Post-quantum certificate management method, certificate management platform and equipment

Abstract

The invention relates to the field of information security, and discloses a post-quantum certificate management method, a certificate management platform and equipment. In the invention, the method comprises the following steps: acquiring a digital certificate application file of a client, the digital certificate application file comprising an SPHINCS + public key; according to the SPHINCS + public key, a post-quantum signature certificate is generated; configuring an encryption key pair for the digital certificate application file, and generating a post-quantum encryption certificate according to the encryption key pair; and sending the post quantum signature certificate and the post quantum encryption certificate to the client. According to the method, an anti-quantum dual-certificate system separation system is constructed, keys are respectively generated through multiple key generation algorithms, the problems of key multiplexing and compatibility are solved, signature and encryption key pairs are thoroughly isolated through a dual-certificate architecture, and systematic risks caused by leakage of a single key are avoided.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a post-quantum certificate management method, certificate management platform, and equipment. Background Art

[0002] The current mainstream Public Key Infrastructure (PKI) relies on classical public key cryptography algorithms such as RSA, ECC, and SM2 to issue and verify digital certificates. However, with the development of quantum computers, quantum attacks such as Shor's algorithm can crack the mathematical difficulties of these algorithms, such as large integer factorization and discrete logarithms, in polynomial time. This poses a significant risk to the existing digital certificate system. Although existing standards such as NIST SP 800-56C recommend increasing key lengths, such as increasing the RSA key length to 3078 bits, to mitigate the threat in the short term, this approach cannot fundamentally protect against quantum attacks. Therefore, there is an urgent need to introduce post-quantum cryptography (PQC) algorithms to restructure the PKI system.

[0003] The use of classic public-key cryptographic algorithms such as RSA, ECC, and SM2 for the issuance and verification of digital certificates in related technologies has significant shortcomings. On the one hand, there is a risk of long-term data leakage. Attackers can intercept and store encrypted data and decrypt it, threatening the long-term security of sensitive information in finance, government affairs, and other fields. On the other hand, there is the risk of certificate forgery. Existing hybrid certificate schemes do not clearly separate the algorithm type for signature and encryption keys, allowing for forged certificate signatures, disrupting the chain of trust and leading to security issues such as man-in-the-middle attacks or counterfeit services, posing a fundamental threat to existing network security systems. Summary of the Invention

[0004] The purpose of the embodiments of the present invention is to provide a post-quantum certificate management method, certificate management platform, and device. Through this method, a quantum-resistant dual-certificate system separation system is constructed, and keys are generated separately through multiple key generation algorithms to solve key reuse and compatibility issues. Through the dual-certificate architecture, signature and encryption key pairs are completely isolated to avoid systemic risks caused by the leakage of a single key.

[0005] To solve the above technical problems, an embodiment of the present invention provides a post-quantum certificate management method, which includes: obtaining a digital certificate application file from a client, where the digital certificate application file includes SPHINCS+public key; generating a post-quantum signature certificate based on the SPHINCS+public key; configuring an encryption key pair for the digital certificate application file, and generating a post-quantum encryption certificate based on the encryption key pair; and sending the post-quantum signature certificate and the post-quantum encryption certificate to the client.

[0006] The embodiment of the application further provides a certificate management platform, comprising at least a certificate system and a key management system; wherein the certificate system is used for obtaining a digital certificate application file of a client, the digital certificate application file comprising an SPHINCS+ public key; the key management system is used for configuring an encryption key pair for the digital certificate application file; the certificate system is further used for generating a post-quantum signature certificate according to the SPHINCS+ public key, generating a post-quantum encryption certificate according to the encryption key pair, and sending the post-quantum signature certificate and the post-quantum encryption certificate to the client.

[0007] The embodiment of the application further provides an electronic device, comprising: at least one processor; and a memory in communication connection with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the post-quantum certificate management method as described above.

[0008] Compared with the related art, the application constructs an anti-quantum double-certificate system separation algorithm system. The signature certificate is generated by using a post-quantum signature algorithm, and the signature forgery attack under quantum computing is resisted. The encryption certificate is generated by using an encryption key, and the quantum-safe key encapsulation and digital envelope functions are realized. In this way, the signature and encryption functions are separated by using the double-certificate architecture, and the algorithm separation of "signature-encryption" is realized: even if a single algorithm is attacked, the other function can still be independently operated. Moreover, the signature certificate and the encryption certificate are generated by using different keys, the key reuse and compatibility problem is solved, the signature and encryption key pairs are completely isolated by using the double-certificate architecture, the systematic risk caused by single key leakage is avoided, and the problems of data leakage and forgery attack of the traditional PKI are solved. BRIEF DESCRIPTION OF DRAWINGS

[0009] One or more embodiments are illustrated by way of example in the figures that are part of this document and which illustrate key principles of the application. The drawings are not to scale, and are solely for purposes of illustration without imposing structural limitations. It is noted that in the drawings, like reference numerals refer to like elements, and that not all elements are necessarily drawn to scale.

[0010] Figure 1 is a structural schematic diagram of a certificate management platform according to an embodiment of the application;

[0011] Figure 2 is a flowchart of a post-quantum certificate management method according to another embodiment of the application;

[0012] Figure 3 is another flowchart of a post-quantum certificate management method according to another embodiment of the application;

[0013] Figure 4 1 is a schematic diagram of the structure of a cryptographic service module of a client provided according to another embodiment of the present application;

[0014] Figure 5 It is a structural diagram of an electronic device provided according to another embodiment of the present application. DETAILED DESCRIPTION

[0015] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, each embodiment of the present invention will be described in detail below with reference to the accompanying drawings. However, it will be understood by those skilled in the art that in each embodiment of the present invention, many technical details are provided to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical solutions claimed in this application can be implemented. The division of the following embodiments is for convenience of description and should not constitute any limitation on the specific implementation of the present invention. The various embodiments can be combined with each other and referenced to each other under the premise that there is no contradiction.

[0016] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0017] There are obvious shortcomings in the use of classical public key cryptographic algorithms such as RSA, ECC and SM2 in related technologies to implement the issuance and verification of digital certificates: on the one hand, there is a risk of long-term data leakage. Attackers can intercept and store encrypted data and decrypt it after quantum computers mature, which will threaten the long-term security of sensitive information in the fields of finance and government affairs; on the other hand, there is a risk of certificate forgery. Quantum computing capabilities can be used to forge CA root certificate signatures, destroy the trust chain, and then cause security issues such as man-in-the-middle attacks or counterfeit services, posing a fundamental threat to the existing network security system. The embodiment of the present application provides a certificate management platform for executing the post-quantum certificate management method provided by the present application (this method will be elaborated in detail later in this article and will not be repeated here). Figure 1 As shown, the certificate management platform and the user's client (ie Figure 1The "1-1" connection is used to issue a post-quantum digital certificate to the user, wherein the post-quantum digital certificate includes a post-quantum signature certificate and a post-quantum encryption certificate. Figure 1 As shown, the certificate management platform includes at least a certificate system (i.e. Figure 1 "1-2" in the above), key management system (i.e. Figure 1 "1-3" in the above) and the certificate issuance system (i.e. Figure 1 "1-4" in the figure), data exchange is carried out between systems.

[0018] Among them, the certificate system obtains the digital certificate application file (Certificate Signing Request, CSR, also known as "digital certificate application CSR file") generated by the target entity (i.e. the user) when the client application calls the cryptographic service module, and reviews the target entity based on the digital certificate application CSR file. If the target entity passes the review, the digital certificate application CSR file submitted by the target entity is parsed. After the digital certificate application CSR file is verified using the signature algorithm, the certificate system applies to the key management system for an encryption key pair. The encryption key pair in this application refers to the ML-KEM post-quantum asymmetric encryption key pair. The key management system determines the encryption key pair corresponding to the digital certificate application CSR file based on the request sent by the certificate system, and sends the encryption key pair to the certificate system. After receiving the encryption key pair, the certificate system generates an encryption certificate based on the encryption key pair, and at the same time produces a signature certificate based on the parsing result of the digital certificate application CSR file. After the quantum encryption certificate is produced, the certificate system publishes the produced post-quantum encryption certificate to the certificate issuing system and sends it to the client, and the certificate issuing system publishes the post-quantum encryption certificate.

[0019] In some embodiments, the certificate system also creates a digital envelope to protect the private key in the encryption key pair. This process uses the ML-KEM public key included in the digital certificate application (CSR) file and a digital envelope created using a hybrid key algorithm to protect the private key in the encryption key pair. (This process will be explained in detail later in this article and will not be repeated here.)

[0020] Through the above-mentioned method of this application, a certificate management platform for issuing post-quantum digital certificates to users is established. This certificate management platform can issue post-quantum certificates (including post-quantum signature certificates and post-quantum encryption certificates), solving the problems of data leakage, counterfeit attacks, etc. in traditional PKI.

[0021] The classical public key cryptography algorithms such as RSA, ECC and SM2 are used in the related art to implement the issuance and verification of digital certificates, which has obvious shortcomings: on the one hand, there is a risk of long-term data leakage, and attackers can intercept and store encrypted data, and then decrypt them when quantum computers mature, which will threaten the long-term security of sensitive information in the fields of finance and government affairs; on the other hand, there is a risk of certificate forgery, and quantum computing power can be used to forge CA root certificate signatures, break the trust chain, and then cause security problems such as man-in-the-middle attacks or impersonation services, which fundamentally threatens the existing network security system. In addition, quantum threats are new risks brought about by technological development, but the existing PKI system did not foresee this risk when it was designed. Therefore, the post-quantum algorithm cannot be directly replaced within the existing PKI framework, and the system must be redesigned. A core difficulty in redesigning is that the current system relies on the signature public key to protect the distribution of the encryption private key, and after replacing the post-quantum algorithm, the post-quantum signature public key cannot assume this role.

[0022] In the above software and hardware running environment, in view of the problems in the above related art, the embodiments of the present application provide a post-quantum certificate management method applied to the above certificate management platform, which obtains the digital certificate application file of the client through the certificate management platform to provide a trusted data basis for subsequent certificate issuance; and configures an encryption key pair for the application file, and generates a post-quantum digital certificate (including a signature certificate and an encryption certificate) based on the encryption key pair and the analysis result. In this way, the method constructs an anti-quantum double-certificate system separation algorithm system, in which the signature certificate is generated by a post-quantum signature algorithm to resist signature forgery attacks under quantum computing. The encryption certificate is generated by encryption with an encryption key to realize quantum-safe key encapsulation and digital envelope functions. In this way, the signature and encryption functions are separated through the double-certificate architecture to realize algorithm separation of "signature-encryption": even if a single algorithm is attacked, the other function can still run independently. Moreover, the signature certificate and the encryption certificate are generated using different keys, solving the key reuse and compatibility problem, and through the double-certificate architecture, the signature and encryption key pairs are completely isolated to avoid systemic risks caused by single key leakage, and solve the problems of data leakage and impersonation attacks of traditional PKI.

[0023] In some embodiments, a post-quantum certificate management method applied to a certificate management platform of the present application has a specific process as shown in Figure 2 , which includes the following steps.

[0024] Step 201, the certificate management platform obtains the digital certificate application file of the client, and generates a post-quantum signature certificate according to the SPHINCS+ public key in the digital certificate application file.

[0025] Step 202, the certificate management platform configures an encryption key pair for the digital certificate application file, and generates a post-quantum encryption certificate according to the encryption key pair.

[0026] In step 203, the certificate management platform sends the post-quantum signature certificate and the post-quantum encryption certificate to the client.

[0027] The above-mentioned method of this application achieves "signature-encryption" algorithm separation: even if a single algorithm is attacked, the other function can still operate independently. Because the signature certificate and encryption certificate issued by the certificate management platform of this application are generated using different keys, it also avoids the security risks of using the same key pair for both signing and encryption in traditional solutions, and solves the data leakage and counterfeit attacks that are common in traditional PKI.

[0028] In step 201, the digital certificate application CSR file is generated by the target entity using the cryptographic service module of the client application based on the SPHINCS+ public key, the ML-KEM public key, the identity information of the target entity and the signature value. Among them, the cryptographic service module is also used to generate the SPHINCS+ signature public and private keys and the ML-KEM public and private keys according to the needs of the user (or target entity). The cryptographic service module can also provide post-quantum cryptographic computing capabilities to help users verify the obtained post-quantum digital certificates (this process will be elaborated in detail later in this article and will not be repeated here). The embodiment of the present application designs a standardized X.509 extension field in the digital certificate application CSR file, embeds the post-quantum encryption public key (used to protect the encryption key pair corresponding to the encryption certificate) into the certificate application file (CSR), is compatible with the existing PKI parsing logic, and achieves a smooth transition. The generated digital certificate application CSR file can be in the form shown below.

[0029]

[0030]

[0031] In step 201, the certificate management platform's certificate system first reviews the acquired digital certificate application CSR file and the corresponding target entity. If the target entity passes the review, the system parses the certificate application CSR file submitted by the target entity to obtain a parsing result. The parsing result consists of one or more of the following: a SPHINCS+ public key, an ML-KEM public key, the target entity's identity information, and a signature value. The certificate system verifies the correctness of the SPHINCS+ public key in the parsing result using the SPHINCS+ signature algorithm. If verification fails, the system sends a corresponding failure message to the target entity. If verification is correct, a post-quantum signature certificate is generated based on the SPHINCS+ public key.

[0032] In step 202, when the application document is verified, the certificate system applies for an encryption key pair (i.e., an ML-KEM post-quantum asymmetric encryption key pair) from the key management system of the certificate management platform to configure the encryption key pair for the digital certificate application document. The process of configuring the ML-KEM post-quantum asymmetric encryption key pair can be implemented as follows: the key management system generates a number of encryption key pairs according to a preset key generation algorithm to construct a key pool, determines an encryption key pair from the key pool to pair with the digital certificate application document, and returns the determined encryption key pair to the certificate system. It is understandable that the key management system can manage the keys corresponding to the post-quantum cryptographic algorithm, the traditional public key cryptographic algorithm, and the symmetric cryptographic algorithm, and pre-generate a certain amount of symmetric encryption keys, which are stored in a secure storage area for extraction when needed, that is, to construct a key pool.

[0033] In step 202, after obtaining the encryption key pair, the certificate system generates a corresponding post-quantum digital certificate based on the encryption key pair and the parsing result. Among them, the certificate system generates a post-quantum encryption certificate based on the public key of the encryption key pair (i.e., the public key in the ML-KEM post-quantum asymmetric encryption key pair). Among them, the certificate generation process of this application can be implemented based on the post-quantum signature algorithm, the post-quantum asymmetric encryption algorithm, the post-quantum symmetric encryption algorithm and the post-quantum hash algorithm. The specific algorithm selection is not limited. Those skilled in the art can select the corresponding post-quantum algorithm to implement certificate generation according to their needs.

[0034] In some embodiments, after generating the post-quantum encryption certificate and the post-quantum signature certificate in step 202, the certificate system further uses a hybrid key algorithm, an ML-KEM public key, and the private key in the encryption key pair to create a digital envelope, protect the private key with the digital envelope, and send the digital envelope to the target entity so that the target entity can decrypt it using the hybrid key algorithm to obtain the private key in the encryption key pair.

[0035] In some embodiments, for making a digital envelope using a hybrid key algorithm and the public key in the encryption key pair, the process can be as follows: using the hybrid key algorithm to generate a temporary encryption key, and using the temporary encryption key to encrypt the private key in the encryption key pair to obtain a first ciphertext, and using the ML-KEM public key in the digital certificate application CSR file to encrypt the encryption key to obtain a second ciphertext; merging the two layers of ciphertext to obtain an encrypted digital envelope.

[0036] Specifically, to ensure quantum security during the transmission of sensitive information (such as the private key of an ML-KEM post-quantum asymmetric encryption key pair), the certificate system uses a digital envelope created using the ML-KEM public key included in the certificate application CSR file to protect the private key of the ML-KEM asymmetric encryption key pair. First, the certificate system generates an encryption key using a hybrid key algorithm (such as the PQC-SM4 symmetric encryption algorithm). Based on this encryption key, it encrypts the private key of the ML-KEM post-quantum asymmetric encryption key pair generated by the key management system to obtain a first ciphertext. This encryption key is then encrypted using the ML-KEM public key in the digital certificate application CSR file generated by the target entity to obtain a second ciphertext. A digital envelope is then created based on the first and second ciphertexts. The certificate system then sends the post-quantum digital certificate and digital envelope to the client. After obtaining the encrypted envelope generated by the certificate system, the target entity can use the post-quantum cryptographic computing capabilities provided by the client's cryptographic service module to reversely decrypt the digital envelope, thereby obtaining the private key of the ML-KEM post-quantum asymmetric encryption key pair.

[0037] The digital envelope with a signature in the above process complies with the "GB / T 0010SM2 Cryptographic Algorithm Encryption Signature Message Syntax Specification". In this application, the digital envelope is adapted to the post-quantum algorithm. The basic data structure of the digital envelope adapted to the post-quantum algorithm is shown below.

[0038]

[0039]

[0040] In step 203, after the certificate system generates the post-quantum signature certificate and post-quantum encryption certificate corresponding to the certificate application document, the certificate system sends the generated post-quantum signature certificate, post-quantum encryption certificate, and the encryption key used to generate the digital envelope to the client and the certificate issuing system. The certificate issuing system will publish the above contents and store the generated post-quantum signature certificate and post-quantum encryption certificate.

[0041] To ensure the legitimacy, integrity, and security of the certificate, and to prevent it from being forged, tampered with, or causing the trust chain to become invalid due to key security issues, please refer to Figure 3 In some embodiments, after step 203, the following steps are further included:

[0042] Step 204: Verify the post-quantum digital certificate to obtain a verification result of the post-quantum digital certificate.

[0043] In some embodiments, step 204 may be implemented by:

[0044] Step a: Verify the security status of the post-quantum encryption certificate and / or the encryption key pair used to generate the post-quantum encryption certificate; if the verification fails, revoke the post-quantum encryption certificate and add the post-quantum encryption certificate to the certificate revocation list.

[0045] Step b: Sending a certificate revocation list to the client, so that the client can verify the post-quantum signature certificate using the SPHINCS+ private key of the target entity.

[0046] In step a, the certificate system verifies the post-quantum digital certificate by determining whether the key encryption key is secure. If it is not secure, the current key encryption key is stopped from being used, and a new encryption key pair is determined from the symmetric cryptographic algorithm key to issue a new post-quantum digital certificate based on the new encryption key pair.

[0047] In step b, the client actively downloads the certificate revocation list from the server, and the certificate system or related management module sends the certificate revocation list determined according to the client's download request, and the certificate system sends it to the client application. The client can verify the obtained post-quantum signature certificate on demand based on the certificate revocation list. For example, after the user receives the post-quantum digital certificate of the target entity, based on the post-quantum cryptographic computing capability provided by the client's cryptographic service module, the post-quantum signature certificate is verified using SPHINCS+private key to obtain the signature verification result of the post-quantum digital certificate of the target entity, thereby ensuring that the certificate has not been tampered with and comes from a trusted issuing source, preventing certificate forgery or tampering attacks in a quantum computing environment. Accordingly, if the security status verification result obtained in step 204 is that the encryption key pair is unsafe, the currently constructed key pool is stopped from being used, and a new key pool is determined according to the key algorithm to allocate encryption key pairs based on the new key pool.

[0048] In this way, through the combination of quantum-resistant signature algorithm and active verification process, the security of the entire process from certificate issuance to use is achieved, and ultimately the technical goal of resisting quantum attacks and maintaining the security of the trust chain is achieved.

[0049] See also Figure 4 , Figure 4A schematic diagram of the structure of a client-side cryptographic service module is provided. As shown in the figure, in some embodiments, the client-side cryptographic service module integrates multiple functions in a lightweight manner, including providing SPHINCS+ signature public and private key generation, ML-KEM encryption public and private key generation, digital envelope decryption, and certificate application CSR file generation, thereby reducing client development and adaptation costs. Specifically, the client-side cryptographic service module consists of a 3-1 cryptographic operation unit, a 3-2 key generation unit, and a 3-3 CSR construction unit. The 3-1 cryptographic operation unit includes a 3-1-1 digital envelope decryption subunit; the 3-2 key generation unit includes a 3-2-1 SPHINCS+ signature public and private key generation subunit and a 3-2-2 ML-KEM encryption public and private key generation subunit; and the 3-3 CSR construction unit includes a 3-3-1 certificate application CSR file generation subunit. The cryptographic service module can be in the form of a dynamic link library (SO), a static library, a JAR package, or other callable program.

[0050] Among them, the cryptographic operation unit is responsible for cryptographic operations, such as encryption and decryption, hash operations and other cryptographic-related operations (such as hash functions (such as SHA-3), symmetric encryption (such as PQC-SM4)), providing post-quantum cryptographic operation capabilities (such as supporting quantum-resistant algorithms such as SPHINCS+ signature and ML-KEM key encapsulation), and using SPHINCS+ private keys to verify the legitimacy of post-quantum signature certificates. The key generation unit is responsible for generating the post-quantum key required in the application documents. The CSR construction unit is responsible for generating certificate application documents. Among them, the CSR construction unit needs to obtain the pre-generated post-quantum key from the key generation unit and fill in the corresponding fields of the CSR. The CSR construction unit relies on the cryptographic operation unit to use the hash function to calculate the CSR content summary and call the SPHINCS+ signature algorithm to sign the summary to ensure the integrity and non-repudiation of the CSR.

[0051] Through the post-quantum certificate management method and certificate management platform provided by several embodiments of the present application, a quantum-resistant dual-certificate system is constructed to achieve the separation of signature and encryption algorithm functions. For example, the signature certificate disclosed in the embodiment of the present application adopts a post-quantum signature algorithm (such as the SPHINCS+ algorithm, which has anti-quantum signature characteristics based on hashing), which can resist signature forgery attacks in quantum computing environments. The encryption certificate disclosed in the embodiment of the present application uses post-quantum encryption technology (such as ML-KEM) to achieve quantum security-level key encapsulation and digital envelope functions. At the same time, the symmetric algorithm has been upgraded, replacing the traditional SM4 with PQC-SM4 (i.e., a variant of SM4 enhanced based on post-quantum cryptography), thereby ensuring that end-to-end encryption has quantum security. In solving key reuse and compatibility issues, with the help of a dual-certificate architecture, a complete isolation of signature and encryption key pairs is achieved, effectively avoiding systemic risks that may be caused by the leakage of a single key. In addition, a standardized X.509 extension field is designed to embed the post-quantum encryption public key issued for the encryption key pair corresponding to the encryption certificate into the certificate application file (CSR). In this way, it is compatible with the existing PKI parsing logic and can achieve a smooth transition effect. In order to improve performance and deployment efficiency, the lightweight integration of the cryptographic service module provided in the embodiment of the present application enables it to have the capabilities of SPHINCS+ signature public and private key generation, ML-KEM encryption public and private key generation, digital envelope unsealing, and certificate application CSR file generation, thereby reducing client development and adaptation costs. At the hardware level of the certificate management platform, by supporting hardware acceleration technology, such as using the ARM SVE2 instruction set, GPU parallel computing, etc., the generation speed of post-quantum signatures is improved. In terms of key management, collaborative management is achieved. For example, the signature private key is securely stored locally on the platform or target entity, and the encryption private key is centrally managed by the Key Management Center (KMC), thereby achieving unified management of the entire key life cycle. In addition, this application focuses on standardization and scalability design, defines the binding rules and verification strategies for dual certificates, provides a security downgrade switch (for example, when the post-quantum signature algorithm verification fails, it is prohibited to fall back to the traditional algorithm) to prevent policy ambiguity problems, and reserves an algorithm parameter upgrade interface to adapt to changes in the NIST post-quantum cryptography standard in the future.

[0052] Another embodiment of the present invention relates to an electronic device, such as Figure 5 As shown, it includes at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the post-quantum certificate management method as described above.

[0053] The memory and processor are connected using a bus, which can include any number of interconnected buses and bridges. The bus connects various circuits of one or more processors and memories. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits. These are all well known in the art and are therefore not described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single component or multiple components, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over a wireless medium via an antenna. Furthermore, the antenna receives data and transmits it to the processor.

[0054] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0055] Those skilled in the art will appreciate that the above-mentioned embodiments are specific examples for implementing the present invention, and that in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present invention.

Claims

1. A post-quantum certificate management method, characterized in that: The method comprises: Obtain a digital certificate application file from the client, the digital certificate application file including SPHINCS+public key; Generate a post-quantum signature certificate based on the SPHINCS+ public key; Configuring an encryption key pair for the digital certificate application file, and generating a post-quantum encryption certificate based on the encryption key pair; Sending the post-quantum signature certificate and the post-quantum encryption certificate to the client.

2. The post-quantum certificate management method according to claim 1, characterized in that: The digital certificate application document also includes the ML-KEM public key; After sending the post-quantum signature certificate and the post-quantum encryption certificate to the client, the method further includes: A digital envelope is created using a hybrid key algorithm, the private key in the encryption key pair, and the ML-KEM public key, and the digital envelope is sent to the client, so that the client decrypts the digital envelope to obtain the private key in the encryption key pair.

3. The post-quantum certificate management method according to claim 2, characterized in that: The hybrid key algorithm is the PQC-SM4 algorithm; The method of using a hybrid key algorithm, the private key in the encryption key pair, and the ML-KEM public key to create a digital envelope includes: Generate a temporary encryption key using the hybrid key algorithm, encrypt the private key in the encryption key pair with the temporary encryption key to obtain a first ciphertext, and encrypt the temporary encryption key with the ML-KEM public key to obtain a second ciphertext; After combining the first ciphertext and the second ciphertext, a digital envelope is obtained.

4. The post-quantum certificate management method according to claim 1, characterized in that: The step of configuring an encryption key pair for the digital certificate application file includes: Generate a number of encryption key pairs according to a preset key generation algorithm to build a key pool; An encryption key pair is determined from the key pool to be paired with the digital certificate application file.

5. The post-quantum certificate management method according to claim 4, characterized in that: The preset key generation algorithm is a post-quantum encryption algorithm, and the encryption key pair is an ML-KEM post-quantum asymmetric encryption key pair; Generating the post-quantum encryption certificate according to the encryption key pair includes: The post-quantum encryption certificate is generated using the public key in the ML-KEM post-quantum asymmetric encryption key pair.

6. The post-quantum certificate management method according to claim 4, characterized in that: The method further comprises: Perform security status verification on the post-quantum encryption certificate and / or the encryption key pair; if the verification fails, revoke the post-quantum encryption certificate and add the post-quantum encryption certificate to a certificate revocation list.

7. The post-quantum certificate management method according to claim 6, characterized in that: After adding the post-quantum encryption certificate to a certificate revocation list, the method further comprises: The certificate revocation list is sent to the client, so that the client can use the private key corresponding to the SPHINCS+ public key to verify the security status of the post-quantum signature certificate.

8. The post-quantum certificate management method according to claim 7, characterized in that: The method further comprises: If it is determined that the encryption key pair is not secure, the currently constructed key pool is stopped from being used, and a new key pool is determined according to the preset key generation algorithm to allocate encryption key pairs based on the new key pool.

9. A certificate management platform, characterized in that: The certificate management platform includes at least a certificate system and a key management system; wherein, The certificate system is used to obtain a digital certificate application file from a client, wherein the digital certificate application file includes SPHINCS+public key; The key management system is used to configure an encryption key pair for the digital certificate application file; The certificate system is further configured to generate a post-quantum signature certificate based on the SPHINCS+ public key, generate a post-quantum encryption certificate based on the encryption key pair, and send the post-quantum signature certificate and the post-quantum encryption certificate to the client.

10. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the post-quantum certificate management method according to any one of claims 1 to 8.

Images