Anti-quantum tunnel communication security enhancement method and system based on software definition

Abstract

The invention belongs to the technical field of network communication security, and relates to an anti-quantum tunnel communication security enhancement method and system based on software definition, and the system comprises a message processing module, a remote management module, a password module and an access control module. By introducing an anti-quantum cryptography algorithm and modular design, an anti-quantum tunnel architecture realized by pure software is provided, quantum secure communication is realized without depending on hardware, non-intrusive deployment is supported, and compatibility with various service scenes is realized. According to the invention, by introducing an anti-quantum cryptography algorithm and modular design, an anti-quantum tunnel architecture realized by pure software is provided, quantum secure communication can be realized without depending on hardware, non-intrusive deployment is supported, and compatibility with various service scenes is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of network communication security, and relates to a software-defined anti-quantum tunnel communication security enhancement method and system. Background Art

[0002] With the rapid development of Internet technology, network tunnel technology plays an important role in heterogeneous network interconnection and secure transmission. Its main purpose is to achieve protocol compatibility between different network architectures, enhance the security of data transmission, and expand network boundaries. For example, IPv6 data can be transmitted through an IPv4 network, and enterprise branch offices can be linked into a unified internal network through logical tunnels. Currently, mainstream tunnel communication technologies such as IPSec establish secure communication tunnels on public networks through encapsulation and encryption technologies, and are widely used in scenarios such as VPNs, enterprise internal network interconnection, and cross-regional data transmission. However, these technologies rely on traditional encryption algorithms such as RSA and ECC, have significant quantum vulnerabilities, and are easily cracked by quantum computers. In addition, existing anti-quantum solutions usually require dedicated hardware support or modification of the underlying protocols of business systems, resulting in high deployment costs, poor compatibility, and long implementation cycles.

[0003] Meanwhile, anti-quantum cryptography technology, as the core solution to deal with the threat of quantum computing, is mainly divided into two categories: quantum key distribution and anti-quantum cryptographic algorithms. Quantum key distribution achieves unconditional security based on quantum physical properties, but it relies on dedicated hardware such as single-photon detectors and optical fiber relay devices, with high deployment costs and difficulty in compatibility with existing network architectures. Anti-quantum cryptographic algorithms are implemented in the form of software or chips, such as NIST standard algorithms CRYSTALS-Kyber and Dilithium. However, existing solutions mostly require modification of business systems or rely on hardware acceleration chips, lacking flexibility. In addition, traditional tunnel technologies also face the problem of management deficiency, lacking remote unified management functions for tunnel tools, or the management channels are not fortified against quantum threats, further increasing security risks.

[0004] In practical applications, the headquarters and multiple branch offices in a distributed enterprise network architecture are often scattered in different geographical locations. Traditional VPN deployment requires local configuration of each device, with low efficiency and difficult to unify security policies. At the same time, anti-quantum chip hardware has high costs and poor portability, making it difficult to promote on a large scale. And software-based anti-quantum solutions such as the reconstruction of the PKI system require restructuring of the business system communication protocol, with high implementation complexity. Therefore, how to provide a tunnel communication solution with low cost, high compatibility, and quantum security without changing the existing business system architecture has become an urgent technical problem to be solved. Summary of the Invention

[0005] In view of the problem of insufficient security of existing tunnel communication technologies under the threat of quantum computing, the present invention proposes a software-defined method and system for enhancing the security of anti-quantum tunnel communication. Through the design of a pure software-defined anti-quantum tunnel architecture, combined with a message processing module, a remote management module, a cryptographic module, and an access control module, full-stack software deployment is achieved, avoiding dependence on anti-quantum chips and reducing deployment costs. At the same time, the original traffic is intercepted through a virtualized network interface, and the service data is transparently encapsulated, supporting multi-protocol transparent transmission, without the need to modify the original protocol, thus achieving non-intrusive deployment. In addition, the present invention adopts a dual-certificate hybrid authentication mechanism, superimposing quantum protection capabilities on the basis of national cryptographic compliance, and ensuring the same security of management instructions and data traffic through an anti-quantum fortified remote management channel, preventing man-in-the-middle attacks under quantum computing. The lightweight traffic access control module realizes refined traffic filtering through dynamic blacklist rules, improving the effective utilization rate of the tunnel and the security of the internal network.

[0006] A software-defined method for enhancing the security of anti-quantum tunnel communication includes the following steps: Tunnel software is deployed at both the local end and the remote end, and the tunnel software includes a message processing module, a remote management module, a cryptographic module, and an access control module; A link is established between the tunnel software at the local end and the tunnel software at the remote end. The local end calls the cryptographic module to generate a key and sends it to the remote end for tunnel establishment and key negotiation. After the tunnel is established, the local end and the remote end use the symmetric encryption key for data encapsulation and transmission; The message processing module at the local end receives the plaintext service message from the enterprise internal network, calls the cryptographic module, and encrypts the plaintext using the negotiated key. The message processing module at the local end sends the encrypted ciphertext service message to the message processing module at the remote end through the tunnel; The message processing module at the local end receives the ciphertext service message responded by the remote end, calls the cryptographic module to decrypt it into plaintext, and sends it to the corresponding device in the enterprise internal network; The message processing module at the local end receives the remote management message. The remote management message is fortified using anti-quantum cryptographic technology. After receiving it, the cryptographic module is called to decrypt it, and after decryption, it is sent to the remote management module for processing.

[0007] Further, a client is deployed at the local end, and a server is deployed at the remote end; The process of tunnel establishment and key negotiation is specifically as follows: S101: The client initiates a key negotiation request; S102: After receiving the key negotiation request, the server sends the server's national cryptographic certificate, the server's anti-quantum certificate, the first random number, and the first signature to the client; S103: After the client receives the response, it verifies the server's national cryptography certificate, the server's quantum-resistant certificate, and the first signature; if the verification passes, it proceeds to the next step, otherwise, it terminates the connection. S104: The client generates a second random number, generates a client quantum-resistant key pair and a session key seed based on the quantum-resistant cryptography algorithm; encrypts the session key seed using the public key in the server's quantum-resistant certificate to obtain the first encrypted information; calculates the hash value of the first random number and the second random number based on the SM3 cryptography algorithm to obtain the first anti-tampering information. S105: The client sends the client's national cryptography certificate, the client's quantum-resistant public key, the first encrypted information, the second random number, the first anti-tampering information, and the second signature to the server. S106: The server verifies the second signature in the client's response; recovers the session key seed from the first encrypted information using the server's quantum-resistant private key; verifies the first anti-tampering information through the SM3 cryptography algorithm, the first random number, and the second random number. S107: The server generates the first key for the symmetric encryption process using the recovered session key seed and the first and second random numbers; encrypts the first key using the client's quantum-resistant public key to obtain the first authentication tag; generates the second anti-tampering information based on the session key seed recovered by the server. S108: The server sends the first authentication tag, the second anti-tampering information, and the third signature to the client. S109: The client verifies the server's third signature; verifies the second anti-tampering information using the local session key seed; the client verifies the server's first authentication tag using the first key. If all verifications pass, both parties then hold the same first key, indicating that the encrypted channel is ready.

[0008] Further, in S102, the server's national cryptography certificate contains the server's public key ; The server's quantum-resistant certificate contains the server's quantum-resistant public key ; The calculation formula for the first signature is as follows: Calculate the hash value based on the first random number : ; Generate the first signature : ; Where represents the first random number, represents the SM3 cryptography algorithm; represents the timestamp; represents the server's SM2 private key; is the string concatenation operator; Represents the signature generation function; The signature verification process in S103 is represented as follows: calculate , ; pass Conduct verification; in, is the recalculated hash value, The server SM2 public key; Represents a signature verification function.

[0009] Furthermore, S104 is specifically as follows: The client generates a second random number , prepare for key exchange; the client generates a client quantum-resistant key pair based on the quantum-resistant cryptographic algorithm, and the client quantum-resistant key pair includes the client quantum-resistant public key and client-side quantum-resistant private keys , the generation algorithm is as follows: Generate a random matrix: First generate a random private key seed , expanded to the public key matrix , ; in, Represents an extension operation; Represents the dimension domain of the matrix, each element in the matrix is a polynomial ring The polynomial on , is the modulus of the polynomial, Represents dimension, is a formal variable, is a modular polynomial, used to construct the algebraic structure of a polynomial ring; Representative Model The ring of integers, that is, all integers modulo The following collection; Generate private key vector , expressed as: ;in, express dimensional error sampling distribution, represents random sampling; Generate a public key , expressed as: ; ; Where, e is the noise vector; Obtaining a quantum-resistant public key , expressed as: ; Obtain the client's quantum-resistant private key , expressed as: ; Generate a session key seed; Use the public key in the server's quantum-resistant certificate to encrypt the session key seed to obtain the first encrypted message ; The specific encryption method is: Use the server's quantum-resistant public key to expand the server matrix ; ; is the server's random private key seed, is the server's public key; Generate a random vector and an error , , expressed as: ; ; ; where, is the single-variable error sampling distribution; Calculate the ciphertext components , ; expressed as: , ; represents the result after encoding as a polynomial, represents the matrix transpose, represents the session key seed; Compress to obtain the first encrypted message , expressed as: ; where, represents retaining the low-order bits of each coefficient; Based on Calculate the hash value of the first random number and the second random number using the cryptographic algorithm to obtain the first tamper-proof information , and the calculation formula is as follows: ; where, represents the cryptographic algorithm.

[0010] Furthermore, the second signature in S105 is generated based on the SM2 cryptographic algorithm, and the calculation formula is as follows: ; where, represents the second signature, Indicates the signature operation based on the cryptographic algorithm, represents the client's quantum-resistant public key, represents the client's quantum-resistant private key, represents the SM3 cryptographic algorithm, represents the first encrypted message, represents the second random number; Specifically, S106 is as follows: The server verifies whether the client's signature is correct. If the verification fails, the connection is terminated. Specifically: Verify the second signature , which is expressed as: ; Among them, represents the server's quantum-resistant private key; After the verification passes, use the server's quantum-resistant private key to recover the session key seed from the first encrypted message, which is expressed as: Decompress the first encrypted message , which is expressed as: ; Among them, is the compressed ciphertext component of the first encrypted message , , is the compressed ciphertext component of the first encrypted message , , is the decompressed result of the ciphertext component , is the decompressed result of the ciphertext component ; Use the server's quantum-resistant private key to decrypt the session key seed, which is expressed as: ; ; Among them, is the encoded information with noise; is the recovered session key seed; represents the decoding function, represents the server's quantum-resistant private key; Verify the hash consistency. Calculate the hash values of the first random number and the second random number based on the cryptographic algorithm. If the hash values are inconsistent with the first tamper-proof information , it is regarded as tampering and the connection is terminated. It is expressed as: ; Among them, represents the conditional judgment.

[0011] Further, S107 is specifically as follows: The server uses the recovered session key seed and the first and second random numbers to generate the first key for the symmetric encryption process , expressed as: ; ; ; ; where is a key derivation function based on the SM3 cryptographic algorithm; is the symmetric encryption key for the SM4 algorithm; is the authentication key of the authentication tag generation function; is the initialization vector for the GCM mode; , and are fixed ASCII strings, respectively used to identify encryption key derivation, authentication key derivation, and counter mode; Use the client's quantum-resistant public key to encrypt the first key to obtain the first authentication tag , the formula is as follows: ; where represents the authentication tag generation function; Generate the second tamper-proof information based on the session key seed recovered by the server, the formula is as follows: ; where represents the second tamper-proof information.

[0012] Further, in S108, the calculation formula for the third signature is as follows: ; ; where represents the third signature, represents the first authentication tag; In S109, the client verifies the server's third signature, the formula is as follows: ; Use the local session key seed to verify the second tamper-proof information, the formula is as follows: ; The first key of the symmetric encryption process generated synchronously by the client is used to verify whether the first authentication tag of the server is correct, which is expressed as: .

[0013] Furthermore, the process of using symmetric encryption keys to encapsulate and transmit data is as follows: S201: After receiving the intranet communication data, the client encrypts the data using the first key to obtain a communication message ciphertext; and calculates a communication message authentication tag based on the first key, the sequence number, and the original traffic flow; S201 is specifically: ; ; in, Represents intranet communication data, Represents the original traffic, Represents the ciphertext of the communication message, represent Pattern encryption function, Represents the communication message authentication tag, The serial number is a 32-bit unsigned integer; Generate functions for authentication tags; S202: The client sends the communication message ciphertext and the communication message authentication tag to the server; S203: After receiving the encrypted data, the server first uses the first key to decrypt the communication message ciphertext; then verifies whether the HMAC is correct. If correct, the plaintext message is forwarded to the client; S203 is expressed as: ; ; in, for Pattern decryption function; is the received HMAC; S204: The server sends the communication message ciphertext and the communication message authentication tag to the client; specifically, the tunnel repeats the symmetric encryption process to transmit data; when the session key reaches the preset life cycle, the link is disconnected, the link is re-established and the key is renegotiated.

[0014] A software-defined anti-quantum tunnel communication security enhancement system is used to implement the above-mentioned software-defined anti-quantum tunnel communication security enhancement method, including a local end and a remote end, Tunnel software is deployed on both the local end and the remote end; The tunnel software includes: The message processing module communicates with the enterprise intranet in plaintext and with the public extranet in ciphertext; The remote management module communicates with the message processing module; The password module communicates with the message processing module; The access control module communicates with the message processing module.

[0015] The technical effects of the present invention are as follows:

[0016] Through a quantum-resistant tunnel architecture defined by pure software, the encryption process is implemented based on the quantum-resistant cryptographic algorithm PQC. Through modular design, full-stack softwareization is achieved, avoiding dependence on quantum-resistant chips and reducing deployment costs. Further, through tunneled non-invasive deployment, based on the client-server tunnel proxy mode, the original traffic is intercepted through the virtual network interface of the message processing module, and the service data is transparently encapsulated, supporting multi-protocol transparent transmission without modifying the original protocol. In particular, through the dual-certificate hybrid authentication mechanism, both SM2 national secret certificates and quantum-resistant certificates are used, compatible with the existing CA system and realizing the quantum security transition. In addition, through the quantum-resistant fortified remote management channel, the remote management channel and the VPN data tunnel are integrated into the same quantum-resistant communication protocol stack to ensure the same security for management instructions and data traffic. Finally, through lightweight traffic access control, the blacklist rules are preset at the entrance of the encryption tunnel to implement access traffic filtering, improving the effective utilization rate of the tunnel and the security of the intranet. Brief Description of the Drawings

[0017] Figure 1 It is a schematic diagram of the software-defined quantum-resistant tunnel communication security enhancement system of the present invention.

[0018] Figure 2 It is a flow chart of tunnel establishment and key negotiation.

[0019] Figure 3 It is a flow chart of symmetric encryption communication. Detailed Embodiments

[0020] The present invention provides a software-defined quantum-resistant tunnel communication security enhancement method and system. By introducing quantum-resistant cryptographic algorithms and modular design, a quantum-resistant tunnel architecture implemented by pure software is constructed. This architecture can achieve quantum-secure communication without relying on hardware, support non-invasive deployment, and be compatible with various business scenarios. The following combines Figures 1 to 3 to describe the detailed embodiments of the present invention in detail.

[0021] Figure 1Schematic diagram of the software-defined quantum-resistant tunnel communication security enhancement system of the present invention, showing the overall structure of the system and the interaction relationship between core modules. The system includes a local end and a remote end, and tunnel software is deployed at both ends. The tunnel software consists of a message processing module, a remote management module, a cryptographic module, and an access control module. Among them, the enterprise internal network imports the original traffic through a virtual network interface, encrypts it in the message processing module, and then transmits it to the message processing module at the remote end through the public external network. The entire communication process involves a dual-certificate authentication mechanism for national cryptographic certificates and quantum-resistant certificates, as well as dynamically updated blacklist rules to ensure the security of traffic.

[0022] During the operation of the system, it is first necessary to establish a tunnel and complete key negotiation, and then achieve real-time communication through data encapsulation and transmission. At the same time, the tunnel working mode, security policies, etc. are centrally controlled through the remote management channel. Figure 2 Shows the tunnel establishment and key negotiation process. Figure 3 Details the specific implementation steps of symmetric encryption communication.

[0023] In practical applications, assume that the headquarters of a distributed enterprise is interconnected with multiple branches through the public external network. The tunnel software of the present invention is deployed at the headquarters and each branch respectively. The original traffic is intercepted through the virtual network interface and transparently quantum-security encapsulated and transmitted. The message processing module ensures business continuity through an intelligent fragmentation and reassembly mechanism, avoiding data loss or delay problems caused by network fluctuations. For example, when device A in the enterprise internal network sends data to remote device B, the message processing module first captures the data stream, calls the cryptographic module to encrypt the data packet layer by layer, and then transmits the encrypted data to the message processing module at the remote end through the tunnel. After receiving the encrypted data, the message processing module at the remote end calls the cryptographic module to decrypt it into plaintext and finally forwards it to the corresponding device B.

[0024] As the control center of the system, the remote management module achieves the same security for instructions and data traffic through a quantum-resistant fortified management channel. The management channel derives an independent management key from the session key generated by the ML-KEM algorithm to ensure that management instructions are not tampered with or stolen during transmission. The remote management module supports functions such as setting the tunnel working mode, real-time tunnel management, and configuring tunnel security policies. For example, the headquarters administrator can query existing tunnel information, add new tunnels, or delete invalid tunnels through the remote management module. In addition, the administrator can also dynamically update the blacklist rules to cope with constantly changing network security threats. The blacklist rules are preset at the entrance of the encrypted tunnel, and the access control module matches the IP address, port number, and protocol type in the original traffic one by one to ensure that illegal traffic is blocked before entering the encrypted tunnel.

[0025] The cryptographic module provides quantum-secure cryptographic service support for the system, supporting post-quantum cryptographic algorithms and hybrid encryption modes. Inside the cryptographic module, flexible switching between multiple algorithms is achieved through modular design. For example, different parameter sets are selected from the NIST post-quantum standard algorithms to meet the requirements of different scenarios. In this embodiment, the cryptographic module uses the ML-KEM post-quantum cryptographic algorithm for data reinforcement and supports the combined use of the SM4 symmetric encryption algorithm and the post-quantum algorithm to ensure compatibility with traditional encryption methods and meet quantum security requirements during the transition period. For example, when the tunnel is established, the client and the server independently calculate the same session key seed, and then use the first key for symmetric encryption communication. During this process, the cryptographic module calls the standardized API according to the preset security policy to complete key generation, distribution, and data encryption operations.

[0026] The access control module communicates with the packet processing module. Throughout the communication process, the remote management function is implemented through a post-quantum fortified management channel to ensure the same security for management instructions and data traffic. The remote management function includes setting the tunnel working mode, real-time tunnel management, and configuring tunnel security policies. For example, an administrator can update the tunnel certificate, modify the encryption algorithm, or adjust the tunnel duration through the management channel. Real-time tunnel management supports querying existing tunnel information, adding new tunnels, or deleting invalid tunnels. Configuring tunnel security policies supports querying, adding, or deleting security rules. For example, blacklist rules can be added for specific IP addresses, port numbers, or protocol types.

[0027] The implementation methods of the remote management function include the following. The tunnel working mode setting supports the certificate update operation. The administrator sends an update instruction through the request message structure, including the version number, message ID, timestamp, operation type, and signature field. The body information includes the instruction type, parameters, and certificate data. The server returns a status code and a status description. If the update is successful, the timestamp of the new configuration's effectiveness is returned. Real-time tunnel management supports the tunnel query function. The administrator can query the tunnel ID, status, and network configuration through filtering conditions. The response data format returns the basic configuration, algorithm suite, and traffic statistics. The tunnel addition operation needs to specify the tunnel identifier, IP address pair, and algorithm suite. The tunnel deletion operation supports batch processing. The security policy configuration supports rule query, addition, or deletion operations. The administrator can dynamically update the blacklist rules through the rule type, rule ID, and target value.

[0028] A software-defined method for enhancing the security of post-quantum tunnel communication includes the following steps: Deploy tunnel software at both the local end and the remote end. The tunnel software includes a packet processing module, a remote management module, a cryptographic module, and an access control module; Establish a connection between the tunneling software on the local side and the tunneling software on the remote side. The local side calls the password module to generate a key, sends it to the remote side, and conducts tunnel establishment and key negotiation. After the tunnel establishment is completed, the local side and the remote side use the symmetric encryption key for data encapsulation and transmission; The message processing module on the local side receives the plaintext service message from the enterprise intranet, calls the password module, and encrypts the plaintext using the negotiated key. The message processing module on the local side sends the encrypted ciphertext service message to the message processing module on the remote side through the tunnel; The message processing module on the local side receives the ciphertext service message responded by the remote side, calls the password module to decrypt it into plaintext, and sends it to the corresponding device on the enterprise intranet; The message processing module on the local side receives the remote management message. The remote management message is fortified using post-quantum cryptography technology. After receiving it, the password module is called to decrypt it, and after decryption, it is sent to the remote management module for processing.

[0029] Furthermore, a client is deployed on the local side, and a server is deployed on the remote side; The specific process of tunnel establishment and key negotiation is as follows: S101: The client initiates a key negotiation request; S102: After receiving the key negotiation request, the server sends the server national cryptography certificate, the server post-quantum certificate, the first random number, and the first signature to the client; S103: After receiving the response, the client verifies the server national cryptography certificate, the server post-quantum certificate, and the first signature; if the verification passes, continue to the next step, otherwise terminate the connection; S104: The client generates a second random number, generates a client post-quantum key pair and a session key seed based on the post-quantum cryptography algorithm; encrypts the session key seed using the public key in the server post-quantum certificate to obtain the first encrypted information; calculates the hash value of the first random number and the second random number based on the SM3 cryptography algorithm to obtain the first anti-tampering information; S105: The client sends the client national cryptography certificate, the client post-quantum public key, the first encrypted information, the second random number, the first anti-tampering information, and the second signature to the server; S106: The server verifies the second signature in the client response; recovers the session key seed from the first encrypted information using the server post-quantum private key; verifies the first anti-tampering information through the SM3 cryptography algorithm, the first random number, and the second random number; S!07: The server generates the first key for the symmetric encryption process using the recovered session key seed and the first and second random numbers; encrypts the first key using the client post-quantum public key to obtain the first authentication tag; generates the second anti-tampering information based on the session key seed recovered by the server; S108: The server sends the first authentication tag, the second tamper-proof information, and the third signature to the client; S109: The client verifies the server's third signature; uses the local session key seed to verify the second tamper-proof information; the client uses the first key to verify the server's first authentication tag; If all verifications pass, both parties then hold the same first key, indicating that the encrypted channel is ready.

[0030] Further, in S102, the server's national cryptography certificate contains the server public key ; The server's quantum-resistant certificate contains the server's quantum-resistant public key ; The calculation formula for the first signature is as follows: Calculate the hash value based on the first random number : ; Generate the first signature : ; Among them, represents the first random number, represents the SM3 cryptographic algorithm; represents the timestamp; represents the server's SM2 private key; is the string concatenation operator; represents the signature generation function; The process of signature verification in S103 is expressed as: Calculate , ; Verify through ; Among them, is the recalculated hash value, is the server's SM2 public key; represents the signature verification function.

[0031] Further, S104 is specifically: The client generates a second random number , and prepares for key exchange; the client generates a client quantum-resistant key pair based on the quantum-resistant cryptographic algorithm. The client quantum-resistant key pair includes the client quantum-resistant public key and the client quantum-resistant private key , and the generation algorithm is as follows: Generate a random matrix: First, generate a random private key seed , and expand it into a public key matrix , ; Among them, Represents an extension operation; Represents the dimension domain of the matrix, each element in the matrix is a polynomial ring The polynomial on , is the modulus of the polynomial, Represents dimension, is a formal variable, is a modular polynomial, used to construct the algebraic structure of a polynomial ring; Representative Model The ring of integers, that is, all integers modulo The following collection; Generate private key vector , expressed as: ;in, express dimensional error sampling distribution, represents random sampling; Generate a public key , expressed as: ; ; Where, e is the noise vector; Obtaining a quantum-resistant public key , expressed as: ; Obtain client quantum-resistant private key , expressed as: ; Generate session key seed; Use the public key in the server's quantum-resistant certificate to encrypt the session key seed to obtain the first encrypted information ; The encryption method is as follows: Use server-side quantum-resistant public key , expand the server matrix ; ; The server's random private key seed, The server public key; Generate random vectors and error 、 , expressed as: ; ; ; in, is the univariate error sampling distribution; Calculate ciphertext components 、 ; expressed as: , ; Represents the result after encoding as a polynomial, represents the matrix transpose, Represents the session key seed; Compress to obtain the first encrypted information , expressed as: ; in, Indicates retaining the low digit of each coefficient; based on The cryptographic algorithm calculates the hash value of the first random number and the second random number to obtain the first tamper-proof information , the calculation formula is as follows: ; in, express Cryptographic algorithm.

[0032] Furthermore, the second signature in S105 is generated based on the SM2 cryptographic algorithm, and the calculation formula is as follows: ; in, represents the second signature, Indicates based on The signature operation of the cryptographic algorithm, Represents the client's quantum-resistant public key, Represents the client's quantum-resistant private key, Indicates the SM3 cryptographic algorithm, represents the first encrypted information, represents the second random number; S106 specifically includes: the server verifies whether the client signature is correct, and terminates the connection if the verification fails; specifically: Verify the second signature , expressed as: ; in, Indicates the server's quantum-resistant private key; After verification, the server-side quantum-resistant private key is used to recover the session key seed from the first encrypted information, which is expressed as: Decompress the first encrypted information , expressed as: ; in, First encrypted information Compressed ciphertext component , First encrypted information Compressed ciphertext component , Ciphertext component The decompressed result is: Ciphertext component The result after decompression; Use the server's quantum-resistant private key to decrypt the session key seed, expressed as: ; ; in, is the coding information containing noise; is the recovered session key seed; represents the decoding function, Indicates the server's quantum-resistant private key; Verify hash consistency, based on The cryptographic algorithm calculates the hash value of the first random number and the second random number. If the hash value is equal to the first tamper-proof information If they are inconsistent, it is considered tampering and the link is terminated; it is expressed as: ;in, Indicates conditional judgment.

[0033] Furthermore, S107 is specifically as follows: The server uses the recovered session key seed The first key of the symmetric encryption process is generated by the first and second random numbers , expressed as: ; ; ; ; in, is a key derivation function based on the SM3 cryptographic algorithm; It is the symmetric encryption key of the SM4 algorithm; for Authentication key for authentication tag generation function; The initialization vector for GCM mode; 、 and These are fixed ASCII strings used to identify encryption key derivation, authentication key derivation, and counter modes, respectively. Use the client's quantum-resistant public key to encrypt the first key to obtain the first authentication tag , the formula is as follows: ; in, represents the authentication tag generation function; The second tamper-proof information is generated based on the session key seed recovered by the server. The formula is as follows: ; in, Represents the second tamper-proof information.

[0034] Furthermore, in S108, the third signature calculation formula is as follows: ; ; in, On behalf of the third signature, Represents the first authentication label; In S109, the client verifies the server's third signature using the following formula: ; Using local session key seed Verify the second tamper-proof information, the formula is as follows: ; The first key of the symmetric encryption process generated synchronously by the client is used to verify whether the first authentication tag of the server is correct, which is expressed as: .

[0035] Furthermore, the process of using symmetric encryption keys to encapsulate and transmit data is as follows: S201: After receiving the intranet communication data, the client encrypts the data using the first key to obtain a communication message ciphertext; and calculates a communication message authentication tag based on the first key, the sequence number, and the original traffic flow; S201 is specifically: ; ; in, Represents intranet communication data, Represents the original traffic, Represents the ciphertext of the communication message, represent Pattern encryption function, Represents the communication message authentication tag, The serial number is a 32-bit unsigned integer; Generate functions for authentication tags; S202: The client sends the ciphertext of the communication message and the authentication tag of the communication message to the server; S203: After receiving the encrypted data, the server first decrypts the ciphertext of the communication message using the first key; next, it verifies whether the HMAC is correct. If it is correct, it forwards the plaintext message to the client; S203 is expressed as: ; ; where, is the mode decryption function; is the received HMAC; S204: The server sends the ciphertext of the communication message and the authentication tag of the communication message to the client; specifically, the tunnel repeated symmetric encryption process is used to transmit data; when the session key reaches the preset life cycle, the connection is disconnected, and a new connection is established and the key is renegotiated.

[0036] A software-defined anti-quantum tunnel communication security enhancement system for implementing the above-mentioned software-defined anti-quantum tunnel communication security enhancement method, including a local end and a remote end, The local end and the remote end are both deployed with tunnel software; The tunnel software includes: A message processing module that communicates with the enterprise intranet in plaintext and communicates with the public extranet in ciphertext; A remote management module that communicates with the message processing module; A password module that communicates with the message processing module; An access control module that communicates with the message processing module.

[0037] In summary, the present invention realizes the encryption process based on the PQC algorithm through a software-defined anti-quantum tunnel architecture, and realizes full-stack softwareization through modular design, avoiding the dependence on anti-quantum chips and reducing the deployment cost. Through tunnelized non-invasive deployment, based on the client-server tunnel proxy mode, the original traffic is intercepted through the virtual network interface of the message processing module, and the service data is transparently encapsulated, supporting multi-protocol pass-through without modifying the original protocol. Through the dual-certificate hybrid authentication mechanism, both the SM2 national secret certificate and the anti-quantum certificate are used, which is compatible with the existing CA system and realizes the quantum security transition. Through the anti-quantum fortified remote management channel, the remote management channel and the VPN data tunnel are integrated into the same anti-quantum communication protocol stack to ensure the same security of management instructions and data traffic. Through lightweight traffic access control, the blacklist rules are preset at the entrance of the encrypted tunnel to realize access traffic filtering, improving the effective utilization rate of the tunnel and the security of the intranet.

Claims

1. A software-defined method for enhancing the security of quantum-resistant tunneling communications, characterized in that: The following steps are involved: Tunnel software is deployed at both the local and remote ends, the tunnel software including a message processing module, a remote management module, a password module and an access control module; The local tunnel software establishes a link with the remote tunnel software. The local end calls the cryptographic module to generate a key and sends it to the remote end for tunnel establishment and key negotiation. After the tunnel is established, the local and remote ends use symmetric encryption keys to encapsulate and transmit data. The local message processing module receives the plaintext business message from the enterprise intranet, calls the cryptographic module, and encrypts the plaintext using the negotiated key. The local message processing module then sends the encrypted ciphertext business message to the remote message processing module through the tunnel. The local message processing module receives the encrypted business message from the remote end, calls the password module to decrypt it into plain text, and sends it to the corresponding device on the enterprise intranet; The local message processing module receives the remote management message, which is reinforced using quantum-resistant cryptography technology. After receiving it, the cryptographic module is called to decrypt it, and then the decrypted message is sent to the remote management module for processing.

2. A software-defined method for enhancing the security of quantum-resistant tunneling communications according to claim 1, characterized in that: The local end is equipped with a client, and the remote end is equipped with a server; The tunnel establishment and key negotiation process is as follows: S101: The client initiates a key negotiation request; S102: After receiving the key agreement request, the server sends the server's national encryption certificate, the server's quantum-resistant certificate, the first random number, and the first signature to the client; S103: After receiving the response, the client verifies the server's national encryption certificate, the server's quantum-resistant certificate, and the first signature; if the verification passes, the client proceeds to the next step; otherwise, the connection is terminated; S104: The client generates a second random number and generates a client quantum-resistant key pair and a session key seed based on a quantum-resistant cryptographic algorithm; encrypts the session key seed using the public key in the server quantum-resistant certificate to obtain first encrypted information; and calculates a hash value of the first random number and the second random number based on the SM3 cryptographic algorithm to obtain first tamper-proof information. S105: The client sends the client's national encryption certificate, the client's quantum-resistant public key, the first encrypted information, the second random number, the first tamper-proof information, and the second signature to the server; S106: The server verifies the second signature in the client response; recovers the session key seed from the first encrypted information using the server's quantum-resistant private key; and verifies the first tamper-proof information using the SM3 cryptographic algorithm, the first random number, and the second random number. S107: The server generates a first key for a symmetric encryption process using the recovered session key seed and the first and second random numbers; Encrypt the first key using the client's quantum-resistant public key to obtain a first authentication tag; Generate second tamper-proof information based on the session key seed recovered by the server; S108: The server sends the first authentication tag, the second tamper-proof information, and the third signature to the client; S109: The client verifies the third signature of the server; uses the local session key seed to verify the second tamper-proof information; the client verifies the first authentication tag of the server using the first key; If all verifications pass, both parties now hold the same first key, indicating that the encryption channel is ready.

3. A software-defined method for enhancing the security of quantum-resistant tunneling communication according to claim 2, characterized in that: In S102, the server's national secret certificate contains the server Public Key ; The server-side quantum-resistant certificate contains the server-side quantum-resistant public key ; The first signature calculation formula is as follows: Calculate a hash value based on the first random number : ; Generate the first signature : ; in, represents the first random number, Represents the SM3 cryptographic algorithm; Represents a timestamp; Represents the server SM2 private key; is the string concatenation operator; Represents the signature generation function; The signature verification process in S103 is represented as follows: calculate , ; pass Conduct verification; in, is the recalculated hash value, The server SM2 public key; Represents a signature verification function.

4. A software-defined method for enhancing the security of quantum-resistant tunneling communications according to claim 3, characterized in that: S104 is specifically: The client generates a second random number , prepare for key exchange; the client generates a client quantum-resistant key pair based on the quantum-resistant cryptographic algorithm, and the client quantum-resistant key pair includes the client quantum-resistant public key and client-side quantum-resistant private keys , the generation algorithm is as follows: Generate a random matrix: First generate a random private key seed , expanded to the public key matrix , ; in, Represents an extension operation; Represents the dimension domain of the matrix, each element in the matrix is a polynomial ring The polynomial on , is the modulus of the polynomial, Represents the dimension, is a formal variable, is a modular polynomial, used to construct the algebraic structure of a polynomial ring; Representative Model The ring of integers, that is, all integers modulo The following collection; Generate private key vector , expressed as: ;in, express dimensional error sampling distribution, represents random sampling; Generate a public key , expressed as: ； ； Where, e is the noise vector; Obtaining a quantum-resistant public key , expressed as: ； Obtain client quantum-resistant private key , expressed as: ； Generate session key seed; Use the public key in the server's quantum-resistant certificate to encrypt the session key seed to obtain the first encrypted information ; The encryption method is as follows: Use server-side quantum-resistant public key , expand the server matrix ; ; The server's random private key seed, The server public key; Generate a random vector and error 、 , expressed as: ； ； ； in, is the univariate error sampling distribution; Calculate ciphertext components 、 ; expressed as: , ; Represents the result after encoding as a polynomial, represents the matrix transpose, Represents the session key seed; Compress to obtain the first encrypted information , expressed as: ； in, Indicates retaining the low digit of each coefficient; based on The cryptographic algorithm calculates the hash value of the first random number and the second random number to obtain the first tamper-proof information , the calculation formula is as follows: ； in, express Cryptographic algorithm.

5. A software-defined method for enhancing the security of quantum-resistant tunneling communications according to claim 4, characterized in that: The second signature in S105 is generated based on the SM2 cryptographic algorithm and is calculated as follows: ； in, represents the second signature, Indicates based on The signature operation of the cryptographic algorithm, Represents the client's quantum-resistant public key, Represents the client's quantum-resistant private key, Indicates the SM3 cryptographic algorithm, represents the first encrypted information, represents the second random number; S106 specifically includes: the server verifies whether the client signature is correct, and terminates the connection if the verification fails; specifically: Verify the second signature , expressed as: ;in, Indicates the server's quantum-resistant private key; After verification, the server-side quantum-resistant private key is used to recover the session key seed from the first encrypted information, which is expressed as: Decompress the first encrypted information , expressed as: ； in, First encrypted information Compressed ciphertext component , First encrypted information Compressed ciphertext component , Ciphertext component The decompressed result is Ciphertext component The result after decompression; Use the server's quantum-resistant private key to decrypt the session key seed, expressed as: ； ； in, is the coding information containing noise; is the recovered session key seed; represents the decoding function, Indicates the server's quantum-resistant private key; Verify hash consistency, based on The cryptographic algorithm calculates the hash value of the first random number and the second random number. If the hash value is equal to the first tamper-proof information If they are inconsistent, it is considered tampering and the link is terminated; it is expressed as: ;in, Indicates conditional judgment.

6. A software-defined method for enhancing the security of quantum-resistant tunneling communications according to claim 5, characterized in that: S107 is specifically: The server uses the recovered session key seed The first key of the symmetric encryption process is generated by the first and second random numbers , expressed as: ； ； ； ； in, is a key derivation function based on the SM3 cryptographic algorithm; It is the symmetric encryption key of the SM4 algorithm; for Authentication key for authentication tag generation function; The initialization vector for GCM mode; 、 and These are fixed ASCII strings used to identify encryption key derivation, authentication key derivation, and counter modes, respectively. Use the client's quantum-resistant public key to encrypt the first key to obtain the first authentication tag , the formula is as follows: ； in, represents the authentication tag generation function; The second tamper-proof information is generated based on the session key seed recovered by the server. The formula is as follows: ； in, Represents the second tamper-proof information.

7. A software-defined method for enhancing the security of quantum-resistant tunneling communications according to claim 6, characterized in that: In S108, the third signature calculation formula is as follows: ； ； in, On behalf of the third signature, Represents the first authentication label; In S109, the client verifies the server's third signature using the following formula: ； Using local session key seed Verify the second tamper-proof information, the formula is as follows: ； The first key of the symmetric encryption process generated synchronously by the client is used to verify whether the first authentication tag of the server is correct, which is expressed as: 。 8. The method for enhancing security of quantum-resistant tunneling communication based on software definition according to claim 7, characterized in that: The specific process of data encapsulation and transmission using symmetric encryption keys is as follows: S201: After receiving the intranet communication data, the client encrypts the data using the first key to obtain a communication message ciphertext; and calculates a communication message authentication tag based on the first key, the sequence number, and the original traffic flow; S201 is specifically: ； ； in, Represents intranet communication data, Represents the original traffic, Represents the ciphertext of the communication message, represent Pattern encryption function, Represents the communication message authentication tag, The serial number is a 32-bit unsigned integer; Generate functions for authentication tags; S202: The client sends the communication message ciphertext and the communication message authentication tag to the server; S203: After receiving the encrypted data, the server first uses the first key to decrypt the communication message ciphertext; then verifies whether the HMAC is correct. If correct, the plaintext message is forwarded to the client; S203 is expressed as: ； ； in, for Pattern decryption function; is the received HMAC; S204: The server sends the communication message ciphertext and the communication message authentication tag to the client; specifically, the tunnel repeats the symmetric encryption process to transmit data; when the session key reaches the preset life cycle, the link is disconnected, the link is re-established and the key is renegotiated.

9. A software-defined anti-quantum tunneling communication security enhancement system, used to implement a software-defined anti-quantum tunneling communication security enhancement method according to any one of claims 1 to 8, comprising a local end and a remote end, characterized in that: Tunnel software is deployed on both the local end and the remote end; The tunnel software includes: The message processing module communicates with the enterprise intranet via plain text and with the public extranet via encrypted text; a remote management module, communicating with the message processing module; A cryptographic module, communicating with the message processing module; An access control module communicates with the message processing module.

Images