Full-link safe electronic passport authentication system and method
By introducing post-quantum cryptographic algorithms into the electronic passport system, low-cost and efficient dual-end device communication and multi-dimensional security authentication are achieved, the problems of quantum computing threats and biometric falsification are solved, and the security and reliability of the electronic passport are improved.
Patent Information
- Application Number
- CN202510527548.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-25
- Publication Date
- 2025-08-01
AI Technical Summary
The existing electronic passport certification system is difficult to withstand the threat of quantum computing, and high-cost dedicated reading and writing equipment limits the scope of popularization. At the same time, the development of biometric counterfeiting technologies such as faces has increased the security risks of automatic border control systems.
The post-quantum cryptography algorithm is used to upgrade the existing electronic passport protocol, introduce PQ-PACE and PQ-AA protocols, and combine the classic cryptography protocol to realize efficient and secure communication and two-way identity authentication between the Android electronic passport and the passport reader.
It realizes low-cost and efficient dual-end device communication, with multi-dimensional security guarantees such as forward security, resistance to online dictionary attacks, and resistance to temporary private key leakage attacks. The transmission speed reaches 152.62Kbps, which can effectively prevent chip tampering and cloning.
Smart Images
Figure CN120415737A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of information security technology, and more particularly, to an electronic passport authentication system and method with end-to-end security. Background Art
[0002] Post-quantum cryptography aims to address the potential threat of quantum computing to traditional encryption algorithms. In 2018, Bos et al. and Ducas et al. proposed two post-quantum cryptography algorithms, Kyber and Dilithium, respectively. Currently, the National Institute of Standards and Technology (NIST) in the United States has renamed these two algorithms as lattice-based module lattice key encapsulation mechanism (ML-KEM) and module lattice digital signature algorithm (ML-DSA), respectively, and incorporated them into the post-quantum cryptography standardization candidate algorithms. The proposal and standardization of these algorithms mark an important progress in the practical application of post-quantum cryptography.
[0003] Existing electronic passport authentication systems are mainly based on contactless smart chips (RFID) and International Civil Aviation Organization (ICAO) standards, including protocols such as BAC (Basic Access Control), PA (Passive Authentication), PACE (Passive Authentication), and AA (Active Authentication), aiming to ensure the security and privacy of electronic passport data. The BAC protocol protects the access to chip data through encryption and authentication mechanisms to prevent unauthorized reading; the PA protocol is used to verify the integrity and authenticity of chip data to ensure that the data has not been tampered with; the PACE protocol establishes a secure communication channel through cryptographic techniques to enhance the security of data exchange; the AA protocol is used to verify the two-way authentication between the chip and the reading device to prevent forgery or illegal access. These protocols together constitute the security framework of the electronic passport. The personal information and photo of the electronic passport together constitute the MRZ code for identity authentication. However, the current encryption algorithms are difficult to resist the threat of quantum computing, and the high-cost dedicated reading and writing devices limit the popularization scope. In addition, the rapid development of generative artificial intelligence has made biometric forgery technologies such as face forgery increasingly mature, further exacerbating the security risks of automatic border control systems. Summary of the Invention
[0004] In view of this, the purpose of the present invention is to provide an electronic passport authentication system and method with end-to-end security, using post-quantum cryptography algorithms and the technical standards of existing electronic passport protocols to support efficient communication between dual-end devices, low-cost authentication processes, and multi-dimensional security guarantees.
[0005] To achieve the above purpose, the first aspect of the present invention provides an electronic passport authentication system with end-to-end security, including:
[0006] An Android-based electronic passport, which deploys a post-quantum cryptography protocol and a classical cryptography protocol, is used to read and display electronic passport information, send a connection request to a passport reader, and complete authentication and establish secure communication with the passport reader based on the post-quantum cryptography protocol and the classical cryptography protocol;
[0007] A passport reader, which deploys a post-quantum cryptography protocol and a classical cryptography protocol, displays user electronic passport information and receives a connection request from the Android-based electronic passport, and completes authentication and establishes secure communication with the Android-based electronic passport based on the post-quantum cryptography protocol and the classical cryptography protocol.
[0008] In one implementation, the post-quantum cryptography protocol includes PQ-PACE and PQ-AA. PQ-PACE is used to establish a secure communication channel through post-quantum cryptography standards, and PQ-AA is used to verify the mutual authentication between the chip and the reading device using post-quantum cryptography standards. The classical cryptography protocol includes BAC, PACE, AA, and PA.
[0009] In one implementation, the Android-based electronic passport includes:
[0010] A passport reading module, which is used to read electronic passport information;
[0011] A data transmission and display module, which is used to transmit electronic passport information to the passport reader and display electronic passport information;
[0012] A post-quantum cryptography module, which is used to implement the encryption and decryption algorithms in the post-quantum cryptography protocol based on a secure operating system and a post-quantum cryptography library;
[0013] A secure communication module, which is used to establish a secure communication channel with the passport reader based on PQ-PACE;
[0014] An authentication and authorization module, which is used to implement mutual authentication with the passport reader based on PQ-AA.
[0015] In one implementation, the Android-based electronic passport further includes a key management module, which is used to manage the keys in the post-quantum cryptography protocol and the classical cryptography protocol.
[0016] In one implementation, the passport reader includes:
[0017] An NFC module, which is used to read the electronic passport information sent by the Android-based electronic passport;
[0018] An optical recognition module, which is used to read the machine-readable zone MRZ in the electronic passport information;
[0019] A programmable security chip is used to establish a secure communication channel with the Android-side electronic passport by executing the PQ-PACE protocol, perform data comparison by executing the PA protocol, and perform identity authentication by executing the PQ-AA protocol.
[0020] In one embodiment, the system further includes a desktop electronic passport system for receiving and displaying the electronic passport information sent by the passport reader.
[0021] Based on the same inventive concept, a second aspect of the present invention provides an all-link secure electronic passport authentication method, including:
[0022] Deploy the quantum cryptography protocol and classical cryptography protocol on the Android-side electronic passport and the passport reader;
[0023] The Android-side electronically reads the electronic passport information, sends the electronic passport information and a connection request to the passport reader;
[0024] The passport reader completes authentication and establishes a secure communication based on the received electronic passport information and connection request based on the post-quantum cryptography protocol and classical cryptography protocol.
[0025] In one embodiment, the passport reader completes authentication and establishes a secure communication based on the received electronic passport information and connection request based on the post-quantum cryptography protocol and classical cryptography protocol, including: executing the PQ-PACE protocol to establish a secure communication channel with the Android-side electronic passport, performing data comparison by executing the PA protocol, and performing identity authentication by executing the PQ-AA protocol.
[0026] In one embodiment, executing the PQ-PACE protocol to establish a secure communication channel with the Android-side electronic passport includes:
[0027] The Android phone first sends a connection request to the passport reader, and both parties generate a session key K using the MRZ information π , the passport reader generates a random noise s, encrypts it and sends it to the Android phone, and the Android phone decrypts it to obtain s;
[0028] The passport reader generates a key pair based on s and sends the public key to the Android phone. The Android phone encrypts s using the ML-KEM post-quantum cryptography algorithm and returns the ciphertext C AB ; the passport reader decrypts C AB to obtain the shared secret Z AB , both parties generate a session key and a MAC key based on Z AB and verify the public key and ciphertext through MAC to ensure communication security, and finally complete authentication and establish a secure communication.
[0029] In one embodiment, the issuing authority generates a unique ML-DSA key pair for each passport. The public key is stored in the chip, and the private key is stored in the secure area of the Android phone. The PQ-AA protocol is executed to implement identity authentication, including:
[0030] At the beginning of the verification, the passport reader reads and verifies the integrity and authenticity of the document security object to ensure that it is issued by the issuing authority.
[0031] The passport reader extracts the chip public key from the SOD or specific data group and generates a random challenge value c to send to the Android phone. The Android phone signs the challenge value c using the private key. And returns the signature result σ to the passport reader, where Sign MLDSA represents the signature algorithm based on ML-DSA, represents the private key of the Android phone.
[0032] The passport reader verifies the signature using the public key of the Android phone. If the verification is successful, the authenticity of the internal chip of the Android phone is confirmed. If the verification fails, it indicates that the chip has been tampered with or cloned. Here, Verify MLDSA represents the verification algorithm based on ML-DSA, represents the public key of the Android phone.
[0033] By introducing an upgrade to the standard electronic passport protocol standard based on post-quantum cryptographic algorithms (PQ-PACE, PQ-AA), the present invention proposes an all-link secure electronic passport authentication system and method. The system or method can achieve the following effects:
[0034] (1) Efficient communication between dual-end devices; even when combined with post-quantum cryptographic algorithms, the protocol time overhead of the present invention is still in the millisecond level, and the overall average transmission speed between the Android phone and the passport reader is 152.62 Kbps. (2) Low-cost authentication process; the present invention deploys an electronic passport on the Android phone, and the identity authentication can be completed by simply tapping the NFC reader, which can be used as a low-cost alternative to paper passports. (3) Multi-dimensional security guarantee. Based on the security attributes of post-quantum cryptographic algorithms, the present invention has support for forward security, resistance to online dictionary attacks, resistance to leakage attacks of ephemeral private keys, resistance to unknown key sharing attacks, explicit authentication, and quantum security. BRIEF DESCRIPTION OF THE DRAWINGS
[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.
[0036] Figure 1 It is a framework diagram of the full-link security electronic passport authentication system according to an embodiment of the present invention;
[0037] Figure 2 It is a module diagram of the Android-side electronic passport according to an embodiment of the present invention;
[0038] Figure 3 It is an authentication flow chart of the passport reader in an embodiment of the present invention;
[0039] Figure 4 It is a schematic diagram of the desktop-side passport reading system in an embodiment of the present invention;
[0040] Figure 5 It is a schematic diagram of the electronic passport in an embodiment of the present invention. Specific embodiments
[0041] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.
[0042] Embodiment 1
[0043] This embodiment discloses an electronic passport authentication system with full-link security, including:
[0044] An Android-side electronic passport, which deploys a post-quantum cryptography protocol and a classical cryptography protocol, is used to read and display electronic passport information, send a connection request to the passport reader, and complete authentication and establish secure communication with the passport reader based on the post-quantum cryptography protocol and the classical cryptography protocol;
[0045] A passport reader, which deploys a post-quantum cryptography protocol and a classical cryptography protocol, displays user electronic passport information and receives the connection request from the Android-side electronic passport, and completes authentication and establishes secure communication with the Android-side electronic passport based on the post-quantum cryptography protocol and the classical cryptography protocol.
[0046] Specifically, first design a post-quantum cryptography protocol, including the design of the PQ-PACE protocol and the PQ-AA protocol; deploy the post-quantum cryptography protocol and the classical cryptography protocol on the security chips of the passport reader and the electronic passport respectively, including the PQ-PACE protocol, the PQ-AA protocol, the BAC protocol, the PA protocol, the PACE protocol, the AA protocol, etc.
[0047] In one embodiment, the system further includes a desktop electronic passport system for receiving and displaying the electronic passport information sent by the passport reader.
[0048] Specifically, please refer to Figure 1 , the present invention provides an all-link secure electronic passport authentication system, including an electronic passport user, an Android-side electronic passport, a passport reader, and a desktop passport authentication system; the Android-side electronic passport is respectively connected to the electronic passport user and the passport reader; the passport reader is respectively connected to the Android-side electronic passport and the desktop electronic passport authentication system; the user touches the Android-side electronic passport NFC on the passport reader, and the reader can return the passport reading result to the Android-side electronic passport and the desktop passport authentication system.
[0049] In the specific implementation process, the design and implementation of the Android-side electronic passport involve an entity of an Android mobile phone for storing and displaying passport information. The user touches the Android-side electronic passport on the passport reader, and the reader can return the reading result to the Android mobile phone and the desktop electronic passport system;
[0050] The design of the security chip of the passport reader and the implementation of the desktop electronic passport system involve two entities of the passport reader and the desktop for displaying the user's electronic passport information. The user touches the Android-side electronic passport on the passport reader, and the reader can return the reading result to the Android mobile phone and the desktop electronic passport system.
[0051] In one embodiment, the Android-side electronic passport includes:
[0052] A passport reading module for reading electronic passport information;
[0053] A data transmission and display module for transmitting the electronic passport information to the passport reader and displaying the electronic passport information;
[0054] A post-quantum cryptography module for implementing the encryption and decryption algorithms in the post-quantum cryptography protocol based on a secure operating system and a post-quantum cryptography library;
[0055] A secure communication module for establishing a secure communication channel with the passport reader based on PQ-PACE;
[0056] An authentication and authorization module for implementing two-way identity authentication with the passport reader based on PQ-AA.
[0057] The Android-side electronic passport further includes a key management module for managing the keys in the post-quantum cryptography protocol and the classical cryptography protocol.
[0058] Specifically, please refer to Figure 2 , the Android-side electronic passport includes an application layer, a security layer, and a physical layer.
[0059] The Design and Implementation of Android Electronic Passport involves an entity of an Android mobile phone, which is used to store and display passport information. When the user touches the Android electronic passport to the passport reader, the reader can return the reading result to the Android mobile phone and the desktop electronic passport system.
[0060] First, the implementation of the Android application layer includes a passport reading application module, a user interface design module, and a log and audit module. The user interface design includes a startup page, an information display and confirmation operation page, and a startup NFC page, ensuring user-friendliness, accurately displaying the electronic passport user information, and accurately transmitting user data to the passport reader.
[0061] After that, the implementation of the Android security layer includes a key management module, a secure communication module, an authentication and authorization module, and a post-quantum cryptography module. These functions are implemented through a secure operating system and a post-quantum cryptography library.
[0062] Finally, the implementation of the Android security layer includes a secure chip integration module, an NFC / RFID module, and a storage management module. This layer provides hardware support for the security layer and the application layer. Among them, the secure chip integration process is the process of deploying the post-quantum cryptography protocol and the classical cryptography protocol on the secure chips of the passport reader and the electronic passport respectively.
[0063] Specifically, it can be implemented in the following ways
[0064] First, the verification terminal software is developed based on the Electron and Vue frameworks, making full use of the cross-platform characteristics of Electron and the efficient development capabilities of Vue, ensuring the compatibility of the terminal on multiple operating systems and a consistent user experience.
[0065] After that, based on the MRZ code jointly generated by the personal detailed information and photo on the passport, the PACE, BAC, PA, and AA traditional electronic passport standard protocols are implemented on the Android electronic passport.
[0066] Finally, the post-quantum algorithm transformation of the PACE and AA electronic passport standard protocols is implemented on the Android electronic passport, and it is upgraded to the post-quantum cryptography protocols of PQ-PACE and PQ-AA that are resistant to quantum attacks.
[0067] In one implementation, the passport reader includes:
[0068] An NFC module for reading the electronic passport information sent by the Android electronic passport;
[0069] An optical recognition module for reading the machine-readable code MRZ in the electronic passport information;
[0070] A programmable security chip is used to establish a secure communication channel with an Android e-passport by executing the PQ-PACE protocol, perform data comparison by executing the PA protocol, and perform identity authentication by executing the PQ-AA protocol.
[0071] Please refer to Figures 3 to 5 , where Figure 3 is the authentication flowchart of the passport reader in the embodiment of the present invention, Figure 4 is the schematic diagram of the desktop passport reading system in the embodiment of the present invention; Figure 5 is the schematic diagram of the e-passport in the embodiment of the present invention.
[0072] In the specific implementation process, the document reader is based on the T10-PT2000 full-page document reader, equipped with an NFC module, an optical recognition module and a programmable security chip. Its internal authentication process includes reading EF.CardAccess, reading the MRZ through ORC, executing the PQ-PACE protocol, performing data comparison by executing the PA protocol, and performing chip authentication by executing the PQ-AA protocol.
[0073] The design of the security chip of the passport reader and the implementation of the desktop e-passport system involve two entities, the passport reader and the desktop, and are used to display the user's e-passport information. The user touches the Android e-passport on the passport reader, and the reader can return the reading result to the Android phone and the desktop e-passport system. It is specifically implemented in the following ways:
[0074] First, the design and implementation of the desktop e-passport reading result interface, including the start page, reading progress, information display and confirmation operation page, to ensure that the e-passport information of the passport reader can be accurately displayed;
[0075] Finally, the integration and protocol adaptation of the security chip of the passport reader connected to the desktop are developed using the Vue3+Electron framework, including the design of APDU instructions on the security chip, that is, the post-quantum cryptography protocol and the classical cryptography protocol are respectively deployed on the security chips of the passport reader and the e-passport, ensuring that the passport reader can accurately and securely read the e-passport information and return the passport information to the desktop.
[0076] Embodiment 2
[0077] Based on the same inventive concept, this embodiment discloses an all-link secure e-passport authentication method, including:
[0078] Deploy the post-quantum cryptography protocol and the classical cryptography protocol on the Android e-passport and the passport reader;
[0079] Read the e-passport information through the Android device, and send the e-passport information and a connection request to the passport reader;
[0080] The passport reader completes authentication and establishes secure communication based on the received electronic passport information and the connection request, using post-quantum cryptographic protocols and classical cryptographic protocols.
[0081] In one embodiment, the passport reader completes authentication and establishes secure communication based on the received electronic passport information and the connection request, using post-quantum cryptographic protocols and classical cryptographic protocols, including: executing the PQ-PACE protocol to establish a secure communication channel with the Android-side electronic passport, executing the PA protocol to implement data comparison, and executing the PQ-AA protocol to implement identity authentication.
[0082] In one embodiment, executing the PQ-PACE protocol to establish a secure communication channel with the Android-side electronic passport includes:
[0083] The Android phone first sends a connection request to the passport reader, and both parties generate a session key K using the MRZ information π , the passport reader generates a random noise s, encrypts it and sends it to the Android phone, and the Android phone decrypts it to obtain s;
[0084] The passport reader generates a key pair based on s and sends the public key to the Android phone. The Android phone encrypts s using the ML-KEM post-quantum cryptographic algorithm and returns the ciphertext C AB ; the passport reader decrypts C AB to obtain the shared secret Z AB , and both parties generate a session key and a MAC key based on Z AB and verify the public key and ciphertext through MAC to ensure communication security, and finally complete authentication and establish secure communication.
[0085] Specifically, the ML-KEM post-quantum cryptographic algorithm is used to replace the encryption and decryption algorithms in the original PACE protocol to complete the upgrade from the traditional PACE protocol to the quantum-resistant PQ-PACE protocol. The communication security is ensured through the modified protocol, and finally authentication is completed and secure communication is established.
[0086] In one embodiment, the issuing authority generates a unique ML-DSA key pair for each passport, stores the public key in the chip, and stores the private key in the secure area of the Android phone; executing the PQ-AA protocol to implement identity authentication includes:
[0087] At the beginning of the verification, the passport reader reads and verifies the integrity and authenticity of the document security object to ensure that it is issued by the issuing authority;
[0088] The passport reader extracts the chip public key from the SOD or a specific data group and generates a random challenge value c and sends it to the Android phone. The Android phone signs the challenge value c using the private key and returns the signature result σ to the passport reader, where Sign MLDSARepresents the signature algorithm based on ML-DSA, represents the private key of the Android phone;
[0089] The passport reader uses the public key of the Android phone to verify the signature If the verification is successful, the authenticity of the internal chip of the Android phone is confirmed; if it fails, it indicates that the chip has been tampered with or cloned, where Verify MLDSA represents the verification algorithm based on ML-DSA, represents the public key of the Android phone.
[0090] Specifically, after adopting the ML-DSA post-quantum cryptographic algorithm to replace the signature and verification algorithms in the original AA protocol, the upgrade from the traditional AA protocol to the quantum-resistant PQ-AA protocol is completed; through the PQ-AA protocol, chip cloning is effectively prevented, and the security and reliability of the e-passport system are improved.
[0091] In addition, the security analysis unit evaluates the security of the PQ-PACE and PQ-AA protocols to ensure that they meet the security requirements of the post-quantum cryptographic standards.
[0092] Among them, at the hardware level, the security chip, as the core component, adopts anti-tampering packaging technology, a secure storage area, and a true random number generator to effectively resist physical attacks and the risk of key leakage. The chip supports international standard encryption algorithms (such as AES, RSA, ECC) and post-quantum cryptographic standard algorithms (such as ML-KEM, ML-DSA), and prevents fault injection attacks through built-in clock and power monitoring circuits;
[0093] Generally speaking, the present invention proposes a full-link secure e-passport authentication system and method by introducing an upgrade of the standard e-passport protocol standard based on post-quantum cryptographic algorithms (PQ-PACE, PQ-AA), and can achieve the following technical effects: (1) Efficient communication between dual-end devices; even when combined with post-quantum cryptographic algorithms, the protocol time overhead of the present invention is still in the millisecond level, and the overall average transmission speed between the Android phone and the passport reader is 152.62 Kbps; (2) Low-cost authentication process; the present invention deploys the e-passport on the Android phone, and the identity authentication can be completed by lightly touching the NFC reader, which can be used as a low-cost alternative to the paper passport; (3) Multi-dimensional security guarantee. Based on the security attributes of the post-quantum cryptographic algorithm, the present invention supports forward security, resistance to online dictionary attacks, resistance to ephemeral private key leakage attacks, resistance to unknown key sharing attacks, explicit authentication, and quantum-resistant security, etc.
[0094] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.
[0095] The present invention is described with reference to the flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each flow and / or block in the flowchart and / or block diagram, and the combination of flows and / or blocks in the flowchart and / or block diagram, can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, such that the instructions executed by the processor of the computer or other programmable data processing device generate means for realizing the functions specified in one Figure 1 one flow or multiple flows and / or blocks Figure 1 one block or multiple blocks.
[0096] Although the preferred embodiments of the present invention have been described, those skilled in the art can make additional changes and modifications to these embodiments once they know the basic creative concept. Therefore, the appended claims are intended to be construed as including the preferred embodiments and all changes and modifications falling within the scope of the present invention. Obviously, those skilled in the art can make various changes and variations to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if these modifications and variations of the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention is also intended to include these changes and variations.
Claims
1. An electronic passport authentication system with end-to-end security, characterized in that, including: The Android electronic passport is deployed with post - quantum cryptography protocols and classical cryptography protocols, used for reading and displaying electronic passport information, sending connection requests to the passport reader, and completing authentication and establishing secure communication with the passport reader based on post - quantum cryptography protocols and classical cryptography protocols; The passport reader is deployed with post - quantum cryptography protocols and classical cryptography protocols, displays the user's electronic passport information, receives connection requests from the Android electronic passport, and completes authentication and establishes secure communication with the Android electronic passport based on post - quantum cryptography protocols and classical cryptography protocols.
2. The full-link secure electronic passport authentication system according to claim 1, characterized in that, The post - quantum cryptography protocols include PQ - PACE, PQ - AA. PQ - PACE is used to establish a secure communication channel through post - quantum cryptography standards, and PQ - AA is used to verify the mutual authentication between the chip and the reading device using post - quantum cryptography standards. The classical cryptography protocols include BAC, PACE, AA, and PA.
3. The full-link secure electronic passport authentication system according to claim 2, wherein The Android electronic passport includes: A passport reading module for reading electronic passport information; A data transmission and display module for transmitting electronic passport information to the passport reader and displaying electronic passport information; A post - quantum cryptography module for implementing encryption and decryption algorithms in post - quantum cryptography protocols based on a secure operating system and a post - quantum cryptography library; A secure communication module for establishing a secure communication channel with the passport reader based on PQ - PACE; An authentication and authorization module for implementing mutual authentication with the passport reader based on PQ - AA.
4. The full-link secure electronic passport authentication system according to claim 3, characterized in that, The Android electronic passport also includes a key management module for managing keys in post - quantum cryptography protocols and classical cryptography protocols.
5. The full-link secure electronic passport authentication system according to claim 2, characterized in that, The passport reader includes: An NFC module for reading the electronic passport information sent by the Android electronic passport; An optical recognition module for reading the machine - readable zone (MRZ) in the electronic passport information; A programmable security chip for executing the PQ - PACE protocol to establish a secure communication channel with the Android electronic passport, executing the PA protocol to implement data comparison, and executing the PQ - AA protocol to implement identity authentication.
6. The full-link secure electronic passport authentication system according to claim 1, characterized in that, The system also includes a desktop electronic passport system for receiving and displaying the electronic passport information sent by the passport reader.
7. An electronic passport authentication method with full-link security, characterized in that, including: Deploying post - quantum cryptography protocols and classical cryptography protocols in the Android electronic passport and the passport reader; Reading electronic passport information through the Android side, sending electronic passport information and connection requests to the passport reader; The passport reader completes authentication and establishes secure communication based on the received electronic passport information and connection requests based on post - quantum cryptography protocols and classical cryptography protocols.
8. The full-link secure electronic passport authentication method according to claim 7, characterized in that The passport reader completes authentication and establishes secure communication based on the received electronic passport information and connection requests based on post - quantum cryptography protocols and classical cryptography protocols, including: executing the PQ - PACE protocol to establish a secure communication channel with the Android electronic passport, executing the PA protocol to implement data comparison, and executing the PQ - AA protocol to implement identity authentication.
9. The full-link secure electronic passport authentication method according to claim 8, wherein Executing the PQ - PACE protocol to establish a secure communication channel with the Android electronic passport, including: The Android phone first sends a connection request to the passport reader, and the two parties generate a session key K using the MRZ information π , the passport reader generates a random noise s, encrypts it and sends it to the Android phone, and the Android phone decrypts it to obtain s; The passport reader generates a key pair based on s and sends the public key to the Android phone. The Android phone encrypts s using the post-quantum cryptography algorithm ML-KEM and returns the ciphertext C. AB The passport reader decrypts C AB to obtain the shared secret Z AB , and both parties generate a session key and a MAC key based on Z AB , and verify the public key and the ciphertext through MAC to ensure secure communication, and finally complete the authentication and establish a secure communication.
10. The full-link secure electronic passport authentication method according to claim 8, wherein, The issuing authority generates a unique ML - DSA key pair for each passport, the public key is stored in the chip, and the private key is stored in the secure area of the Android phone; Implement the PQ-AA protocol for identity authentication, including: At the beginning of verification, the passport reader reads and verifies the integrity and authenticity of the document security object to ensure that it is issued by the issuing agency; The passport reader extracts the chip public key from the SOD or specific data set and generates a random challenge value c to send to the Android phone, which signs the challenge value c using the private key and returns the signature result σ to the passport reader, where Sign MLSSA represents the signature algorithm based on ML-DSA, represents the private key of the Android phone; The passport reader uses the public key of the Android phone to verify the signature If the verification is successful, the authenticity of the internal chip of the Android phone is confirmed; if it fails, it indicates that the chip has been tampered with or cloned, where Verify MLDSA represents the verification algorithm based on ML-DSA, represents the public key of the Android phone.