improve the security of communication encryption.

[0089] Further references Figure 2 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a quantum-resistant secure communication device applied to a public network channel. These device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the quantum-resistant secure communication device applied to a public network channel can be specifically applied to various electronic devices.

[0090] like Figure 2As shown, some embodiments of the quantum-resistant secure communication device 200 applied to a public network channel include: a sending unit 201 is configured to send user authentication information and an encryption confirmation request to a communication receiving end through a public network channel, wherein the user authentication information includes: sender identity information and a first information list, and the first information in the first information list represents a description of an encryption algorithm used to encrypt information; a generating unit 202 is configured to generate sender public and private key information in response to receiving target encryption information confirmed by the communication receiving end, according to the target encryption information, wherein the target encryption information is the first information confirmed by the communication receiving end from the first information list after receiving the encryption confirmation request, and the sender public and private key information includes sender public key information and sender private key information; an executing unit 203 is configured to generate a sender random number pair; and send the sender public key to the communication receiving end through the public network channel. information and a request for the public key information of the receiving end; in response to receiving the public key information of the receiving end sent by the above-mentioned communication receiving end, according to the above-mentioned public key information of the receiving end, the public key scheme is used to encrypt the random number pair of the sending end to obtain the encrypted information of the sending end; according to the random number pair of the sending end and the above-mentioned private key information of the sending end, the master secret information is generated, wherein the generated master secret information corresponds to the generation time; in response to determining that the current time does not meet the preset time period condition corresponding to the generation time, the above-mentioned first loop step is executed again; in response to determining that the current time meets the period time bar corresponding to the generation time, based on the master secret information, the following second loop step is executed: according to the master secret information, a temporary session key and a temporary session validity period are determined; in response to determining that the current communication duration is less than or equal to the validity period of the temporary session key, the communication information is encrypted according to the temporary session key; in response to determining that the current communication duration is greater than the validity period of the temporary session key, the above-mentioned second loop step is executed again.

[0091] It can be understood that the units described in the quantum-resistant secure communication device 200 for use in a public network channel are similar to those described in the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the quantum-resistant secure communication device 200 applied to the public network channel and the units contained therein, and will not be repeated here.

[0092] Reference below Figure 3 , which shows a structural schematic diagram of an electronic device 300 suitable for implementing some embodiments of the present disclosure. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0093] like Figure 3As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory 302 or a program loaded from a storage device 308 into a random access memory 303. Various programs and data required for the operation of the electronic device 300 are also stored in the random access memory 303. The processing device 301, the read-only memory 302, and the random access memory 303 are connected to each other via a bus 304. An input / output interface 305 is also connected to the bus 304.

[0094] Typically, the following devices may be connected to the I / O interface 305: input devices 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 309. The communication devices 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0095] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the read-only memory 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.

[0096] It should be noted that the computer-readable medium recorded in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In some embodiments of the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0097] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (Hyper Text Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0098] The above-mentioned computer-readable medium may be included in the above-mentioned electronic device; or it may exist independently without being assembled into the electronic device. The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: sends user authentication information and an encryption confirmation request to the communication receiving end through a public network channel, wherein the above-mentioned user authentication information includes: the identity information of the sending end and a first information list, and the first information in the above-mentioned first information list represents the description of the encryption algorithm used for information encryption; in response to receiving the target encryption information confirmed by the above-mentioned communication receiving end, generates the sending end public and private key information according to the above-mentioned target encryption information, wherein the above-mentioned target encryption information is the first information confirmed by the above-mentioned communication receiving end from the first information list after receiving the above-mentioned encryption confirmation request, and the above-mentioned sending end public and private key information includes the sending end public key information and the sending end private key information; based on the above-mentioned sending end public and private key information, executes the following first loop steps: generates a sending end random number pair; sends the above-mentioned to the above-mentioned communication receiving end through the above-mentioned public network channel. The present invention provides a method for transmitting the public key information of the transmitting end and the public key information of the receiving end; in response to receiving the public key information of the receiving end sent by the above-mentioned communication receiving end, according to the above-mentioned public key information of the receiving end, encrypting the random number pair of the transmitting end by the public key scheme to obtain the encrypted information of the transmitting end; generating the master secret information according to the random number pair of the transmitting end and the above-mentioned private key information of the transmitting end, wherein the above-mentioned master secret information corresponds to the generation time; in response to determining that the current time does not meet the preset time period condition corresponding to the generation time, executing the above-mentioned first loop step again; in response to determining that the current time meets the period time bar corresponding to the generation time, based on the master secret information, executing the following second loop step: determining the temporary session key and the temporary session validity period according to the master secret information; in response to determining that the current communication duration is less than or equal to the temporary session key validity period, encrypting the communication information according to the temporary session key; in response to determining that the current communication duration is greater than the temporary session key validity period, executing the above-mentioned second loop step again.

[0099] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0100] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0101] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The units described may also be provided in a processor, for example, may be described as: a processor including a sending unit, a generating unit, and an executing unit. The names of these units do not, in some cases, constitute limitations on the units themselves, for example, the sending unit may also be described as "a unit that sends user authentication information and an encryption confirmation request to a communication receiving end through a public network channel".

[0102] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0103] The above descriptions are only some preferred embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) and the technical solutions formed.

Claims

1. A quantum-resistant secure communication method applied to a public network channel, comprising: Sending user authentication information and an encryption confirmation request to a communication receiving end through a public network channel, wherein the user authentication information includes: identity information of the sending end and a first information list, wherein the first information in the first information list represents a description of an encryption algorithm used for information encryption; In response to receiving the target encryption information confirmed by the communication receiving end, generating the sending end public and private key information according to the target encryption information, wherein the target encryption information is the first information confirmed by the communication receiving end from the first information list after receiving the encryption confirmation request, and the sending end public and private key information includes the sending end public key information and the sending end private key information; Based on the public and private key information of the sender, the following first loop steps are performed: Generate a pair of random numbers for the sender; Sending the sending end public key information and the receiving end public key information request to the communication receiving end through a public network channel; In response to receiving the receiving end public key information sent by the communication receiving end, encrypting the sending end random number pair according to the receiving end public key information to obtain the sending end encrypted information; Generate master secret information according to the sending end random number pair and the sending end private key information, wherein the generated master secret information corresponds to a generation time; In response to determining that the current time does not satisfy the preset time period condition corresponding to the generated time, executing the first loop step again; In response to determining that the current time satisfies the periodic time bar corresponding to the generation time, based on the master secret information, the following second loop steps are performed: Determine the temporary session key and the validity period of the temporary session according to the master secret information; In response to determining that the current communication duration is less than or equal to the validity duration of the temporary session key, encrypting the communication information according to the temporary session key; In response to determining that the current communication duration is greater than the validity duration of the temporary session key, the second loop step is performed again.

2. The method according to claim 1, wherein: The target encryption information includes: first encryption information and second encryption information, the sender public key information includes: first sender public key and second sender public key, the sender private key information includes: first sender private key and second sender private key; and the generating of the sender public and private key information and the sender random number pair according to the target encryption information includes: Generate first sending end public key information and first sending end private key information according to the first encrypted information; Generate second sending end public key information and second sending end private key information according to the second encrypted information; Determine the first sender public key information and the second sender public key information as the sender public key information included in the sender public-private key information; The first sender private key information and the second sender private key information are determined as the sender private key information included in the sender public and private key information.

3. The method according to claim 1, wherein: The generating of the sending end random number pair comprises: Generate two random numbers as a first sending end random number and a second sending end random number, respectively, wherein the first sending end random number and the second sending end random number are independent of each other; The first sending end random number and the second sending end random number are determined as a sending end random number pair.

4. The method according to claim 3, wherein: The receiving end public key information is generated by the communication receiving end based on the target encryption information by executing the following steps: Generate first receiving end public key information according to the first encryption information included in the target encryption information; Generate second receiving end public key information according to the second encryption information included in the target encryption information; The first receiving end public key information and the second receiving end public key information are determined as the receiving end public key information.

5. The method according to claim 4, wherein: The step of encrypting the random number pair of the sending end by a public key scheme according to the public key information of the receiving end to obtain the encrypted information of the sending end includes: According to the first receiving end public key information, encrypt the first sending end random number with a public key scheme to obtain the first sending end encrypted information; According to the public key information of the second receiving end, encrypt the random number of the second sending end using a public key scheme to obtain the encrypted information of the second sending end; The first sending end encrypted information and the second sending end encrypted information are determined as the sending end encrypted information.

6. A quantum-resistant secure communication device applied to a public network channel, comprising: A sending unit is configured to send user authentication information and an encryption confirmation request to a communication receiving end through a public network channel, wherein the user authentication information includes: identity information of the sending end and a first information list, and the first information in the first information list represents a description of an encryption algorithm used for information encryption; a generating unit, configured to generate, in response to receiving the target encryption information confirmed by the communication receiving end, the sending end public-private key information according to the target encryption information, wherein the target encryption information is the first information confirmed by the communication receiving end from the first information list after receiving the encryption confirmation request, and the sending end public-private key information includes the sending end public key information and the sending end private key information; The execution unit is configured to generate a random number pair for a sender; send the sender public key information and the receiver public key information request to the communication receiving end through the public network channel; in response to receiving the receiver public key information sent by the communication receiving end, perform a public key scheme to encrypt the sender random number pair according to the receiver public key information to obtain the encrypted information of the sender; generate master secret information according to the sender random number pair and the sender private key information, wherein the generated master secret information corresponds to a generation time; in response to determining that the current time does not meet the preset time period condition corresponding to the generation time, execute the first loop step again; in response to determining that the current time meets the period time bar corresponding to the generation time, execute the following second loop step based on the master secret information: determine a temporary session key and a temporary session validity period according to the master secret information; in response to determining that the current communication duration is less than or equal to the temporary session key validity period, encrypt the communication information according to the temporary session key; in response to determining that the current communication duration is greater than the temporary session key validity period, execute the second loop step again.

7. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 5.

8. A computer readable medium having a computer program stored thereon, wherein: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images