Single packet authentication method, electronic equipment and storage medium

Abstract

The invention provides a single packet authentication method, electronic equipment and a storage medium, and the method comprises the steps that an SDP client encrypts to-be-verified service request information by adopting a single packet encryption key pre-distributed by an SPA key distribution center to obtain a service request ciphertext, the service request information is used for requesting to access a target service resource through an SDP gateway, and the service request ciphertext is sent to the SPA key distribution center; the method comprises the following steps: performing HMAC operation on user information and a service request ciphertext corresponding to an SDP client by adopting a single-packet authentication key pre-distributed by an SPA key distribution center to obtain a to-be-verified message authentication code, generating a single-packet authentication knocking message according to the user information, the service request ciphertext and the to-be-verified message authentication code, and sending the single-packet authentication knocking message to an SDP controller. According to the application, the pre-distributed single-packet encryption key and the single-packet authentication key are used for single-packet authentication, and the user does not need to keep the key by himself, so that the problems that the key is easy to leak and the user operation is complicated are solved, and the usability is high.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a single-packet authentication method, an electronic device, and a storage medium. Background Art

[0002] Single Packet Authorization (SPA) is a lightweight security protocol that uses only a single data packet for access requests. It simplifies the knocking process by integrating all necessary information into a single data packet. Before allowing access to the network, it verifies the identity of the device and user, thereby achieving "network invisibility" and preventing attackers from finding service addresses and ports.

[0003] Currently, in the SPA knocking authentication process, one method is to directly pre-set the SPA key in the device, and the other method is to receive the SPA key through SMS, email, etc. and inject it into the client.

[0004] However, once the preset SPA key is cracked or copied, it may be necessary to manually replace the key, which increases the difficulty and cost of system maintenance. The received SPA key injected into the client may face the risk of attack, and the user needs to manually extract the key, which has certain operational complexity. Summary of the invention

[0005] In view of this, the embodiments of the present application provide a single-packet authentication method, an electronic device, and a storage medium to solve the problems of easy key leakage and complex user operations.

[0006] In a first aspect, an embodiment of the present application provides a single-packet authentication method, which is applied to an SDP client, and the method includes:

[0007] Using a single-package encryption key pre-distributed by the SPA key distribution center, the service request information to be verified is encrypted to obtain a service request ciphertext, wherein the service request information is used to request access to a target service resource through an SDP gateway;

[0008] Using the single-package authentication key pre-distributed by the SPA key distribution center, perform HMAC operation on the user information corresponding to the SDP client and the service request ciphertext to obtain a message authentication code to be verified;

[0009] Generate a single-package authentication knock message according to the user information, the service request ciphertext and the message authentication code to be verified;

[0010] The single-packet authentication knock message is sent to the SDP controller, so that the SDP controller extracts the user information, the service request ciphertext and the message authentication code to be verified from the single-packet authentication knock message, and obtains the single-packet encryption key and the single-packet authentication key from the SPA key distribution center according to the user information, and uses the obtained single-packet authentication key and the message authentication code to be verified to verify the information validity of the single-packet authentication knock message. If the verification passes, the obtained single-packet encryption key is used to decrypt the service request ciphertext to obtain the service request information, and based on the service request information, obtain access rights to the target business resources.

[0011] In an optional implementation, the single-packet authentication key pre-distributed by the SPA key distribution center is used to perform an HMAC operation on the user information corresponding to the SDP client and the service request ciphertext to obtain a message authentication code to be verified, including:

[0012] Using the single-packet authentication key, perform an HMAC operation on the user information, the service request ciphertext, a preset random number, and a current timestamp to obtain the message authentication code to be verified;

[0013] The generating a single-package authentication knock message according to the user information, the service request ciphertext, and the message authentication code to be verified includes:

[0014] The single-packet authentication knock message is generated according to the user information, the service request ciphertext, the summary of the service request ciphertext, the preset random number, the current timestamp and the message authentication code to be verified, so that the SDP controller extracts the user information, the service request ciphertext, the summary of the service request ciphertext, the preset random number, the current timestamp and the message authentication code to be verified from the single-packet authentication knock message, and performs time validity verification on the single-packet authentication knock message according to the current timestamp and information validity verification on the service request ciphertext according to the summary of the service request ciphertext. If both verifications are passed, the single-packet encryption key and the single-packet authentication key are obtained from the SPA key distribution center according to the user information.

[0015] In an optional implementation, before the single-packet authentication key pre-distributed by the SPA key distribution center is used to perform an HMAC operation on the user information corresponding to the SDP client and the service request ciphertext to obtain the message authentication code to be verified, the method further includes:

[0016] The user information is extracted from the post-quantum signature certificate of the SDP client.

[0017] In an optional embodiment, the method further comprises:

[0018] Using the post-quantum signature private key of the SDP client, the post-quantum signature certificate and the post-quantum encryption public key of the SDP client are signed to obtain a target signature value;

[0019] Generate a single-package key distribution request according to the post-quantum signature certificate, the post-quantum encryption public key and the target signature value;

[0020] Sending the single-package key distribution request to the SPA key distribution center;

[0021] Receive the single-packet encryption key and the single-packet authentication key sent by the SPA key distribution center.

[0022] In an optional implementation, the receiving the single-package encryption key and the single-package authentication key sent by the SPA key distribution center includes:

[0023] Receive the single-package authentication key ciphertext distributed by the SPA key distribution center, where the single-package authentication key ciphertext is obtained by the SPA key distribution center verifying the information validity of the target signature value according to the post-quantum signature certificate and the post-quantum encryption public key, and performing root verification on the post-quantum signature certificate. If the verifications are all passed, the single-package encryption key and the single-package authentication key are generated, a shared key is generated according to the post-quantum encryption public key, and the single-package encryption key and the single-package authentication key are encrypted using the shared key;

[0024] The shared key is generated according to the post-quantum encryption private key of the SDP client, and the generated shared key is used to decrypt the single-packet authentication key ciphertext to obtain the single-packet encryption key and the single-packet authentication key.

[0025] In a second aspect, an embodiment of the present application further provides a single packet authentication method, which is applied to an SDP controller, and the method includes:

[0026] Receive a single-package authentication knock message sent by an SDP client, wherein the single-package authentication knock message includes: user information corresponding to the SDP client, a service request ciphertext, and a message authentication code to be verified, wherein the service request ciphertext is obtained by the SDP client using a single-package encryption key pre-distributed by a SPA key distribution center to encrypt the service request information of the SDP client, the message authentication code to be verified is obtained by the SDP client performing an HMAC operation on the user information and the service request ciphertext, and the service request information is used to request access to target service resources through an SDP gateway;

[0027] Sending a key acquisition request for the user information to the SPA key distribution center;

[0028] Receiving a single-packet encryption key and a single-packet authentication key sent by the SPA key distribution center;

[0029] Verifying the validity of the single-package authentication knock message according to the received single-package authentication key and the message authentication code to be verified;

[0030] If the verification is successful, the received single-packet encryption key is used to decrypt the service request ciphertext to obtain the service request information, and obtain the access rights to the target business resource;

[0031] If the access permission of the target service resource is to allow access, an authorized access policy is issued to the SDP gateway so that the SDP client can access the target service resource through the SDP gateway.

[0032] In an optional implementation, the single-packet authentication knock message further includes: a preset random number and a current timestamp, and the sending of a key acquisition request for the user information to the SPA key distribution center includes:

[0033] Performing time validity verification on the single-packet authentication knock message according to the current timestamp;

[0034] If the verification is successful, the key acquisition request is sent to the SPA key distribution center.

[0035] In an optional implementation, the verifying the validity of the single-packet authentication knock message according to the received single-packet authentication key and the message authentication code to be verified includes:

[0036] According to the received single-packet authentication key, perform an HMAC operation on the user information, the service request ciphertext, the preset random number and the current timestamp to obtain a target message authentication code;

[0037] The single-package authentication knock message is verified for information validity according to the target message authentication code and the message authentication code to be verified.

[0038] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the memory through the bus, and the processor executes the machine-readable instructions to execute any one of the methods described in the first aspect or any one of the second aspect.

[0039] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method described in any one of the first aspect or any one of the second aspect is executed.

[0040] The present application provides a single-package authentication method, electronic device and storage medium, the method comprising: the SDP client uses the single-package encryption key pre-distributed by the SPA key distribution center to encrypt the service request information to be verified, and obtain the service request ciphertext, wherein the service request information is used to request access to the target business resource through the SDP gateway, and uses the single-package authentication key pre-distributed by the SPA key distribution center to perform HMAC operation on the user information and service request ciphertext corresponding to the SDP client to obtain the message authentication code to be verified, and generates a single-package authentication knock message according to the user information, the service request ciphertext and the message authentication code to be verified, and sends the single-package authentication knock message to the SDP controller. The present application uses the pre-distributed single-package encryption key and the single-package authentication key for single-package authentication, and the user does not need to keep the key by himself, which solves the problem of easy leakage of the key and complex user operation, and is easy to use. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 A schematic diagram of the architecture of a single-packet authentication system provided in an embodiment of the present application;

[0043] Figure 2 Schematic diagram of the process of the single packet authentication method provided in the embodiment of the present application Figure 1 ;

[0044] Figure 3 Schematic diagram of the process of the single packet authentication method provided in the embodiment of the present application Figure 2 ;

[0045] Figure 4 Schematic diagram of the process of the single packet authentication method provided in the embodiment of the present application Figure 3 ;

[0046] Figure 5 Schematic diagram of the process of the single packet authentication method provided in the embodiment of the present application Figure 4 ;

[0047] Figure 6 A schematic diagram of the structure of a single packet authentication device provided in an embodiment of the present application Figure 1 ;

[0048] Figure 7 A schematic diagram of the structure of a single packet authentication device provided in an embodiment of the present application Figure 2 ;

[0049] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0051] First, the professional terms involved in this application are explained:

[0052] Single Packet Authorization (SPA): A lightweight security protocol that uses only a single data packet for access requests. It simplifies the knocking process by integrating all necessary information into a single data packet. Before allowing access to the network, it verifies the identity of the device and user, thereby achieving "network invisibility" and preventing attackers from finding service addresses and ports.

[0053] Signature: The sender uses a hash algorithm to perform a hash operation on the message to obtain a message digest, and then uses its own private key to encrypt the message digest to form a digital signature.

[0054] Signature verification: The receiver uses the sender's public key to decrypt the digital signature and obtain a message digest. Then the original message is hashed using the same hash algorithm to obtain a new message digest. Finally, the two message digests are compared. If they are the same, it means that the message has not been tampered with.

[0055] Root certificate verification: Use the public key of the root certificate to verify the signature of the issuer of other certificates.

[0056] Shared key: A secret key shared between two communicating parties, usually used for symmetric encryption and other security protocols. The steps for generating a shared key using the Post Quantum Cryptography (PQC) encryption public key are as follows:

[0057] 1. Key Generation

[0058] First, the two parties involved in the communication (for example, Alice and Bob) generate a public key and a private key. PQC algorithms (such as lattice-based encryption or hash-based encryption) use specific mathematical structures to generate key pairs.

[0059] 2. Public Key Exchange

[0060] Alice sends her public key to Bob.

[0061] 3. Shared key generation

[0062] Bob uses Alice's public key to generate a shared secret key using a specific mathematical structure.

[0063] Alice has her own public key, and generates a shared key that is consistent with Bob through a specific mathematical structure.

[0064] HMAC: The full name is Hash-based Message Authentication Code, which is a method of message authentication based on hash functions and keys.

[0065] With the acceleration of digital transformation of enterprises, traditional perimeter-based network security protection methods are indeed facing increasing challenges and are difficult to effectively deal with potential security threats brought by various emerging technologies and innovative businesses. In this context, Single Packet Authorization (SPA), as a key component of the new generation of network security technology architecture of Software Defined Perimeter (SDP), provides enterprises with a more powerful and flexible security protection solution.

[0066] In the SPA knock authentication process, the secure distribution of SPA keys is crucial. Key leakage or improper management may bring security risks. At present, various manufacturers have various implementation methods, which can be simply summarized as follows, but all of them have more or less security or usability issues:

[0067] One method is to directly pre-set the SPA key in the client device when it leaves the factory or is installed. This method saves the complicated distribution process, but does not implement one-person-one-code. Once cracked or copied, it involves the security of all users and devices in the system. The system administrator may need to take cumbersome manual measures to replace the key, which undoubtedly increases the difficulty and cost of system maintenance.

[0068] The other method is that users receive the SPA key through SMS, email, etc. and inject it into the client. Although it may be more convenient in some scenarios, it may face multiple risks such as man-in-the-middle attacks, phishing attacks, or malware theft. Users need to manually extract the key from SMS or email, which has certain operational complexity and may cause errors.

[0069] Based on this, this application uses a method of automatically distributing SPA keys. Users do not need to keep SPA seeds or keys by themselves, which solves the problem of easy leakage of SPA keys and complex user operations caused by traditional pre-setting, SMS, and emails that require manual operation and storage. It is more convenient for users to use and has a certain degree of ease of use. At the same time, it simplifies the user's operation process and improves the overall security and flexibility of the system.

[0070] Figure 1 The schematic diagram of the architecture of the single-packet authentication system provided in the embodiment of the present application is as follows: Figure 1 As shown, the system includes: a SPA key distribution center, an SDP client, an SDP controller, and an SDP gateway.

[0071] Among them, the SPA key distribution center is configured with the PQC root certificate issued by a third-party certificate authority (CA), which implements SPA key distribution based on post-quantum cryptography for SDP clients logging in for the first time, and distributes client SPA keys to the SDP controller during SPA knock authentication.

[0072] The SDP client has a post-quantum key and certificate issued by a third-party CA and stored in a preset secure storage medium. USBKey can be used as a secure storage medium on a personal computer, and a secure SIM card can be used as a secure storage medium on a mobile phone. When the SDP client logs in to the storage medium for the first time, the SPA key distribution method based on post-quantum cryptography is implemented, and a single packet authentication is initiated to the SDP controller.

[0073] It should be noted that post-quantum keys include post-quantum signature keys and post-quantum encryption keys. The PQC signature algorithm can select Dilithium, FALCON and SPHINCS+ signature algorithms, and the PQC encryption algorithm can select Kyber algorithm.

[0074] The SDP controller obtains the client's SPA key through the SPA key distribution center, authenticates the client's single-packet authentication knock message (SPA knock authentication message), and sends the authorization access policy of the successfully authenticated user to the SDP gateway.

[0075] The SDP gateway uses a firewall to block all unauthenticated access requests and hides its own services. It only allows the SDP client to access the target business resources through the SDP gateway after the SDP client's authorized access policy is issued under the control of the SDP packet authentication. Unsuccessful requests are discarded by default without being processed.

[0076] Based on the above single-package authentication method, the single-package authentication method provided by this application is described below.

[0077] Figure 2 Schematic diagram of the process of the single packet authentication method provided in the embodiment of the present application Figure 1 ,like Figure 2 As shown, the method may include:

[0078] S101. The SDP client uses the single-packet encryption key pre-distributed by the SPA key distribution center to encrypt the service request information to be verified, and obtains the service request ciphertext.

[0079] The single-packet encryption key is the SPA encryption key, which is pre-distributed to the SDP client by the SPA key distribution center.

[0080] The SDP client uses a single-packet encryption key to encrypt the service request information to be verified to obtain a service request ciphertext, wherein the service request information is used to request access to target service resources through the SDP gateway.

[0081] S102, the SDP client uses the single-packet authentication key pre-distributed by the SPA key distribution center to perform HMAC operation on the user information and service request ciphertext corresponding to the SDP client to obtain the message authentication code to be verified.

[0082] Among them, the single-packet authentication key is the SPA encryption key, and the single-packet authentication key is pre-distributed to the SDP client by the SPA key distribution center. The user information corresponding to the SDP client is the information of the user who logs in to the SDP client, for example, it may include the user name.

[0083] In an optional implementation, in the above step S102, the SDP client uses the single-package authentication key pre-distributed by the SPA key distribution center to perform HMAC operation on the user information and service request ciphertext and ciphertext digest corresponding to the SDP client to obtain the message authentication code to be verified. The method may also include:

[0084] Extract user information from the SDP client's post-quantum signed certificate.

[0085] Among them, the post-quantum cryptography (PQC) cryptographic signature certificate of the SDP client is the signature certificate corresponding to the post-quantum algorithm, which is granted and issued to the client by the CA organization. When the SDP client logs in to the preset secure storage medium for the first time, it can read the post-quantum signature certificate from the preset secure storage medium.

[0086] The post-quantum signature certificate of the SDP client includes information about the user who logged into the SDP client, so the user information can be extracted from the post-quantum signature certificate.

[0087] The SDP client uses a single-packet authentication key to perform HMAC operations on the user information and service request ciphertext corresponding to the SDP client to obtain the message authentication code to be verified.

[0088] S103. The SDP client generates a single-package authentication knock message according to the user information, the service request ciphertext and the message authentication code to be verified.

[0089] The SDP client generates a single-package authentication knock message according to the user information, the service request ciphertext and the message authentication code to be verified, wherein the single-package authentication knock message includes: user information, the service request ciphertext and the message authentication code to be verified.

[0090] S104. The SDP client sends a single-packet authentication knock message to the SDP controller.

[0091] The SDP client sends a single-packet authentication knock message to the SDP controller, so that the SDP controller extracts user information, service request ciphertext and message authentication code to be verified from the single-packet authentication knock message, and obtains the single-packet encryption key and single-packet authentication key from the SPA key distribution center according to the user information, and uses the obtained single-packet authentication key and message authentication code to be verified to verify the validity of the single-packet authentication knock message. If the verification passes, the obtained single-packet encryption key is used to decrypt the service request ciphertext to obtain the service request information, and based on the service request information, obtain access rights to the target business resources.

[0092] For specific steps executed by the SDP controller, please refer to the following steps S105-S109.

[0093] Correspondingly, the SDP controller receives a single-package authentication knock message sent by the SDP client, wherein the single-package authentication knock message includes: user information corresponding to the SDP client, a service request ciphertext, and a message authentication code to be verified.

[0094] Among them, the service request ciphertext is obtained by the SDP client using the single-packet encryption key pre-distributed by the SPA key distribution center to encrypt the service request information of the SDP client. The message authentication code to be verified is obtained by the SDP client performing an HMAC operation on the user information and the service request ciphertext. The service request information is used to request access to the target business resources through the SDP gateway.

[0095] S105. The SDP controller sends a key acquisition request for user information to the SPA key distribution center.

[0096] S106. The SDP controller receives the single-packet encryption key and the single-packet authentication key sent by the SPA key distribution center.

[0097] Among them, the SPA key distribution center is the SPA key distribution center, the SDP controller sends a key acquisition request for user information to the SPA key distribution center, and the key acquisition request includes: user information, the SPA key distribution center determines the single-packet encryption key and single-packet authentication key that match the user information based on the user information query, and sends the single-packet encryption key and single-packet authentication key to the SDP controller. Correspondingly, the SDP controller receives the single-packet encryption key and single-packet authentication key sent by the SPA key distribution center, that is, the SDP controller obtains the single-packet encryption key and single-packet authentication key from the key distribution center.

[0098] Among them, the SPA key distribution center and the SDP controller use a secure data channel for data exchange, which can effectively ensure the security of single-packet encryption keys and single-packet authentication keys.

[0099] S107. The SDP controller verifies the validity of the single-packet authentication knock message according to the received single-packet authentication key and the message authentication code to be verified.

[0100] The SDP controller verifies the validity of the single-packet authentication knock message based on the received single-packet authentication key and the message authentication code to be verified. The received single-packet authentication key can be used to perform an HMAC operation on the user information and service request ciphertext to obtain the target message authentication code. The single-packet authentication knock message is verified for validity based on the target message authentication code and the message authentication code to be verified. If the target message authentication code and the message authentication code to be verified are consistent, the verification succeeds, indicating that the user information and service request ciphertext have not been tampered with during transmission. If the target message authentication code and the message authentication code to be verified are inconsistent, the verification fails, indicating that the user information and / or service request ciphertext have been tampered with during transmission.

[0101] S108: If the verification is successful, the SDP controller uses the received single-packet encryption key to decrypt the service request ciphertext to obtain the service request information, and obtains access rights to the target service resources.

[0102] If the verification is successful, it means that the user information and the service request ciphertext have not been tampered with during the transmission process, that is, the user information and the service request ciphertext are valid. The SDP controller then uses the received single-packet encryption key to decrypt the service request ciphertext to obtain the service request information, and obtains the access rights to the target business resources based on the service request information, where the access rights include allowing access and denying access.

[0103] The access permission can be understood as the authorization status of the target business resource. Allowing access means that the authorization status of the target business resource is authorized access, and prohibiting access means that the authorization status of the target business resource is unauthorized access.

[0104] S109: If the access permission of the target service resource is to allow access, the SDP controller sends an authorization access policy to the SDP gateway, so that the SDP client can access the target service resource through the SDP gateway.

[0105] If the access permission of the target business resource is allowed access, that is, the authorization status is authorized access, the SDP controller sends an authorization access policy to the SDP gateway. The authorization access policy includes: user information corresponding to the SDP client and information about the target business resource. The SDP gateway enables the authorization service of the target business resource for the SDP client. The DP client can initiate authorized resource access by connecting to the service port of the SDP gateway to access the authorized target business resource.

[0106] In this embodiment, single-package authentication is performed using pre-distributed single-package encryption keys and single-package authentication keys. Users do not need to keep the keys themselves, which solves the problems of easy key leakage and complex user operations. It is easy to use and simplifies the user's operation process, thereby improving the overall security and flexibility of the system.

[0107] Figure 3 Schematic diagram of the process of the single packet authentication method provided in the embodiment of the present application Figure 2 ,like Figure 3 As shown, in the above step S102, the SDP client uses the single-package authentication key pre-distributed by the SPA key distribution center to perform HMAC operation on the user information and service request ciphertext corresponding to the SDP client to obtain the message authentication code to be verified, which may include:

[0108] S201. The SDP client uses a single-packet authentication key to perform an HMAC operation on the user information, the service request ciphertext, the preset random number, and the current timestamp to obtain a message authentication code to be verified.

[0109] Among them, the preset random number may include at least one of a pre-generated random number (such as a quantum random number) and a random salt value. The SDP client uses a single-packet authentication key to perform an HMAC operation on the user information, the service request ciphertext, the preset random number and the current timestamp to obtain a message authentication code to be verified.

[0110] The above step S103, generating a single-package authentication knock message according to the user information, the service request ciphertext and the authentication code of the message to be verified, may include:

[0111] S202. The SDP client generates a single-package authentication knock message according to the user information, the service request ciphertext, the preset random number, the current timestamp, and the message authentication code to be verified.

[0112] The SDP client generates a single-package authentication knock message based on the user information, the service request ciphertext, the summary of the service request ciphertext, the preset random number, the current timestamp, and the message authentication code to be verified. The single-package authentication knock message includes: user information, the service request ciphertext, the summary of the service request ciphertext, the preset random number, the current timestamp, and the message authentication code to be verified.

[0113] The summary of the service request ciphertext is a hash summary obtained by performing a hash operation on the service request ciphertext.

[0114] The SDP client sends a single-packet authentication knock message to the SDP controller, so that the SDP controller extracts user information, service request ciphertext, summary of the service request ciphertext, preset random number and current timestamp from the single-packet authentication knock message, and verifies the time validity of the single-packet authentication knock message according to the current timestamp, and verifies the information validity of the service request ciphertext according to the summary of the service request key. If the verification is successful, the single-packet encryption key and single-packet authentication key are obtained from the SPA key distribution center according to the user information, and the obtained single-packet authentication key and the message authentication code to be verified are used to verify the information validity of the single-packet authentication knock message. If the verification is successful, the obtained single-packet encryption key is used to decrypt the service request ciphertext to obtain the service request information, and based on the service request information, the access rights to the target business resources are obtained.

[0115] Among them, the SDP controller can perform a hash operation on the service request ciphertext extracted from the single-packet authentication knock message to obtain a target summary. If the target summary is consistent with the summary of the service request ciphertext extracted from the single-packet authentication knock message, it means that the service request ciphertext has not been tampered with, that is, it is valid. If the target summary is inconsistent with the summary of the service request ciphertext extracted from the single-packet authentication knock message, it means that the service request ciphertext may have been tampered with, that is, it is invalid.

[0116] Accordingly, for the steps performed by the SDP controller side, the above step S105, in which the SDP controller sends a key acquisition request for user information to the SPA key distribution center, may include:

[0117] S203. The SDP controller verifies the time validity of the single-packet authentication knock message according to the current timestamp.

[0118] S204: If the verification is successful, the SDP controller sends a key acquisition request to the SPA key distribution center.

[0119] The SDP controller verifies the time validity of the single-packet authentication knock message based on the current timestamp in the single-packet authentication knock message, wherein the SDP controller itself can obtain the timestamp of the current moment, and compare the timestamp of the current moment with the current timestamp in the single-packet authentication knock message. If the timestamp difference is within the preset range, and the timestamp at the current moment is greater than the current timestamp in the single-packet authentication knock message, then the single-packet authentication knock message is determined to be valid, that is, the single-packet authentication knock message has not been tampered with or there is no replay attack. If the timestamp difference is not within the preset range, or the timestamp at the current moment is less than or equal to the current timestamp in the single-packet authentication knock message, then the single-packet authentication knock message is determined to be valid, that is, the single-packet authentication knock message has been tampered with or there is a replay attack.

[0120] If the verification is successful, the SDP controller sends a key acquisition request to the SPA key distribution center.

[0121] In an optional implementation, the SDP controller performs an HMAC operation on the user information, the service request ciphertext, the preset random number, and the current timestamp based on the received single-packet authentication key to obtain a target message authentication code, and verifies the validity of the single-packet authentication knock message based on the target message authentication code and the message authentication code to be verified. If the target message authentication code and the message authentication code to be verified are consistent, the verification succeeds, indicating that the user information and the service request ciphertext have not been tampered with during transmission. If the target message authentication code and the message authentication code to be verified are inconsistent, the verification fails, indicating that the user information and / or the service request ciphertext have been tampered with during transmission.

[0122] In this embodiment, adding a preset random number and a timestamp to the single-packet authentication knock message can prevent tampering and resist replay attacks, thereby improving the security of the single-packet authentication process.

[0123] Figure 4 Schematic diagram of the process of the single packet authentication method provided in the embodiment of the present application Figure 3 ,like Figure 4 As shown, in an optional implementation, the method may further include:

[0124] S301. The SDP client uses the post-quantum signature private key of the SDP client to sign the post-quantum signature certificate and post-quantum encryption public key of the SDP client to obtain the target signature value.

[0125] Among them, the post-quantum signature private key of the SDP client is the SDP client signature private key corresponding to the post-quantum algorithm, the post-quantum encryption public key is the SDP client signature public key corresponding to the post-quantum algorithm, and the post-quantum signature certificate of the SDP client is the SDP client signature certificate corresponding to the post-quantum algorithm, which is granted and issued to the SDP client by the Certificate Authority (CA) system.

[0126] When the SDP client logs in to the preset secure storage medium for the first time, it can read the post-quantum signature certificate, post-quantum encryption public key and post-quantum signature private key from the secure storage medium, and use the post-quantum signature private key to sign the post-quantum signature certificate and post-quantum encryption public key to obtain the target signature value.

[0127] S302. The SDP client generates a single-package key distribution request based on the post-quantum signature certificate, the post-quantum encryption public key, and the target signature value.

[0128] The SDP client generates a single-package key distribution request, namely, a SPA key distribution request, based on the post-quantum signature certificate, the post-quantum encryption public key, and the target signature value. The single-package key distribution request includes: the post-quantum signature certificate, the post-quantum encryption public key, and the target signature value.

[0129] S303: The SDP client sends a single-package key distribution request to the SPA key distribution center.

[0130] S304: The SDP client receives the single-packet encryption key and the single-packet authentication key sent by the SPA key distribution center.

[0131] The SDP client sends a single-package key distribution request to the SPA key distribution center. The single-package key distribution request is used to request the SPA key distribution center to distribute SPA keys, namely, a single-package authentication key and a single-package encryption key.

[0132] The SPA key distribution center extracts the post-quantum signature certificate and post-quantum encryption public key from the one-way authentication key request, and uses the extracted post-quantum signature certificate and post-quantum encryption public key to verify the validity of the target signature value to ensure the integrity and consistency of user data, and performs root verification on the post-quantum signature certificate. After both verifications are passed, the SPA key distribution center can generate and send a single-package encryption key and a single-package authentication key to the SDP client. Correspondingly, the SDP client receives the single-package encryption key and single-package authentication key sent by the SPA key distribution center.

[0133] It is worth mentioning that root verification refers to root certificate verification and root authentication. The post-quantum signature certificate includes: user information, post-quantum public key and CA signature. The public key in the post-quantum root certificate of a third-party CA organization is used to verify the validity of the post-quantum signature certificate to confirm whether the user is an authorized user of the CA.

[0134] Among them, after verification, the SPA key distribution center can obtain the user information corresponding to the SDP client from the post-quantum signature certificate, create a client user record for the user information, generate a single-package encryption key and a single-package authentication key based on the user information, and save them to the storage space of the corresponding user.

[0135] In this embodiment, in the single-package key distribution process, the use of post-quantum cryptographic algorithms can resist quantum computer attacks and prevent the distributed keys from being cracked by quantum computing, thereby solving the problem of anti-quantum computing risks brought about by asymmetric encryption key distribution methods.

[0136] Figure 5 Schematic diagram of the process of the single packet authentication method provided in the embodiment of the present application Figure 4 ,like Figure 5 As shown, in an optional implementation, the above step S304, the SDP client receives the single-package encryption key and the single-package authentication key sent by the SPA key distribution center, which may include:

[0137] S401. The SDP client receives a single-packet authentication key ciphertext distributed by a SPA key distribution center.

[0138] The SDP client sends a single-package key distribution request to the SPA key distribution center, and the single-package authentication key ciphertext is: The single-package authentication key distribution center extracts the post-quantum signature certificate, the post-quantum encryption public key and the target signature value from the single-package key distribution request, verifies the validity of the target signature value according to the post-quantum signature certificate and the post-quantum encryption public key, and performs root verification on the post-quantum signature certificate. If the verification passes, a single-package encryption key and a single-package authentication key are generated, and a first shared key is generated according to the post-quantum encryption public key, and the single-package encryption key and the single-package authentication key are encrypted using the first shared key.

[0139] Among them, the SPA key distribution center can generate a shared key based on the post-quantum encryption public key extracted from the single-package key distribution request and the SPA key distribution center's own post-quantum encryption private key.

[0140] S402. The SDP client generates a shared key according to the post-quantum encryption private key of the SDP client, and uses the generated shared key to decrypt the single-package authentication key ciphertext to obtain the single-package encryption key and the single-package authentication key.

[0141] Among them, the post-quantum encryption private key of the SDP client is the SDP client encryption private key corresponding to the post-quantum algorithm. The SDP client reads the post-quantum encryption private key of the SDP client from a preset secure storage medium, generates a shared key based on the SPA key distribution center's own post-quantum encryption public key and the SDP client's post-quantum encryption private key, and uses the generated shared key to decrypt the single-package authentication key ciphertext to obtain the single-package encryption key and the single-package authentication key. The SDP client can also store the single-package encryption key and the single-package authentication key in a secure storage medium.

[0142] In this embodiment, during the single-package key distribution process, a post-quantum cryptographic algorithm and a shared key are used to transmit single-package encryption keys and single-package authentication keys, thereby improving the security of single-package encryption keys and single-package authentication keys, being able to resist quantum computer attacks, and preventing the distributed keys from being cracked by quantum computing, thereby solving the problem of anti-quantum computing risks brought about by asymmetric encryption key distribution methods.

[0143] Figure 6 A schematic diagram of the structure of a single packet authentication device provided in an embodiment of the present application Figure 1 , the device is applied to the SDP client.

[0144] like Figure 6 As shown, the device may include:

[0145] The processing module 501 is used to encrypt the service request information to be verified using the single-package encryption key pre-distributed by the SPA key distribution center to obtain a service request ciphertext, wherein the service request information is used to request access to the target service resource through the SDP gateway;

[0146] The processing module 501 is further used to use the single-packet authentication key pre-distributed by the SPA key distribution center to perform HMAC operation on the user information and service request ciphertext corresponding to the SDP client to obtain a message authentication code to be verified;

[0147] A generating module 502, for generating a single-package authentication knock message according to user information, a service request ciphertext and a message authentication code to be verified;

[0148] The sending module 503 is used to send a single-packet authentication knock message to the SDP controller, so that the SDP controller extracts user information, service request ciphertext and message authentication code to be verified from the single-packet authentication knock message, and obtains a single-packet encryption key and a single-packet authentication key from the SPA key distribution center according to the user information, and uses the obtained single-packet authentication key and the message authentication code to be verified to verify the validity of the single-packet authentication knock message. If the verification passes, the obtained single-packet encryption key is used to decrypt the service request ciphertext to obtain the service request information, and based on the service request information, obtain access rights to the target business resources.

[0149] In an optional implementation, the processing module 501 is specifically configured to:

[0150] Using a single-packet authentication key, perform HMAC operation on user information, service request ciphertext, preset random number and current timestamp to obtain the message authentication code to be verified;

[0151] The generating module 502 is specifically used for:

[0152] A single-packet authentication knock message is generated according to user information, service request ciphertext, summary of service request ciphertext, preset random number, current timestamp and message authentication code to be verified, so that the SDP controller extracts user information, service request ciphertext, summary of service request ciphertext, preset random number, current timestamp and message authentication code to be verified from the single-packet authentication knock message, and performs time validity verification on the single-packet authentication knock message according to the current timestamp and information validity verification on the service request ciphertext according to the summary of the service request ciphertext. If both verifications are passed, a single-packet encryption key and a single-packet authentication key are obtained from the SPA key distribution center according to the user information.

[0153] In an optional implementation, the processing module 501 is further configured to:

[0154] Extract user information from the SDP client's post-quantum signed certificate.

[0155] In an optional implementation, the processing module 501 is further configured to:

[0156] Generate a single-package key distribution request based on the post-quantum signature certificate, the post-quantum encryption public key, and the target signature value;

[0157] The sending module 503 is also used to send a single-package key distribution request to the SPA key distribution center;

[0158] Also includes:

[0159] The receiving module 504 is used to receive the single-packet encryption key and the single-packet authentication key sent by the SPA key distribution center.

[0160] In an optional implementation manner, the receiving module 504 is specifically configured to:

[0161] Receive the single-package authentication key ciphertext distributed by the SPA key distribution center. The single-package authentication key ciphertext is obtained by the SPA key distribution center verifying the information validity of the target signature value based on the post-quantum signature certificate and the post-quantum encryption public key, and performing root verification on the post-quantum signature certificate. If the verification is successful, a single-package encryption key and a single-package authentication key are generated, and a shared key is generated based on the post-quantum encryption public key, and the single-package encryption key and the single-package authentication key are encrypted using the shared key;

[0162] A shared key is generated according to the post-quantum encryption private key of the SDP client, and the generated shared key is used to decrypt the single-packet authentication key ciphertext to obtain the single-packet encryption key and the single-packet authentication key.

[0163] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0164] Figure 7 A schematic diagram of the structure of a single packet authentication device provided in an embodiment of the present application Figure 2 , the device is applied to the SDP controller.

[0165] like Figure 7 As shown, the device may include:

[0166] The receiving module 601 is used to receive a single-package authentication knock message sent by the SDP client, wherein the single-package authentication knock message includes: user information corresponding to the SDP client, a service request ciphertext, and a message authentication code to be verified, wherein the service request ciphertext is obtained by the SDP client using a single-package encryption key pre-distributed by the SPA key distribution center to encrypt the service request information of the SDP client, and the message authentication code to be verified is obtained by the SDP client performing an HMAC operation on the user information and the service request ciphertext, and the service request information is used to request access to target service resources through the SDP gateway;

[0167] A sending module 602 is used to send a key acquisition request for user information to the SPA key distribution center;

[0168] The receiving module 601 is also used to receive the single-packet encryption key and the single-packet authentication key sent by the SPA key distribution center;

[0169] The processing module 603 is used to verify the validity of the single-package authentication knock message according to the received single-package authentication key and the message authentication code to be verified;

[0170] The processing module 603 is further configured to, if the verification is successful, use the received single-packet encryption key to decrypt the service request ciphertext to obtain the service request information, and obtain access rights to the target business resource;

[0171] The sending module 602 is further configured to send an authorization access policy to the SDP gateway if the access permission of the target service resource is to allow access, so that the SDP client can access the target service resource through the SDP gateway.

[0172] In an optional implementation manner, the sending module 602 is specifically configured to:

[0173] Verify the time validity of the single-packet authentication knock message based on the current timestamp;

[0174] If the verification is successful, a key acquisition request is sent to the SPA key distribution center.

[0175] In an optional implementation manner, the sending module 602 is specifically configured to:

[0176] According to the received single-packet authentication key, HMAC operation is performed on the user information, service request ciphertext, preset random number and current timestamp to obtain the target message authentication code;

[0177] According to the target message authentication code and the message authentication code to be verified, the single-package authentication knock message is verified for information validity.

[0178] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0179] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The device can be implemented by the above-mentioned SDP client or SDP controller. Figure 8 As shown, the device may include: a processor 701, a memory 702 and a bus 703. The memory 702 stores machine-readable instructions executable by the processor 701. When the electronic device is running, the processor 701 communicates with the memory 702 through the bus 703, and the processor 701 executes the machine-readable instructions to perform the above method.

[0180] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. The computer program is executed when a processor is running, and the processor executes the above method.

[0181] In the embodiment of the present application, the computer program can also execute other machine-readable instructions when run by the processor to execute other methods described in the embodiment. For the specific execution method steps and principles, please refer to the description of the embodiment, which will not be repeated here.

[0182] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0183] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0184] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0185] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a controller, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0186] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and are not to be understood as indicating or implying relative importance.

[0187] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application. They should all be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A single packet authentication method, characterized in that: Applied to the SDP client, the method comprises: Using a single-package encryption key pre-distributed by the SPA key distribution center, the service request information to be verified is encrypted to obtain a service request ciphertext, wherein the service request information is used to request access to a target service resource through an SDP gateway; Using the single-package authentication key pre-distributed by the SPA key distribution center, an HMAC operation is performed on the user information corresponding to the SDP client and the service request ciphertext to obtain a message authentication code to be verified; Generate a single-package authentication knock message according to the user information, the service request ciphertext and the message authentication code to be verified; The single-packet authentication knock message is sent to the SDP controller, so that the SDP controller extracts the user information, the service request ciphertext and the message authentication code to be verified from the single-packet authentication knock message, and obtains the single-packet encryption key and the single-packet authentication key from the SPA key distribution center according to the user information, and uses the obtained single-packet authentication key and the message authentication code to be verified to verify the information validity of the single-packet authentication knock message. If the verification passes, the obtained single-packet encryption key is used to decrypt the service request ciphertext to obtain the service request information, and based on the service request information, obtain access rights to the target business resources.

2. The method according to claim 1, characterized in that The method of using the single-packet authentication key pre-distributed by the SPA key distribution center to perform HMAC operation on the user information corresponding to the SDP client and the service request ciphertext to obtain the message authentication code to be verified includes: Using the single-packet authentication key, perform an HMAC operation on the user information, the service request ciphertext, a preset random number, and a current timestamp to obtain the message authentication code to be verified; The generating a single-package authentication knock message according to the user information, the service request ciphertext, and the message authentication code to be verified includes: The single-packet authentication knock message is generated according to the user information, the service request ciphertext, the summary of the service request ciphertext, the preset random number, the current timestamp and the message authentication code to be verified, so that the SDP controller extracts the user information, the service request ciphertext, the summary of the service request ciphertext, the preset random number, the current timestamp and the message authentication code to be verified from the single-packet authentication knock message, and performs time validity verification on the single-packet authentication knock message according to the current timestamp and information validity verification on the service request ciphertext according to the summary of the service request ciphertext. If both verifications are passed, the single-packet encryption key and the single-packet authentication key are obtained from the SPA key distribution center according to the user information.

3. The method according to claim 1, characterized in that Before the single-packet authentication key pre-distributed by the SPA key distribution center is used to perform an HMAC operation on the user information corresponding to the SDP client and the service request ciphertext to obtain the message authentication code to be verified, the method further includes: The user information is extracted from the post-quantum signature certificate of the SDP client.

4. The method according to claim 1, characterized in that The method further comprises: Using the post-quantum signature private key of the SDP client, the post-quantum signature certificate and the post-quantum encryption public key of the SDP client are signed to obtain a target signature value; Generate a single-package key distribution request according to the post-quantum signature certificate, the post-quantum encryption public key and the target signature value; Sending the single-package key distribution request to the SPA key distribution center; Receive the single-packet encryption key and the single-packet authentication key sent by the SPA key distribution center.

5. The method according to claim 4, characterized in that The receiving the single-packet encryption key and the single-packet authentication key sent by the SPA key distribution center includes: Receive the single-package authentication key ciphertext distributed by the SPA key distribution center, where the single-package authentication key ciphertext is obtained by the SPA key distribution center verifying the information validity of the target signature value according to the post-quantum signature certificate and the post-quantum encryption public key, and performing root verification on the post-quantum signature certificate. If the verifications are all passed, the single-package encryption key and the single-package authentication key are generated, a shared key is generated according to the post-quantum encryption public key, and the single-package encryption key and the single-package authentication key are encrypted using the shared key; The shared key is generated according to the post-quantum encryption private key of the SDP client, and the generated shared key is used to decrypt the single-packet authentication key ciphertext to obtain the single-packet encryption key and the single-packet authentication key.

6. A single packet authentication method, characterized in that: Applied to an SDP controller, the method comprises: Receive a single-package authentication knock message sent by an SDP client, wherein the single-package authentication knock message includes: user information corresponding to the SDP client, a service request ciphertext, and a message authentication code to be verified, wherein the service request ciphertext is obtained by the SDP client using a single-package encryption key pre-distributed by a SPA key distribution center to encrypt the service request information of the SDP client, the message authentication code to be verified is obtained by the SDP client performing an HMAC operation on the user information and the service request ciphertext, and the service request information is used to request access to target service resources through an SDP gateway; Sending a key acquisition request for the user information to the SPA key distribution center; Receiving a single-packet encryption key and a single-packet authentication key sent by the SPA key distribution center; Verifying the validity of the single-package authentication knock message according to the received single-package authentication key and the message authentication code to be verified; If the verification is successful, the received single-packet encryption key is used to decrypt the service request ciphertext to obtain the service request information, and obtain the access rights to the target business resource; If the access permission of the target service resource is to allow access, an authorized access policy is issued to the SDP gateway so that the SDP client can access the target service resource through the SDP gateway.

7. The method according to claim 6, characterized in that The single-packet authentication knock message also includes: a preset random number and a current timestamp, and the sending of a key acquisition request for the user information to the SPA key distribution center includes: Performing time validity verification on the single-packet authentication knock message according to the current timestamp; If the verification is successful, the key acquisition request is sent to the SPA key distribution center.

8. The method according to claim 7, characterized in that The step of verifying the validity of the single-package authentication knock message according to the received single-package authentication key and the message authentication code to be verified includes: According to the received single-packet authentication key, perform an HMAC operation on the user information, the service request ciphertext, the preset random number and the current timestamp to obtain a target message authentication code; The single-package authentication knock message is verified for information validity according to the target message authentication code and the message authentication code to be verified.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and the processor executes the machine-readable instructions to perform the method described in any one of claims 1 to 5 or any one of claims 6 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 or any one of claims 6 to 8 is executed.

Images