Anti-quantum migration method and system, electronic device, and storage medium

Abstract

The application relates to an anti-quantum password migration method, system, electronic equipment and storage medium, and belongs to the technical field of anti-quantum data transmission. The method comprises the following steps: adaptively extending a transmission layer security protocol; and performing secure transmission of application data by an encryption end and a decryption end based on the extended transmission layer security protocol, wherein the secure transmission process of the application data comprises the following steps: respectively generating a master key, a multi-level sub-key and a path key chain based on an extended password suite according to a chained post-quantum key generation mechanism; generating an encryption key by the encryption end using part of the sub-key, encrypting the application data in a symmetric encryption mode to generate ciphertext, and sending the ciphertext and a path node key at the end of the path key chain to the decryption end; verifying the path node key by the decryption end, generating a decryption key by the decryption end using part of the sub-key after the path node key is verified, and decrypting the ciphertext. The application realizes the security and high efficiency of data transmission in the anti-quantum password migration process.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of anti-quantum data transmission technology, in particular to an anti-quantum password migration method and system, an electronic device and a storage medium. BACKGROUND

[0002] In recent years, quantum computing based on quantum mechanics has developed rapidly, and the industry has realized a thousand quantum bit level processor. With the popularization of commercial quantum computers, the encryption system in existing data transmission has been threatened as never before. According to the research of the National Institute of Standards and Technology (NIST), a quantum computer can break the RSA, ECC (Elliptic Curve Cryptography) and other traditional public key cryptography systems in polynomial time through the Shor algorithm; the Grover algorithm can halve the effective key strength of symmetric encryption (such as AES-128).

[0003] Under this background, anti-quantum technology has emerged. Anti-quantum technology mainly includes two types: post-quantum cryptography (PQC) and quantum key distribution (QKD). Among them, PQC is an anti-quantum cryptographic algorithm based on mathematical problems (such as lattice cryptography, hash signature), mainly including lattice-based PQC such as Kyber, Falcon, NTRU, etc.; encoding-based PQC such as Classic McEliece; multivariate-based PQC such as Rainbow; hash-based PQC such as SPHINCS+, XMSS, etc., and digital signature algorithm Dilithium. However, in order to achieve anti-quantum, the current PQC algorithm generally has problems such as large key size (such as Kyber public key up to 1.5KB), low calculation efficiency (for example, the signature speed is 10 times slower than RSA), etc., which is difficult to meet the real-time, high-speed transmission requirements of data in most fields.

[0004] QKD is based on the principle of quantum non-cloning to achieve the secure transmission of unconditional keys, but QKD relies on special optical fiber channels, and the transmission distance is limited (star-ground link needs to be relayed and expanded), and cannot cover large-scale network scenarios.

[0005] Therefore, in the prior art, there are still many difficulties in the password migration process from the traditional password system to the anti-quantum password system. SUMMARY

[0006] In view of the technical problems in the prior art, the present application provides an anti-quantum password migration method, system, electronic device and storage medium, which realizes the security of data and the efficiency of transmission in the anti-quantum password migration process through multi-layer cascading key rotation.

[0007] In order to achieve the above technical problems, according to one aspect of the present application, the present application provides an anti-quantum password migration method, comprising the following steps:

[0008] The transport layer security protocol is adaptively extended, and the extension content at least includes: adding an anti-quantum password suite in a password suite list; and adding, in an encryption extension item, a chained post-quantum key generation mechanism, a multi-layer cascading key rotation protocol, a key derivation application data based on a multi-layer cascading key to generate an encryption / decryption key, path key chain verification, and symmetric encryption of application data.

[0009] The encryption end and the decryption end perform secure transmission of application data based on the extended transport layer security protocol, wherein the secure transmission process of the application data comprises:

[0010] The encryption end and the decryption end respectively generate a master key, a multi-level sub-key and a path key chain based on the extended password suite according to the chained post-quantum key generation mechanism.

[0011] The encryption end derives an encryption key for symmetric encryption by taking one or more of the partial sub-keys as key material, encrypts the application data in a symmetric encryption mode to generate ciphertext, and sends the ciphertext and the path node key at the end of the path key chain to the decryption end.

[0012] The decryption end verifies the path node key received with the ciphertext, and after the verification of the path node key is passed, derives a decryption key by taking one or more of the partial sub-keys as key material, and decrypts the ciphertext; and

[0013] The encryption end and the decryption end update the multi-layer cascading key based on the multi-layer cascading key rotation protocol.

[0014] Optionally, the content of symmetric encryption of application data added in the encryption extension item further includes an encryption mode.

[0015] Correspondingly, when message authentication is included in the encryption mode, in the secure transmission process of application data based on the extended transport layer security protocol, after the encryption end encrypts the application data in a symmetric encryption mode to generate ciphertext, the encryption end generates an authentication tag of the ciphertext based on one or more of another part of the sub-key.

[0016] After the decryption end verifies the path node key received together with the ciphertext, the authentication tag is verified, and after the authentication tag verification, one or more of the partial sub-keys are used as key material to derive the decryption key, and the ciphertext is decrypted.

[0017] Optionally, the step of generating the master key, the multi-level sub-key and the path key chain based on the extended cipher suite respectively comprises:

[0018] The encryption end and the decryption end determine the shared key based on the extended transport layer security protocol through key agreement;

[0019] The encryption end and the decryption end generate the anti-quantum master key based on the shared key through the PT hash algorithm constructed by the quantum random circuit in the anti-quantum cipher suite respectively;

[0020] The encryption end and the decryption end generate the multi-level sub-key based on the master key respectively, wherein the initial value of each level of sub-key is generated according to the master key and / or one or more sub-key initial values of the upper level;

[0021] The encryption end and the decryption end construct the path key chain respectively, and generate the initial path node key of the path key chain based on the master key and / or one or more sub-key initial values.

[0022] Optionally, the step of updating the multi-layer cascading key based on the multi-layer cascading key rotation protocol by the encryption end and the decryption end comprises:

[0023] During the update period of the master key, when one or more of the partial sub-keys are used as key material to derive the encryption / decryption key for symmetric encryption, one or more sub-keys used to derive the encryption / decryption key are updated; when the life of the sub-key reaches the preset life cycle length, the sub-key is updated; when the update number of the second sub-key associated with the first sub-key reaches the threshold, the first sub-key is updated;

[0024] When the life of the master key reaches the preset life cycle length, the master key is updated, and after the master key is updated, the multi-level new sub-key and the new path key chain are generated based on the updated master key.

[0025] Optionally, the step of updating the multi-layer cascading key based on the multi-layer cascading key rotation protocol by the encryption end and the decryption end further comprises:

[0026] After any sub-key is updated, a new path node key is generated based on the path node key at the end of the path key chain and at least all the currently updated sub-keys, and is added to the end of the path key chain;

[0027] When the master key is updated, a new path node key of a new path key chain is generated based on the updated master key and / or one or more new sub-key initial values after generating the new sub-keys of multiple levels based on the updated master key.

[0028] Optionally, the extension of the adaptation of the transport layer security protocol further includes a rollback mechanism, and the secure transmission process of the application data further includes:

[0029] Monitoring key security events;

[0030] Determining a corresponding first key algorithm component based on the monitored key security events and uninstalling the first key algorithm component;

[0031] Determining a second key algorithm component of a secure version of the first key algorithm component from a component center; wherein the component center provides a plurality of encryption algorithm components, related key algorithm components and signature algorithm components;

[0032] Loading the second key algorithm component of the secure version from the component center;

[0033] Removing the uninstalled first key algorithm information from the cipher suite list and adding the loaded second key algorithm information; and

[0034] Generating a new multi-level cascade key based on the updated cipher suite according to the chained post-quantum key generation mechanism and freezing the original multi-level cascade key, wherein the application data is transmitted based on the new multi-level cascade key and the historical application data is decrypted based on the original multi-level cascade key.

[0035] According to another aspect of the present application, the present application also provides an anti-quantum cryptography migration system, comprising:

[0036] A protocol adaptation module configured to adaptively extend the transport layer security protocol of the data, and the extension content at least includes: adding an anti-quantum cipher suite in a cipher suite list; and adding a chained post-quantum key generation mechanism, a multi-level cascade key rotation protocol, a derivation of an application data encryption / decryption key based on a multi-level cascade key, a path key chain verification and a symmetric encryption of the application data in an encryption extension item;

[0037] A data transmission module configured to perform secure transmission of the application data between an encryption end and a decryption end based on the extended transport layer security protocol, wherein the secure transmission process of the application data includes:

[0038] The encryption end and the decryption end respectively generate a master key, a multi-level sub-key and a path key chain according to the chained post-quantum key generation mechanism based on the extended cipher suite;

[0039] The encryption end derives an encryption key for symmetric encryption using one or more of the partial sub-keys as key material, encrypts the application data in a symmetric encryption manner to generate ciphertext, and sends the ciphertext and the path node key at the end of the path key chain to the decryption end;

[0040] The decryption end verifies the path node key received together with the ciphertext, derives a decryption key using one or more of the partial sub-keys as key material after successful verification of the path node key, and decrypts the ciphertext; and

[0041] The encryption end and the decryption end update the multi-layer cascaded key based on the multi-layer cascaded key rotation protocol.

[0042] Optionally, when the transport layer security protocol is adaptively extended, the extension content further includes a rollback mechanism, and the system further includes a security rollback module configured to monitor a key security event, roll back to a secure version of a key algorithm after monitoring the key security event, and regenerate a multi-layer cascaded key based on the secure version of the key algorithm, freeze an original multi-layer cascaded key, wherein application data is transmitted based on the new multi-layer cascaded key, and historical application data is decrypted based on the original multi-layer cascaded key.

[0043] According to another aspect of the present application, the present application also provides an electronic device including a processor and a memory, the memory storing computer instructions, the processor executing the computer instructions to perform the aforementioned anti-quantum password migration method.

[0044] According to another aspect of the present application, the present application also provides a computer readable storage medium storing computer instructions, the computer instructions being executed by a processor to perform the aforementioned anti-quantum password migration method.

[0045] Based on the lock chain type post-quantum key generation mechanism and the anti-quantum multi-layer cascaded key rotation protocol, the present application constructs a multi-layer cascaded key and related communication mode, reduces the size of the key, realizes anti-quantum encryption / decryption, and realizes efficient and secure transmission of data. BRIEF DESCRIPTION OF DRAWINGS

[0046] Hereinafter, preferred embodiments of the present application will be described in further detail with reference to the accompanying drawings, in which:

[0047] Figure 1 is a flowchart of an anti-quantum password migration method according to an embodiment of the present application;

[0048] Figure 2 is a flowchart of a method for secure transmission of application data by the encryption end and the decryption end based on the extended transport layer security protocol according to an embodiment of the present application;

[0049] Figure 3 is a flow chart of a method for determining a shared key according to an embodiment of the present application;

[0050] Figure 4 is a flow chart of a method for generating a multi-layer concatenated key according to an embodiment of the present application;

[0051] Figure 5 is a schematic diagram of a quantum random circuit structure according to an embodiment of the present application;

[0052] Figure 6 is a flow chart of a method for generating a quantum-resistant master key based on a shared key through a PT Hash algorithm constructed by a quantum random circuit according to an embodiment of the present application;

[0053] Figure 7 is a schematic diagram of an evolution process of a path key chain according to an embodiment of the present application;

[0054] Figure 8 is a schematic diagram of a quantum-resistant password migration system according to an embodiment of the present application; and

[0055] Figure 9 is a schematic diagram of a structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0056] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0057] In the following detailed description, reference can be made to the various drawings that form a part of the present disclosure and are used to illustrate specific embodiments of the present application. In the drawings, like numerals describe substantially similar components throughout the several views. Various specific embodiments of the present application are described in sufficient detail below to enable one of ordinary skill in the relevant art to practice the subject matter of the present application. It should be understood that other embodiments can be utilized and structural, logical, and electrical changes can be made without departing from the scope of the present application.

[0058] The present application provides an anti-quantum password migration method to cope with the threat of quantum computing to the encryption system in the current data transmission process. The anti-quantum multi-layer cascade key rotation protocol (Multi-Layer Rotation Protocol, MLR Protocol) is used to generate an anti-quantum multi-layer cascade key through a lock chain post-quantum key generation mechanism (Locks Chain Post-Quantum Key Generation Mechanism, LocksChainPQ). The key size is small, and the key calculation efficiency is high. The anti-quantum encryption and decryption is realized, and the forward security and backward security of data transmission are ensured.

[0059] Referring to Figure 1 , Figure 1 is an anti-quantum password migration method flowchart according to an embodiment of the present application. The anti-quantum password migration method comprises the following steps:

[0060] Step S10, the transport layer security protocol is adaptively extended. The extension content at least includes: adding an anti-quantum password suite in the password suite list; adding the following in the encryption extension item: lock chain post-quantum key generation mechanism, multi-layer cascade key rotation protocol, application data encryption / decryption key derived based on the multi-layer cascade key, path key chain verification, and symmetric encryption of application data.

[0061] Step S20, the encryption end and the decryption end perform secure transmission of application data based on the extended transport layer security protocol.

[0062] The transport layer security protocol applied in data transmission usually includes a password suite (Cipher Suites) list and an encryption extension item. The security protocol is, for example, TSSL / TLS (Secure Sockets Layer / Transport Layer Security), SSH (Secue Shell), S / MIME (Secure / Multipurpose Internet Mail Extensions), blockchain, etc. Taking TLS 1.3 as an example, the password suite list is as follows:

[0063] TLS_AES_256_GCM_SHA384

[0064] TLS_CHACHA20_POLY1305_SHA256

[0065] TLS_AES_128_GCM_SHA256

[0066] TLS_AES_128_CCM_8_SHA256

[0067] TLS_AES_128_CCM_SHA256

[0068] ...

[0069] In order to realize the anti-quantum password migration, the application adds an anti-quantum password suite in the password suite list, for example:

[0070] PTHash_Kyber_SPHINCS+_PTHash_AES_256_GCM

[0071] PTHash_SM3_Kyber_XMSS_AES_256

[0072] SM3_SHA3_512_CRYSTALS-KEM_PTHash_AES_256_GCM

[0073] ...

[0074] The following extensions are added in the encryption extension item of TLS 1.3:

[0075] Chain type post-quantum key generation mechanism;

[0076] Multi-layer cascading key rotation protocol;

[0077] Based on the multi-layer cascading key derivation application data encryption / decryption key;

[0078] Path key chain verification;

[0079] Symmetric encryption of application data.

[0080] Through the above adaptation extension of the transport layer security protocol, when data transmission is performed at both ends of the communication system (hereinafter referred to as an anti-quantum password migration system) to which the anti-quantum password migration method is applied, such as a client and a server, a multi-layer cascading key is generated by using an anti-quantum password suite according to the chain type post-quantum key generation mechanism, in the transmission of application data after the handshake, an encryption key is derived based on the multi-layer cascading key, and the application data is encrypted in a symmetric encryption manner, and path key chain verification is required before decryption, and only after the verification is passed can the decryption be performed. In order to facilitate the description, the encryption end and the decryption end in the anti-quantum password migration system are expressed as two ends, which can be a client and a server that provide some services, or two user ends.

[0081] The chained post-quantum key generation mechanism provides a post-quantum key generation specification, including key level, sub-key number, applied key algorithm, path node key calculation method and the like.

[0082] Specifically, referring to Figure 2 , Figure 2 is a method flowchart for secure transmission of application data by the encryption end and the decryption end based on the extended transport layer security protocol according to an embodiment of the present application, and the method for secure transmission of application data comprises the following steps:

[0083] Step S21, the encryption end and the decryption end perform key negotiation based on the extended transport layer security protocol to determine a shared key.

[0084] Step S221, the encryption end generates a multi-layer cascaded key of the encryption end with the shared key as key material, including a master key, multiple sub-keys and a path key chain.

[0085] Step S231, the decryption end generates a multi-layer cascaded key of the decryption end with the shared key as key material, including a master key, multiple sub-keys and a path key chain.

[0086] When the encryption end receives a data transmission request, the following steps are performed:

[0087] Step S222, the encryption end derives an encryption key for symmetric encryption with one or more of the partial sub-keys as key material.

[0088] Step S223, the application data is encrypted in a symmetric encryption manner to generate ciphertext.

[0089] Step S224, the ciphertext and the path node key at the end of the path key chain are sent to the decryption end.

[0090] Step S225, the key is updated, wherein at least one or more of the multiple sub-keys used to generate the encryption key is updated.

[0091] Step S232, the decryption end verifies the path node key received together with the ciphertext.

[0092] If the verification of the path node key fails, in step S233, a path verification failure message is sent to the encryption end.

[0093] If the verification of the path node key passes, in step S234, a decryption key is derived with one or more of the partial sub-keys as key material.

[0094] Step S235, decrypting the ciphertext.

[0095] Step S236, sending a message of successful decryption to the encryption end.

[0096] Step S237, updating the key. At least one or more of the multiple sub-keys used to generate the decryption key is updated.

[0097] Referring to Figure 3 , Figure 3 is a flowchart of a method for determining a shared key according to an embodiment of the present application. In this embodiment, the steps of determining a shared key by the encryption end and the decryption end based on the expanded transport layer security protocol through key agreement include:

[0098] Step S210, initializing a key pair to obtain an RSA key pair and a post-quantum key pair. For example, an RSA key pair is obtained based on an RSA (such as Elliptic Curve Diffie-Hellman) component, including a private key d and a public key Q, where the public key Q = d • G, and G represents a base point and • represents a multiplication relationship.

[0099] A post-quantum key pair is obtained based on a CRYSTALS-KEM post-quantum component, including a secret vector r and a public key vector b. Specifically, a secret vector r and a public key matrix A are selected, and the public key vector b is calculated based on formula (1-1).

[0100] b = A • r + e (1-1)

[0101] where e represents an error vector.

[0102] Step S211, generating a first shared key S1 and a second shared key S2, respectively.

[0103] The first shared key S1 is calculated based on formula (1-2) according to the RSA key pair.

[0104] S1 = d A • Q B (1-2)

[0105] where A and B represent the encryption end and the decryption end, respectively, d A is the private key of the encryption end, Q B is the public key of the decryption end. S1 is the shared key calculated by the encryption end, and the shared key calculated by the decryption end is the same as the shared key calculated by the encryption end, i.e., S1 = d A • Q B = d B • Q A = d A • d B • G.

[0106] According to the post-quantum key pair, the second shared key S2 is calculated based on formula (1-3).

[0107] S2 = H(b T •r+d) (1-3)

[0108] Wherein, H represents a hash operation, d represents an error vector, b T represents the transpose of the public key vector b.

[0109] Step S212, the first shared key S1 and the second shared key S2 are calculated to obtain the shared key S. For example, the first shared key S1 and the second shared key S2 are spliced according to formula (1-4) to obtain the shared key S.

[0110] S = S1 || S2 (1-4)

[0111] In this embodiment, the data transmission channel type is a hybrid type, so the first shared key S1 is obtained by using a traditional encryption algorithm, the second shared key S2 is obtained by using a quantum-resistant encryption algorithm, and then the two shared keys are spliced by using formula (1-4), and the splicing result is used as the shared key S for generating the master key. However, it can be known that if the data transmission channel type is a traditional type, the first shared key S1 can be used as the key material for generating the master key, and if the data transmission channel type is a post-quantum type, the second shared key S2 can be used as the key material for generating the master key.

[0112] The encryption end and the decryption end generate the multi-layer cascaded key based on the extended password suite and the shared key as the key material according to the multi-layer cascaded key rotation protocol, and the method is the same, see Figure 4 , Figure 4 is a flow chart of a method for generating a multi-layer cascaded key according to an embodiment of the application, and in this embodiment, the encryption end is taken as an example. The method for generating the multi-layer cascaded key comprises the following steps:

[0113] Step S31, a quantum random circuit is constructed, which acts on a plurality of quantum bits arranged in order from low to high. For each quantum bit, a plurality of rotation quantum gates and entanglement quantum gates are arranged in turn, and the control bits and target bits of the plurality of entanglement quantum gates act on each quantum bit in a cyclic shift manner.

[0114] Step S32, an anti-quantum master key is generated by a PT hash function (PTHash for short) algorithm component constructed by the quantum random circuit based on the obtained shared key.

[0115] Step S33, generating multi-level sub-key initial values based on the master key, wherein the initial value of each sub-key is generated according to the master key and / or one or more sub-key initial values of the upper level.

[0116] Step S34, constructing a path key chain. Wherein, the initial value of the path node key of the path key chain is generated based on the master key and the initial value of all multi-level sub-keys.

[0117] Referring to Figure 5 , Figure 5 is a schematic diagram of the principle of a quantum random circuit structure according to an embodiment of the present application. For the convenience of description, a quantum random circuit with 4 quantum bits is taken as an example, the quantum random circuit includes 4 sub-circuits, each sub-circuit acts on one quantum bit, each sub-circuit sequentially arranges multiple parameterized rotation quantum gates and entanglement quantum gates from left to right, as shown in the figure, from left to right are Rx gate, Ry gate, Rz gate, then continue to be Rx gate and Ry gate, and then is CNOT gate. The CNOT gate is an entanglement quantum gate acting on two quantum bits, the control bit and the target bit of multiple CNOT gates act on each quantum bit in a cyclic shift manner. For example, when the difference between the number of bits of the control bit and the target bit acting on each quantum bit is 1, the control bit of the first CNOT gate is q0, the target bit is q1, the control bit of the second CNOT gate is q1, the target bit is q2, the control bit of the third CNOT gate is q2, the target bit is q3, the control bit of the fourth CNOT gate is q3, and the target bit is q0. When the difference between the number of bits of the control bit and the target bit is 2, the control bit of the first CNOT gate is q0, the target bit is q2, the control bit of the second CNOT gate is q1, the target bit is q3, the control bit of the third CNOT gate is q2, the target bit is q0, the control bit of the fourth CNOT gate is q3, and the target bit is q1. The cycle is set in this way. The parameter of each parameterized rotation quantum gate is the rotation angle θ, and the principal value range is 0≤θ<2π. The present application constructs an anti-quantum hash algorithm based on a quantum random circuit, which is referred to as PT hash function or PT Hash algorithm in the present application.

[0118] Wherein, referring to Figure 6 , Figure 6 is a method flow chart for generating an anti-quantum master key based on a shared key through a PT Hash algorithm (referred to as PT Hash) constructed by a quantum random circuit according to an embodiment of the present application, the method includes the following steps:

[0119] Step 321, the key material is processed to obtain the parameter value of the quantum random circuit. In one specific embodiment, a key string is obtained based on HKDF (HMAC-based Extract-and-Expand Key Derivation Function), and the HKDF algorithm includes two calculation processes.

[0120] First, a random number PRK is obtained by performing an extraction operation (HKDF-Extract) on the key material according to the following formula (2-1):

[0121] PRK = HMAC (salt, IKM) (2-1)

[0122] Wherein, the salt is a salt value, which can be None, and the IKM is the key material, which in this embodiment is the shared key S mentioned above.

[0123] Then, a key string OKM (output keying material) is obtained by performing an expansion operation (HKDF-Expand) according to the following formula (2-2):

[0124] OKM = HMAC (PRK, inf || counter) (2-2)

[0125] The inf is a random vector, which can be empty, and the counter is a counter.

[0126] In another embodiment, the shared key S can also be directly used as the key string and processed as follows.

[0127] The key string OKM is encoded into a byte sequence according to a certain encoding rule. In one embodiment, the key string is encoded into a byte sequence B using the UTF-8 (8-bit, Universal Character Set / Unicode Transformation Format) encoding rule, B = {b0, b1, …, b i ,…,b L}, b iLet L = {0, 1, ..., 255}, where L is the total number of bytes in the byte sequence. The preferred value of L is an integer multiple of the total number of qubits used by the quantum random circuit. When the total number of bytes L is an integer multiple N (N≥1) of the total number of qubits used by the quantum random circuit, the byte sequence B is sequentially divided into N groups to obtain N subsequences. If the total number of bytes L is not an integer multiple of the total number of qubits used by the quantum random circuit, for example, an integer multiple N with a remainder of M bytes, then the byte sequence B is sequentially divided into N+1 groups. The first N subsequences have the same number of bytes as the total number of qubits, and the N+1th subsequence includes M bytes.

[0128] Then, based on the normalization function formula (2-3), the rotation angle θ of the rotating gate acting on the corresponding qubit is calculated for each byte.

[0129] (2-3)

[0130] Based on byte b i The rotation angle of the quantum gate Rk acting on the i-th qubit is calculated, where k represents the quantum gates Rx, Ry, and Rz for x, y, and z, respectively; λx, λy, and λz are three pairwise distinct constants. In one embodiment, λx, λy, and λz are three phase seeds in the Porter-Thomas distribution, with λx=0, λy=85, and λz=170.

[0131] When the byte sequence B is divided into multiple subsequences, the byte b described in formula (2-3) i It is the byte sequence number in a subsequence.

[0132] Step S322: Assign the parameter values ​​to the parameterized rotating quantum gate respectively. Assign byte b from the byte sequence... i Mapped to qubit q in a quantum random circuit i , will be based on byte b i The calculated rotation angle of the Rk quantum gate is assigned to the Rx, Ry, and Rz gates acting on the i-th qubit in the quantum random circuit.

[0133] Step S323: Run the quantum circuit and perform a final state measurement to obtain the measurement result. The final state measurement result of the quantum random circuit is an R-bit sequence m consisting of 0s and 1s, as expressed in expression (2-4).

[0134] m=(m1,m2,…,m R (2-4)

[0135] Where m∈{0,1}^R.

[0136] When the byte sequence B is divided into multiple subsequences, steps S322 and S323 are performed for each subsequence to obtain a measurement result corresponding to each subsequence, and then the corresponding measurement results are spliced together in the order of the division of the subsequences to obtain the final measurement result. If the total number of bytes in the subsequence is less than the total number of qubits in the quantum random circuit, when the final state of all qubits is measured, the measurement data corresponding to the qubits not used is deleted; or only the final state of the used qubits is measured.

[0137] Step S324, convert the measurement result into a string of the preset symbol coding system. Specifically, first truncate or fold the measurement result to a fixed length. If the number of bits R of the sequence m is greater than the number of bits J of the string of the preset symbol coding system, the first J bits of the sequence m are truncated to obtain a sequence m (J) . Alternatively, the sequence m is folded once according to formula (2-5) to obtain a sequence m (J) .

[0138] (2-5)

[0139] If the number of bits R of the sequence m is less than the number of bits J of the string of the preset symbol coding system, continue to trigger the quantum random circuit to run and perform the final state measurement, and splice the sequence corresponding to the measurement result and the sequence corresponding to the last measurement result together until the number of bits R of the spliced sequence is greater than or equal to the number of bits J of the string of the preset symbol coding system. At this time, the sequence m (J) is the quantum entropy preimage.

[0140] Then perform hexadecimal encoding. Specifically, first group the sequence m (J) according to 4 bits each to obtain formula (2-6).

[0141] (m0, m1, m2, m3) (m4, m5, m6, m7) … … (2-6)

[0142] Convert each 4 bits to an integer v j according to formula (2-7).

[0143] (2-7)

[0144] wherein, .

[0145] Then map v j to c j using the hexadecimal table {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, a, b, c, d, e, f}.

[0146] Reordering c j , and thus a string C, C=( c0, c1, …, c j , …, c (J / 4-1) ) is obtained, and the string C is a true random number conforming to a PT distribution. As can be seen from the foregoing description, when an input string (such as the key material described above) is calculated by a quantum random circuit, a true random number is obtained, that is, the present application constructs a function by a quantum random circuit, and the calculation result of the function is a true random number conforming to a PT distribution. In the present application, the function constructed by the quantum random circuit is referred to as a PT hash function or a PT Hash function, the corresponding algorithm is referred to as a PT Hash algorithm, and a component implementing the PT Hash algorithm is referred to as a PT Hash algorithm component.

[0147] In an embodiment, the string C is taken as a master key, or the first preset number of characters in the string C is taken as a master key. The foregoing process is simplified as the following calculation formula (2-8).

[0148] Kmaster=PTHash(IKM) (2-8)

[0149] , wherein the IKM is a key material.

[0150] In another embodiment, a key derivation function MKDF can also be derived from the string C, and a derived key is taken as a master key. For example, based on the multi-layer rotation protocol (MLR) and the lock chain post-quantum key generation mechanism (Locks Chain PQ) provided by the present application, a key derivation function MKDF is proposed.

[0151] The MKDF algorithm component includes two calculation processes. The first process is to derive a true random key conforming to a cryptographic strength based on a key material IKM, which can be an authentication code of the key material IKM. The other process changes the length of the true random key calculated by the first process. Specifically,

[0152] First, the key material is subjected to an extraction operation (LocksChainPQ-Extract) by the following formula (2-9) to obtain a true random number RRK:

[0153] RRK= LocksChainPQ (C, O)

[0154] = PT Hash (C 0 opad || PT Hash (C 0 ipad || O)) (2-9)

[0155] wherein C is a string, O is additional information; ipad (inner padding) represents internal padding, which is a byte sequence of the same size as the string C; opad (outer padding) represents external padding, which is another byte sequence of the same size as the string C; 0 represents bitwise XOR operation; || represents concatenation (splicing) operation. Through the PTHash function shown in the foregoing formula (2-9), a certain number of bits of the true random number RRK is calculated. Figure 6

[0156] Then, the number of bits of the true random number RRK is changed according to the formula (2-10) to obtain a string D_OKM of a preset number of bytes.

[0157] D_OKM = LocksChainPQ (RRK, inf || counter) (2-10)

[0158] wherein Inf is a random vector, which can be empty, and counter is a counter. In this step, the string D_OKM of a preset number of bytes is output through multiple rounds of PTHash calculation.

[0159] In this embodiment, the quantum rotation gate parameters are generated by a classical algorithm, realizing the deep integration of quantum computing and traditional cryptography. When the shared key is calculated based on the HKDF, the fixed number of random numbers used in the calculation, such as the fixed number of salt values and Inf values, ensure the determinacy of the quantum circuit parameter generation. Through the Rx quantum gate, the Ry quantum gate and the Rz quantum gate in each layer (strip) of the quantum random circuit, it is ensured that the slight change of the input data will cause the significant difference of the quantum state, that is, the avalanche effect is obtained. The connection mode of the CNOT gate in the quantum circuit dynamically changes with the number of layers (strips) to form a dynamic entanglement network, which further enhances the avalanche effect, so as to obtain a true random number.

[0160] ​Since the corresponding key algorithm, encryption algorithm and the like are specified in the cipher suite, the encryption end and the decryption end determine the key algorithm component or algorithm parameter applied when generating the multi-level concatenated key and the key algorithm component or algorithm parameter applied when updating the sub-key in the handshake process. The key algorithm component in the application is a key algorithm component or key derivation algorithm component applied in symmetric encryption algorithm, asymmetric encryption algorithm or post-quantum encryption algorithm. In a specific embodiment, a plurality of available key algorithm components are provided for each level, so that in step S33, the sub-key initial value of the corresponding level is generated by executing the key algorithm component of each level. In another embodiment, when all sub-key initial values are generated by one key algorithm component, the sub-key of different levels has corresponding algorithm parameters. For convenience of description, the sub-key is denoted as Kij, wherein i represents the level, which is a natural number starting from 1; j represents the serial number, which is an integer starting from 0. The plurality of initial sub-keys generated in step S33 can be represented as K10, K20, K30, ….

[0161] The path key chain in step S34 is composed of a plurality of path node keys, each of which includes a node name Path i and specific key data. Among them, the initial path node key of the path key chain is generated based on the master key and all the initial sub-keys by a certain key algorithm component, the name is Path0, and the specific key data is a string of several bits.

[0162] In the application, based on the extended transport layer security protocol, the application data is encrypted in a symmetric encryption manner, which fully utilizes the advantages of symmetric encryption algorithm and improves the data transmission efficiency.

[0163] Further, when the transport layer security protocol is extended, the specific encryption mode can also be specified in the encryption extension item, for example, AES-256 or AES_256_GCM is specified in the encryption extension item, or if TLS1.3 is used, the encryption mode in the original encryption extension item can be directly used, such as TLS_AES_256_GCM_SHA384.

[0164] When the message authentication code is included in the encryption mode (such as the aforementioned AES_256_GCM), the encryption end and the decryption end generate the authentication tag of the ciphertext based on one or more of the other part of the sub-key after encrypting the application data in a symmetric encryption manner to generate the ciphertext in the process of secure transmission of the application data based on the extended transport layer security protocol.

[0165] After the decryption end verifies the path node key received together with the ciphertext, the authentication tag is verified, and after the authentication tag verification passes, one or more of the partial sub-keys are used as key material to derive a decryption key, and the ciphertext is decrypted.

[0166] The master key and each sub-key in the application have corresponding update conditions, for example, the life of a sub-key reaches the preset length corresponding to the life cycle, the sub-key is used to generate plaintext encryption / decryption keys or a sub-key encryption security event occurs, or the number of updates of the sub-key associated with it reaches a threshold. When a sub-key is updated, the lower-level sub-key associated with the sub-key is also updated. For example, the multi-layer cascading key includes a master key Kmaster, a first sub-key K1 and a second sub-key K2, and their mutual relationship is as follows: K1=M(Kmaster), K2=M(K1). Where M is a general symbol of a key algorithm component, and M() represents calculation based on the data in the parentheses. The first sub-key K1 is a lower-level key of the master key Kmaster, and the second sub-key K2 is a lower-level key of the first sub-key K1. When the first sub-key K1 is updated, the second sub-key K2 is also updated. When the master key Kmaster is updated, the first sub-key K1 and the second sub-key K2 are regenerated.

[0167] The different sub-keys in the application can have the same or different life cycles. Among them, the life cycle is measured by time or the number of updates of the associated sub-key. For example, the multi-layer cascading key includes a master key Kmaster, a first sub-key K1 and a second sub-key K2, and their mutual relationship is as follows: K1=M(Kmaster), K2=M(Kmaster). The first sub-key K1 and the second sub-key K2 are lower-level sub-keys of the master key Kmaster. When the first sub-key K1 is updated to a preset number of times (such as 3 times), the second sub-key K2 is triggered to update, so that the first sub-key K1 is an associated key of the second sub-key K2, and the association between the first sub-key K1 and the second sub-key K2 is established through the update relationship.

[0168] In addition, in the application, when it is monitored that a sub-key is used to generate encryption / decryption keys of application data, the sub-key needs to be updated, so that the key is different each time encryption / decryption is performed in the data transmission process, even if the current encryption key is leaked, historical data cannot be decrypted, ensuring the forward security of communication. Moreover, since the master key and each sub-key are periodically updated, even if the current encryption key is leaked or cracked, future keys cannot be predicted, ensuring the backward security of communication.

[0169] Further, when a key security event occurs, if the encryption key is leaked or cracked, the system rolls back to the secure version of the key algorithm component, re-generates the master key and all sub-keys through the secure version of the key algorithm component, and builds a new path key chain.

[0170] When a key is monitored to meet its update condition, the key is re-computed. In one specific computation manner, the to-be-updated key is updated by a different key algorithm component from that used when the to-be-updated key is generated, and the computation result is taken as the new key. For example, when the initial value of the first sub-key K1 is computed, the first key algorithm component M1 is used, and the computation is based on the master key Kmaster, and the corresponding formula is: K10=M1(Kmaster). When the first sub-key K1 is updated, the second key algorithm component M2 is used, and the updated first sub-key K11 is computed based on the initial value K10 of the first sub-key K1 before the update, and the corresponding formula is: K11=M2(K10), or the computation is still based on the master key Kmaster, and the corresponding formula is: K11=M2(Kmaster).

[0171] In another specific computation manner, the to-be-updated key is updated by the key algorithm component used when the to-be-updated key is generated, and the computation is based on the updated algorithm parameter, and the computation result is taken as the new key. For example, when the initial value of the first sub-key K1 is computed, the first key algorithm component M1 is used, and the computation is based on the master key Kmaster, and the corresponding formula is: K10=M1(Kmaster). When the first sub-key K1 is updated, the first key algorithm component M1 is still used, and the updated first sub-key K11 is computed based on the initial value K10 of the first sub-key K1 before the update, and the corresponding formula is: K11=M1(K10).

[0172] The initial value computation formula of the first sub-key K1 can also be: K10=M1(Kmaster, salt1, info). Wherein, salt1 is the salt value of the first sub-key K1, and its specific value is, for example, "subkey1"; info is additional information, and when the initial value is computed, info is, for example, "init".

[0173] The update calculation formula of the first sub-key K1 is K1i=M1(self.current_key, salt1, info), self.current_key is the current value of the first sub-key K1. For example, self.current_key is K10 when calculating the first update value K11, and self.current_key is K11 when calculating the second update value K12. Salt1 is, for example, "subkey1", and info is, for example, "update". In this embodiment, the same key algorithm component is used when generating the sub-key and updating the sub-key. When updating each time, new algorithm parameters are used for calculation. The algorithm parameters can be the current key, or the new key can be calculated in combination with other parameters, such as the salt value or additional information mentioned above.

[0174] When the sub-key is updated, the path key chain is updated, and when the master key is updated, the path key chain is regenerated. After obtaining a new path node key each time, the old path node key is destroyed (i.e., securely erased) in the present application, thereby preventing the old path node key from being broken down by backtracking after the current path node key is obtained by human attack. For example, the initial path node key Path0 is updated to obtain Path1, and the specific key data of Path0 is destroyed and marked as unusable. When the path key chain update condition is met again, Path1 is updated to obtain Path2, and Path1 is destroyed. This is true for Path0, Path1, Path2, and so on. As can be seen, Path0, Path1, Path2, and the like obtained in sequence form a path key chain. For details, see Figure 7 . Figure 7Fig. 1 is a schematic diagram of an evolution process of a path key chain according to an embodiment of the present application. At each update, a new path key is generated based on the path node key at the end of the path key chain and all the sub-keys of the current update. In an embodiment, the last path node key of the path key chain and all the sub-keys of the current update are concatenated, and then a Hash calculation or a PTHash calculation is performed on the concatenation result, and the Hash value is taken as the new path node key. Alternatively, the last path node key of the path key chain and all the sub-keys of the current update are subjected to a specific calculation, such as an XOR calculation or a specific function calculation, for example, a lattice-based operation such as a modular addition / modular multiplication, or a Hash combination operation, and the like. Then a Hash calculation or a PTHash calculation is performed on the calculation result, and the Hash value is taken as the new path node key. The path key chain in the present application records the update path of the key, and indirectly records the application process of the key in the encryption process. If the path key chain is broken, it indicates that the current data has a security risk.

[0175] The multi-layer cascaded key in the present application takes the quantum-resistant master key as a seed to drive the generation of sub-keys of other levels. Each level of sub-key is independently generated through a key algorithm component, and thus each level of sub-key is isolated. When transmitting application data, part of the sub-keys can be used as encryption / decryption keys or as seeds to generate encryption / decryption keys, and part of the sub-keys can be used as encryption keys of service data or as seeds to generate encryption keys. The present application realizes the hierarchical dependence and chain path constraint (similar to a nine-ringed chain) of multiple keys similar to a mechanical type (such as a Luby lock) based on a multi-level cascading architecture, improves the key cracking difficulty, effectively resists quantum brute force cracking, and realizes the unification of the dual security goals of “historical data cannot be decrypted and future risk is actively isolated” and flexibility. In encryption / decryption, symmetric algorithms such as AES-256 and SM4 are used to encrypt / decrypt application data, taking into account efficiency and compatibility. The present application also generates a path key chain when providing a multi-layer cascaded key, which is used to record the key update sequence, and the old key is forcibly destroyed (erased) after each update to prevent human attacks and backtracking cracking in the communication process. In the data transmission process, the integrity of the path key chain is verified to effectively ensure the legality of the key update, guarantee the security of the application data, and prevent backtracking attacks.

[0176] Application Embodiment

[0177] In the mobile payment scenario, the mobile payment system includes a user-side wallet application (APP) and a server. The user-side wallet APP locally initializes a key pair, such as generating a post-quantum key pair through a Kyber component, and the private key is encrypted and stored in a TEE or a secure area. When the user registers with the server through the user-side wallet APP, the public key is uploaded, and the key access permission is enhanced in cooperation with biometric identification (such as fingerprint, FaceID).

[0178] In the process of establishing a communication connection between the user-side wallet APP and the server, a handshake is performed through an extended transport layer security protocol, and a cipher suite is determined in the handshake process, including key algorithm components used when generating and updating keys at different levels. In an embodiment, the user-side wallet APP and the server generate a shared key based on a post-quantum key pair as master key material through negotiation.

[0179] On the user side:

[0180] 1. The user-side wallet APP generates a master key Kmaster_c based on a PTHash component. For example: Kmaster_c = b3c6a8d648840e42...

[0181] 2. The initial value K10_c of the first subkey K1_c and the initial value K20_c of the second subkey K2_c are derived based on the master key through formulas (3-1) and (3-2), respectively.

[0182] K10_c = MLR(Kmaster,'subkey1', 'init') (3-1)

[0183] K20_c = MLR(Kmaster,'subkey2', 'init') (3-2)

[0184] Wherein, MLR() can be any one of the aforementioned key derivation algorithms based on LocksChainPQ, such as MKDF algorithm, PTHash algorithm, or an improvement of some existing key algorithms according to the LocksChainPQ of the present application, or other quantum-resistant key algorithms conforming to LocksChainPQ, such as Kyber, XMSS, SPHINCS, or FALCON, etc.

[0185] When the master key Kmaster_c = b3c6a8d648840e42..., K10_c = a9fd1a30fb9b5f5d..., and K20_c = 46b17c75f4adc441...

[0186] 3. Calculate the initial path node key Path0_c according to formula (3-3) based on the master key Kmaster_c and the initial value K10_c of the first sub-key K1_c and the initial value K20_c of the second sub-key K2_c.

[0187] Path0_c = PTHash(Kmaster_c || K10_c || K20_c) (3-3)

[0188] In this embodiment, Path0_c = a9fd1a30fb9b5f5d...

[0189] 4. In the transaction phase, the user terminal wallet APP generates a session key Ksession based on formula (3-4), and the session key Ksession is the encryption key of the transaction data.

[0190] Ksession = MLR(K10_c || K20_c,'session') (3-4)

[0191] In this embodiment, Ksession = 4475e36eb9695530...

[0192] 5. Use the session key Ksession to encrypt the transaction data 'Pay5yuan...' according to formula (3-5) to obtain the ciphertext ciphertext.

[0193] ciphertext = AES-GCM(Ksession, nonce, 'Pay5yuan...') (3-5)

[0194] 6. Update the first sub-key K1_c according to formula (3-6):

[0195] K1i+1_c = MLR(K1i_c,'subkey1', 'update') (3-6)

[0196] In this embodiment, i = 0, i.e. K11_c = fadfdc266e5b92aa...

[0197] 7. Update the path node key according to formula (3-7):

[0198] Pathn+1 = PTHash(Pathn c || K1i+1 || K2j) (3-7)

[0199] In this step of the embodiment, i = 0, j = 0, n = 0, i.e.

[0200] Path1_c = PTHash(Path0_c || K11_c || K20_c ).

[0201] Path1_c = 6db3e1c96450a64b...

[0202] The user terminal wallet APP sends the ciphertext ciphertext and the path node key Path1_c to the server.

[0203] On the server side:

[0204] After receiving the data sent by the user terminal wallet APP, the server obtains the user ID, the ciphertext ciphertext and the path node key Path1_c by parsing the data. The server performs the following processing:

[0205] 1. Determine the corresponding master key material based on the user ID, and generate the master key Kmaster_s based on the PTHash component. Wherein the master key Kmaster_s = b3c6a8d648840e42...

[0206] 2. Derive the initial value K10_s of the first sub-key K1_s and the initial value K20_s of the second sub-key K2_s based on the master key respectively. Wherein K10_s = a9fd1a30fb9b5f5d... and K20_s = 46b17c75f4adc441...

[0207] 3. Initialize the path key chain on the server side, and calculate the initial path node key Path0_s. In this embodiment, Path0_s = a9fd1a30fb9b5f5d...

[0208] 4. Verify whether the current path node key of the path key (i.e. the initial path node key Path0_s) is consistent with the received path node key Path0_c. It can be seen from the comparison that Path0_s = Path0_c, so the path verification is passed. If the verification fails, the server ends this processing and returns a message of verification failure to the user terminal wallet APP.

[0209] 5. Generate the decryption key Kdecrypt based on the initial value K10_s of the first sub-key K1_s and the initial value K20_s of the second sub-key K2_s, and decrypt the received ciphertext ciphertext according to formula (3-8) to obtain the plaintext data plaintext:

[0210] plaintext = AES (Kdecrypt, nonce, ciphertext) (3-8)

[0211] In this embodiment, Kdecrypt = 4475e36eb9695530..., and the decrypted plaintext is the transaction data "Pay 5 yuan...".

[0212] 6. Update the first sub-key K1_s and the path node key, where the updated first sub-key K1_s is: K11_s = fadfdc266e5b92aa..., and Path1_s = 6db3e1c96450a64b...

[0213] At this point, the data transmission process of a transaction data is completed.

[0214] On the other hand, the user terminal wallet APP and the server of the user ID update the keys according to the update mechanism in the multi-level concatenated key rotation protocol in the extended security protocol. As described above, the user terminal wallet APP updates the first sub-key K1_c after generating the session key Ksession each time, and the server updates the first sub-key K1_s after decryption each time. The second sub-key K2 is triggered to update after the first sub-key K1 is updated for a preset number of times, and the new shared key is periodically re-negotiated to determine the new shared key as the master key material, the master key Kmaster is re-generated, and the sub-key initial value and the new path key chain are re-generated. In the key update process, after the updated key is generated, the original old key is destroyed, so that the historical transaction cannot be decrypted after the current key is leaked, and the security of the transaction data is ensured.

[0215] The application provides a multi-level concatenated key, which is managed in layers and updated according to respective update conditions, and realizes forward / backward security and anti-quantum attack capability through dynamic dependence of multiple levels of keys and irreversible path constraints.

[0216] Since the sub-key in the application is updated in one direction (for example, K1i → K1i+1), the old key can be destroyed immediately when the new key is generated in application, so that the historical data cannot be decrypted, and the forward security of communication is realized. Due to the periodic resetting of the master key and the sub-key, the future key is isolated from the old data, and the backward security of communication is realized. The multi-level concatenated key provided by the application has an anti-quantum advantage. Due to the hierarchical relationship, when a key is cracked, multiple keys associated with it need to be cracked, which is computationally complex, and when different keys are generated based on different algorithms, the complexity of calculation is greater.

[0217] For example, the cracking time T 破解 of a three-level key is 主密钥 T 主密钥 × T子密钥1 XT 子密钥2 .

[0218] Wherein, the single-layer cracking time T 单层 = 2^b operations, where b is the key bit security strength, for the Kyber-1024 algorithm component generated key, its security strength b=173 bits (NIST evaluation value), assuming that the attacker can perform 1018 operations per second (current supercomputer computing power), then we can get:

[0219] T 单层 = 11972621413014756705924586149611790497021399392059392 =1.197e+52 seconds =3.796e+44 years.

[0220] Three-stage linkage total cracking time: T 破解 =(T 单层 ) 3 =(3.796e+44) 3 ≈1.716e+156 years. This value far exceeds the actual physical limit (such as the age of the universe is about 10^17 seconds), thus, the present application reduces the size of the single-layer key, such as generating less than the key size provided for Kyber-1024 algorithm, still need long enough cracking time, under the premise of ensuring quantum resistance, reduces the calculation complexity and calculation time of the key, reduces the requirement for system performance, improves the processing speed.

[0221] In addition, the present application also monitors key security events, such as vulnerabilities of quantum-resistant key algorithms, key leakage events, etc. When monitoring the key security event, determine the corresponding first key algorithm key based on the monitored key security event and unload the first key algorithm. Then determine the second key algorithm of the safe version of the first key algorithm from the component center, and load the safe version of the second key algorithm from the component center. Then, based on the foregoing unloading and loading operations of the key algorithm information and the corresponding key algorithm information, update the cipher suite, i.e. delete the unloaded first key algorithm information from the cipher suite list and add the loaded second key algorithm information. Based on the updated cipher suite, generate a new multi-layer cascading key according to the multi-layer cascading key rotation protocol and freeze the original multi-layer cascading key, in the subsequent application data transmission process, based on the new multi-layer cascading key, transmit the application data, the original multi-layer cascading key is frozen and in read-only state, can decrypt historical application data when needed.

[0222] In the present application, the component center can be a complementary system of the anti-quantum cryptography migration system, or a third-party provided system, which provides an algorithm component library including various encryption algorithm components and related key algorithm components, signature algorithm components, etc. In an embodiment, the component center is an independent third-party system, which includes two types of users. One type of user is an algorithm developer, who provides corresponding algorithms according to the requirements of the component center, the component center encapsulates each algorithm into a component with a standard interface, and provides a corresponding download channel or API interface, so that the components in the present application can realize hot plug, be loaded when needed, and be unloaded when not needed, without affecting the data transmission in the anti-quantum cryptography migration system. The other type of user is an algorithm user, whose system is the anti-quantum cryptography migration system of the present application, which can download the required algorithm components from the component center, or call the API of the required algorithm components. For example, when a key security event is monitored, the corresponding algorithm component is unloaded, and a new algorithm component is loaded from the component center. In addition, the present application also monitors the effectiveness of the installed key algorithm components in the anti-quantum cryptography migration system during the management of the key. If the installed key algorithm components in the anti-quantum cryptography migration system are invalid, the invalid key algorithm components are unloaded from the system. In a specific embodiment, the configuration file of the component center records the effective conditions of the key algorithm components, such as the use duration, the invalid mark manually marked, etc. The anti-quantum cryptography migration system queries the configuration file in a periodic polling manner to determine whether the installed algorithm in the current system is effective, or the component center monitors the effectiveness of the algorithm components in the configuration file, and notifies the corresponding user (i.e. the corresponding encryption communication system) after the algorithm is invalid, thus ensuring that the sub-key or master key can be updated in time without affecting the data transmission in the communication system.

[0223] In another aspect, the present application also provides an anti-quantum cryptography migration system, referring to Figure 8 , Figure 8 is a principle block diagram of an anti-quantum cryptography migration system according to an embodiment of the present application. In the present embodiment, the anti-quantum cryptography migration system includes a protocol adaptation module 10 and a data transmission module 20. The protocol adaptation module 10 adaptively extends the transmission layer security protocol of data, and the extension content at least includes: adding an anti-quantum cryptography suite in the cryptography suite list; adding the following in the encryption extension item: a chained post-quantum key generation mechanism, a multi-layer cascading key rotation protocol, a key derivation application data based on multi-layer cascading keys, a path key chain verification, and a symmetric encryption of application data. The data transmission module 20 performs secure transmission of application data between the encryption end and the decryption end based on the extended transmission layer security protocol.

[0224] The anti-quantum migration system further comprises a security rollback module 30, which monitors a key security event, rolls back to a security version of a key algorithm after monitoring the key security event, and regenerates a multi-layer cascaded key based on the security version of the key algorithm and freezes an original multi-layer cascaded key, wherein application data is transmitted based on the new multi-layer cascaded key and historical application data is decrypted based on the original multi-layer cascaded key.

[0225] The data transmission module 20 comprises a key management unit 201, an encryption unit 202, a verification unit 203, and a decryption unit 204, the encryption end and the decryption end each comprise the key management unit 201, the key management unit 201 generates a master key, multi-level sub-keys, and a path key chain based on an extended cipher suite according to a chained post-quantum key generation mechanism, and updates the multi-layer cascaded key according to a multi-layer cascaded key rotation protocol. The encryption unit 202 is located at the encryption end, uses one or more of the partial sub-keys as key material to derive an encryption key for symmetric encryption, encrypts application data in a symmetric encryption mode to generate ciphertext, and sends the ciphertext and a path node key at the end of the path key chain to the decryption end.

[0226] The verification unit 203 and the decryption unit 204 are located at the decryption end, the decryption end parses the ciphertext and the path node key from the data sent by the encryption end after receiving the data, then verifies the path node key by the verification unit 203, and after the verification of the path node key is successful, the decryption unit 204 derives a decryption key using one or more of the partial sub-keys as key material, and decrypts the ciphertext.

[0227] When the message authentication code is included in the encryption mode, after the encryption unit 202 encrypts the application data in a symmetric encryption mode to generate ciphertext, another part of one or more sub-keys is used to generate a first authentication tag of the ciphertext. The first authentication tag is sent to the decryption end together with the ciphertext and the path node key at the end of the path key chain. Correspondingly, after the verification unit 203 verifies the path, one or more sub-keys are used to generate a second authentication tag of the ciphertext; the first authentication tag and the second authentication tag are compared; if the first authentication tag and the second authentication tag match, it is determined that the authentication of the ciphertext is passed, the decryption unit 204 derives a decryption key using one or more of the partial sub-keys as key material, and decrypts the ciphertext. If the first authentication tag and the second authentication tag do not match, it is determined that the authentication of the ciphertext is not passed, and the decryption of the ciphertext is ended.

[0228] In another aspect, the embodiments of the present application also provide an electronic device, referring to Figure 9 , Figure 9 is a structural principle block diagram of an electronic device according to an embodiment of the present application, as Figure 9As shown, the electronic device includes a processor 601 and a memory 602, the memory storing computer instructions, the processor executing the computer instructions to perform the anti-quantum migration method provided by the present application.

[0229] Specifically, the processor 601 can include a central processing unit (CPU) or a graphics processing unit (GPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present application. The memory 602 includes data or instructions. For example, the memory 602 can be at least one of a hard disk drive (HDD), a read-only memory (ROM), a random access memory (RAM), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, a universal serial bus (USB) drive, or other physical / tangible storage device. In another example, the memory 602 includes a removable or non-removable (or fixed) medium. In another example, the memory 602 can be internal or external to the integrated gateway disaster recovery device. The memory 602 can be a non-volatile solid-state memory. In other words, the memory 602 generally includes a tangible (non-transitory) computer-readable storage medium (such as a memory device) encoded with executable instructions, where the stored executable instructions are executed by the processor 601 (such as by one or more processors) to implement the anti-quantum migration method in embodiments of the present application.

[0230] In one example, Figure 9 The electronic device shown can also include a communication interface 603 and a bus 610. The processor 601, the memory 602, and the communication interface 603 are connected through the bus 610 and complete communication with each other. The communication interface 603 is mainly used to realize the communication between the modules, devices, units, and / or equipment in the electronic device.

[0231] Bus 610 includes hardware, software, or both, to couple components in communication bus, for example, at least one of the following: an accelerated graphics port (AGP) or other graphics bus, an enhanced industry standard architecture (EISA) bus, a front-side bus (FSB), a HyperTransport (HT) interconnect, an industry standard architecture (ISA) bus, an Infineon® Infinity bus, a low pin count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a serial advanced technology attachment (SATA) bus, a Video Electronics Standards Association local (VLB) bus, or another suitable bus or interconnect. Bus 610 can include one or more buses. Although a particular bus is described or shown in the embodiments of the present application, the embodiments of the present application contemplate any suitable bus or interconnect.

[0232] In another aspect, the embodiments of the present application also provide a computer readable storage medium, on which computer program instructions are stored, and the computer program instructions are executed by a processor to implement the aforementioned anti-quantum migration method. The computer readable storage medium includes a classical computer readable storage medium, such as the aforementioned memory 602, i.e. a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible storage device, and can also include a storage medium readable by a quantum computer for storing quantum information, such as a quantum random access memory (QRAM). The QRAM is regarded as a quantum version of the RAM in the classical computer, and through the QRAM, a quantum superposition state containing information can be manufactured. Compared with the RAM which needs to be read one by one, the superposed data can be read with superposed addresses. The QRAM can be realized in an optical, semiconductor quantum dot, superconducting circuit, ion trap and the like.

[0233] The flowcharts and / or block diagrams of the method and system of the embodiments of the present application are described above by way of example, and the related aspects are described. It should be understood that each block in the flowchart and / or block diagram can be implemented by computer program instructions, or by special-purpose hardware that performs specified functions or actions, or by a combination of special-purpose hardware and computer instructions. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a functional card, and the like; when implemented in software, it is a program or a code segment used to perform the required task. The program or code segment can be stored in a memory, or transmitted in a data signal carried in a carrier wave in a transmission medium or communication link. The code segment can be downloaded via a computer network, such as the Internet, an intranet, and the like.

[0234] The above examples are only for illustrating the present application, and are not intended to limit the present application. Those skilled in the art can make various changes and modifications without departing from the scope of the present application. Therefore, all equivalent technical solutions should belong to the scope of the present application.

Claims

1. A method of quantum-resistant migration of an anti-quantum cipher, comprising: The application relates to a method for transmitting application data securely based on an extended transport layer security protocol. The method comprises the following steps: The encryption end and the decryption end respectively generate a master key, a plurality of sub-keys and a path key chain based on the extended cipher suite according to the chain-type post-quantum key generation mechanism, and the method comprises the following steps: The encryption end and the decryption end determine a shared key through key negotiation based on the extended transport layer security protocol; The encryption end and the decryption end respectively generate an anti-quantum master key through a PT hash algorithm in the anti-quantum cipher suite which is constructed by a quantum random circuit based on the shared key; The encryption end and the decryption end respectively generate a plurality of sub-keys based on the master key, wherein the initial value of each sub-key is generated according to the master key and / or the initial value of one or more sub-keys of a higher level; The encryption end and the decryption end respectively construct a path key chain and generate an initial path node key of the path key chain based on the master key and / or the initial value of one or more sub-keys; The encryption end derives an encryption key for symmetric encryption by taking one or more of the partial sub-keys as key material, encrypts the application data in a symmetric encryption mode to generate ciphertext, and sends the ciphertext and the path node key at the end of the path key chain to the decryption end; The decryption end verifies the path node key received together with the ciphertext, derives a decryption key by taking one or more of the partial sub-keys as key material after the verification of the path node key is passed, and decrypts the ciphertext; and The encryption end and the decryption end update the multi-layer cascading key based on the multi-layer cascading key rotation protocol, and the method comprises the following steps: During the update period of the master key, one or more sub-keys used for deriving the encryption / decryption key are updated after the encryption / decryption key is derived by taking one or more of the partial sub-keys as key material; the sub-key is updated when the life of the sub-key reaches the preset life cycle length; the first sub-key is updated when the update times of the second sub-key associated with the first sub-key reach a threshold value; The master key is updated when the life of the master key reaches the preset life cycle length, and a plurality of new sub-keys and a new path key chain are generated based on the updated master key after the master key is updated. The encryption mode is further included in the content of symmetric encryption of the application data in the encryption extension item; 2. The method of quantum-resistant migration of claim 1, wherein, Correspondingly, when the message authentication mode is included in the encryption mode, the encryption end and the decryption end generate an authentication tag of the ciphertext based on one or more of another part of the sub-keys after the encryption end encrypts the application data in a symmetric encryption mode to generate the ciphertext during the process of securely transmitting the application data based on the extended transport layer security protocol. ​ After the decryption end verifies the path node key received with the ciphertext, the authentication tag is verified, and after the authentication tag verification is passed, one or more of the partial sub-keys are used as key material to derive a decryption key, and the ciphertext is decrypted.

3. The method of quantum-resistant migration of claim 1, wherein, The steps of the encryption end and the decryption end updating the multi-layer cascading key based on the multi-layer cascading key rotation protocol further comprise: After updating any sub-key, a new path node key is generated based on the path node key at the end of the path key chain and at least all the sub-keys currently updated, and is added to the end of the path key chain; After the master key is updated, after generating a plurality of new sub-keys based on the updated master key, an initial path node key of a new path key chain is generated based on the updated master key and / or one or more new sub-key initial values.

4. The method of quantum-resistant migration of claim 1, wherein, The extension of the adaptive extension of the transport layer security protocol further comprises a rollback mechanism, and the secure transmission process of the application data further comprises: Monitoring key security events; Determine the corresponding first key algorithm component based on the monitored key security event and unload the first key algorithm component; Determine a second key algorithm component of a secure version of the first key algorithm component from the component center; wherein the component center provides a plurality of encryption algorithm components, related key algorithm components and signature algorithm components; Load the second key algorithm component of the secure version from the component center; Delete the unloaded first key algorithm information from the cipher suite list and add the loaded second key algorithm information; and Based on the updated cipher suite, generate a new multi-layer cascading key based on the chained post-quantum key generation mechanism and freeze the original multi-layer cascading key, wherein the application data is transmitted based on the new multi-layer cascading key, and the historical application data is decrypted based on the original multi-layer cascading key.

5. A quantum-resistant migration system, comprising: Comprise: A protocol adaptation module configured to adaptively extend the transport layer security protocol of the data, and the extension content at least includes: adding an anti-quantum cipher suite in the cipher suite list; adding the chained post-quantum key generation mechanism, the multi-layer cascading key rotation protocol, the derivation of the application data based on the multi-layer cascading key, the path key chain verification, and the symmetric encryption of the application data in the encryption extension item; A data transmission module configured to perform secure transmission of application data between the encryption end and the decryption end based on the extended transport layer security protocol, wherein the secure transmission process of the application data comprises: The encryption end and the decryption end generate a master key, a plurality of sub-keys, and a path key chain based on the extended cipher suite according to the chained post-quantum key generation mechanism, including the following steps: The encryption end and the decryption end determine the shared key based on the extended transport layer security protocol through key negotiation; The encryption end and the decryption end generate an anti-quantum master key through the PT hash algorithm constructed by the quantum random circuit in the anti-quantum cipher suite based on the shared key; The encryption end and the decryption end generate a plurality of sub-keys based on the master key, wherein the initial value of each sub-key is generated based on the master key and / or one or more sub-key initial values of the upper level. The encryption end and the decryption end respectively construct a path key chain, and generate an initial path node key of the path key chain based on a master key and / or one or more sub-key initial values; The encryption end derives an encryption key for symmetric encryption by taking one or more of the partial sub-keys as key material, encrypts the application data in a symmetric encryption manner to generate ciphertext, and sends the ciphertext and the path node key at the end of the path key chain to the decryption end; The decryption end verifies the path node key received together with the ciphertext, derives a decryption key by taking one or more of the partial sub-keys as key material after the verification of the path node key is successful, and decrypts the ciphertext; and The encryption end and the decryption end update the multi-layer cascaded key based on a multi-layer cascaded key rotation protocol, including the following steps: During the update period of the master key, after deriving the encryption / decryption key by taking one or more of the partial sub-keys as key material, one or more sub-keys used to derive the encryption / decryption key are updated; when the life of a sub-key reaches a preset life cycle length, the sub-key is updated; when the update times of a second sub-key associated with a first sub-key reaches a threshold, the first sub-key is updated; When the life of the master key reaches a preset life cycle length, the master key is updated, and after the master key is updated, new multi-level sub-keys and a new path key chain are generated based on the updated master key.

6. The quantum-resistant migration resistant system of claim 5, wherein, When the transport layer security protocol is adaptively extended, the extension content further includes a rollback mechanism, and the system further includes: A security rollback module configured to monitor a key security event, after monitoring the key security event, roll back to a secure version of a key algorithm, and regenerate a multi-layer cascaded key based on the secure version of the key algorithm, freeze the original multi-layer cascaded key, wherein application data is transmitted based on the new multi-layer cascaded key, and historical application data is decrypted based on the original multi-layer cascaded key.

7. An electronic device comprising a processor and a memory, characterized in that The memory stores computer instructions, and the processor executes the computer instructions to perform the quantum-resistant password migration method of any one of claims 1-4.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions, and the computer instructions are executed by the processor to perform the quantum-resistant password migration method of any one of claims 1-4.

Images