Extensible encryption network protocol implementation method, cryptographic algorithm negotiation method, system, equipment and medium

Abstract

The invention provides an extensible encryption network protocol implementation method, a cryptographic algorithm negotiation method, a system, equipment and a medium, and relates to the technical field of information security. The method comprises the steps of obtaining an algorithm calling request of an application layer; calling a unified program interface of an algorithm compatibility layer according to the information of the cryptographic algorithm to be called; a unified program interface is adopted, and a query request of a to-be-called cryptographic algorithm is initiated to a providing program interface through a core program interface in the algorithm compatibility layer; a program interface is provided, and based on a query request of a to-be-called cryptographic algorithm, a calling method of the to-be-called cryptographic algorithm is queried from a preset cryptographic algorithm list; and calling the to-be-called cryptographic algorithm in the post-quantum cryptographic algorithm library in the extensible layer by providing a program interface. According to the method, the new cryptographic algorithm in the post-quantum cryptographic algorithm library is called, so that the expansibility of the cryptographic algorithm is improved, and the capability of resisting the attack of the quantum algorithm is also improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to an implementation of an extensible encryption network protocol and a cryptographic algorithm negotiation method, system, device and medium. BACKGROUND

[0002] The SSH protocol (Secure Shell) is a network security protocol, mainly used for providing encrypted remote login and data transmission services between clients and servers in an insecure network environment. The security of the SSH protocol, as an important protocol for remote login and data transmission, is crucial for network communication.

[0003] The post-quantum SSH protocol refers to a protocol in which a post-quantum cryptographic algorithm is introduced into the SSH protocol to enhance the ability of the SSH protocol to resist quantum computing attacks. However, the post-quantum SSH protocol has significant defects. Current post-quantum SSH protocol schemes generally use a single fixed algorithm structure design, and the algorithm types and protocol parameters are difficult to adjust flexibly according to actual needs, which cannot adapt to rapidly changing security needs and new application scenarios, and also poses a risk of being broken by quantum algorithms. SUMMARY

[0004] In view of the deficiencies in the prior art described above, the present application provides an implementation of an extensible encryption network protocol and a cryptographic algorithm negotiation method, system, device and medium to solve the problems in the prior art.

[0005] The technical solutions adopted by the embodiments of the present application are as follows: In a first aspect, the embodiments of the present application provide an implementation method of an extensible encryption network protocol, applied to a client or a server, comprising: obtaining an algorithm call request of an application layer, the algorithm call request comprising information of a to-be-called cryptographic algorithm; calling a uniform program interface of an algorithm compatibility layer according to the information of the to-be-called cryptographic algorithm; using the uniform program interface to initiate a query request of the to-be-called cryptographic algorithm to a providing program interface through a core program interface in the algorithm compatibility layer; using the providing program interface to query a calling method of the to-be-called cryptographic algorithm from a preset cryptographic algorithm list based on the query request of the to-be-called cryptographic algorithm; using the providing program interface to load and call the to-be-called cryptographic algorithm in a post-quantum cryptographic algorithm library in an extensible layer according to the calling method of the to-be-called cryptographic algorithm, the post-quantum cryptographic algorithm library comprising at least two post-quantum cryptographic algorithms.

[0006] In an embodiment, the method further comprises: The newly added post-quantum cryptographic algorithm in the post-quantum cryptographic algorithm library is encapsulated into the uniform program interface by using the cryptographic interface encapsulation module in the extensible layer. The calling method of the newly added post-quantum cryptographic algorithm is generated by using the registration intermediate module in the extensible layer. The calling method of the newly added post-quantum cryptographic algorithm is registered into the preset cryptographic algorithm list by using the registration module in the extensible layer.

[0007] In an embodiment, the at least two post-quantum cryptographic algorithms include a domestic post-quantum cryptographic algorithm and an international post-quantum cryptographic algorithm, wherein the domestic post-quantum cryptographic algorithm includes a domestic post-quantum encryption algorithm, a domestic post-quantum decryption algorithm, and a domestic post-quantum encapsulation algorithm.

[0008] In a second aspect, the embodiments of the present application further provide a cryptographic algorithm negotiation method, applied to a client, the method comprising: initiating a cryptographic algorithm negotiation request to a server; the cryptographic algorithm negotiation request comprising a first cryptographic algorithm list supported by the client; the cryptographic algorithm negotiation request being used to make the server perform cryptographic algorithm negotiation according to the first cryptographic algorithm list and a second cryptographic algorithm list supported by the server, to obtain a target cryptographic algorithm list; receiving the target cryptographic algorithm list sent by the server, so that the server performs the implementation method of the extensible encryption network protocol according to any one of the embodiments based on the target cryptographic algorithm list.

[0009] In an embodiment, before the cryptographic algorithm negotiation request is initiated to the server, the method further comprises: adding a first newly added cryptographic algorithm to the first cryptographic algorithm list.

[0010] In a third aspect, the embodiments of the present application further provide a cryptographic algorithm negotiation method, applied to a server, the method comprising: receiving a cryptographic algorithm negotiation request sent by a client; the cryptographic algorithm negotiation request comprising a first cryptographic algorithm list supported by the client; performing cryptographic algorithm negotiation according to the first cryptographic algorithm list and a second cryptographic algorithm list supported by the server, to obtain a target cryptographic algorithm list; sending the target cryptographic algorithm list to the client, so that the client performs the implementation method of the extensible encryption network protocol according to any one of the embodiments based on the target cryptographic algorithm list.

[0011] In an embodiment, before the cryptographic algorithm negotiation request sent by the client is received, the method further comprises: adding a second new cryptographic algorithm to the second cryptographic algorithm list.

[0012] In a fourth aspect, the embodiments of the present application further provide a scalable encryption network protocol system, comprising: an application layer, a quantum-resistant encryption network protocol layer, an algorithm compatibility layer, and a scalable layer; the algorithm compatibility layer is pre-integrated with a uniform program interface, a core program interface, and a provider program interface; the scalable layer is configured with a post-quantum cryptographic algorithm library; The application layer is configured to send an algorithm calling request to the quantum-resistant encryption network protocol layer. The quantum-resistant encryption network protocol layer is configured to implement the method for implementing the scalable encryption network protocol according to any of the embodiments.

[0013] In a fifth aspect, the embodiments of the present application further provide an electronic device, comprising: a processor, a storage medium, and a bus; the storage medium stores program instructions executable by the processor; when the electronic device is running, the processor and the storage medium communicate through the bus; and the processor executes the program instructions to implement the method for implementing the scalable encryption network protocol according to any of the embodiments.

[0014] In a sixth aspect, the embodiments of the present application further provide a readable storage medium, which stores program instructions; when the program instructions are executed by a processor, the method for implementing the scalable encryption network protocol according to any of the embodiments is implemented.

[0015] The method for implementing the scalable encryption network protocol comprises: obtaining an algorithm calling request of an application layer, the algorithm calling request comprising information of a cryptographic algorithm to be called; calling a uniform program interface of an algorithm compatibility layer according to the information of the cryptographic algorithm to be called; initiating a query request of the cryptographic algorithm to be called to a provider program interface through a core program interface in the algorithm compatibility layer by using the uniform program interface; querying a calling method of the cryptographic algorithm to be called from a preset cryptographic algorithm list based on the query request of the cryptographic algorithm to be called by using the provider program interface; and calling the cryptographic algorithm to be called in a post-quantum cryptographic algorithm library in a scalable layer by using the provider program interface and according to the calling method of the cryptographic algorithm to be called, the post-quantum cryptographic algorithm library comprising at least two post-quantum cryptographic algorithms.

[0016] The method is closely combined with the extensible encryption network protocol system, utilizes the cooperative work of each interface, simplifies the algorithm calling process, reduces the application development difficulty, and realizes efficient calling of multiple post-quantum cryptographic algorithms, improves the adaptation capability of the system to the multiple post-quantum cryptographic algorithms, greatly enhances the extensibility and security of the cryptographic algorithm, and can effectively cope with the security challenges brought by quantum computing. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiments will be briefly introduced as follows. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0018] Figure 1 A structural schematic diagram of the extensible encryption network protocol system provided by the embodiments of the present application is shown. Figure 2 One of the flow schematic diagrams of the implementation method of the extensible encryption network protocol provided by the embodiments of the present application is shown. Figure 3 The second flow schematic diagram of the implementation method of the extensible encryption network protocol provided by the embodiments of the present application is shown. Figure 4 One of the flow schematic diagrams of the cryptographic algorithm negotiation method provided by the embodiments of the present application is shown. Figure 5 The second flow schematic diagram of the cryptographic algorithm negotiation method provided by the embodiments of the present application is shown. Figure 6 A remote login flow schematic diagram provided by the embodiments of the present application is shown. Figure 7 A structural schematic diagram of an electronic device provided by the embodiments of the present application is shown. Figure 8 A structural schematic diagram of the implementation device of the extensible encryption network protocol provided by the embodiments of the present application is shown. Figure 9 One of the structural schematic diagrams of the cryptographic algorithm negotiation device provided by the embodiments of the present application is shown. Figure 10 The second structural schematic diagram of the cryptographic algorithm negotiation device provided by the embodiments of the present application is shown. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solutions and advantages of the embodiments of the present application more clear, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are some embodiments of the present application, but not all the embodiments.

[0020] The following detailed description of embodiments of the application provided in the accompanying drawings is not intended to limit the scope of the application claimed, but merely represents selected embodiments of the application. Based upon the embodiments of the application, all other embodiments obtained by persons of ordinary skill in the art without creative work are within the scope of protection of the application.

[0021] Furthermore, the terms "first", "second", and the like in the description and in the claims of the present application and above drawings are used for distinguishing between similar objects, and are not necessarily used to describe a particular sequential or chronological order. It is to be understood that the data so designated are interchangeable that the embodiments of the application described herein can operate in other sequences than the one illustrated or described herein. Furthermore, the terms "comprise", "comprising", "include", "including", and the like are meant to encompass non-exclusive inclusions, such that processes, methods, articles, or apparatuses that comprise, include, or the like a list of steps or elements are not necessarily limited to those steps or elements but can include other not expressly listed steps or elements.

[0022] It should be noted that the features of the embodiments of the application can be combined with each other without conflict.

[0023] Figure 1 The structural schematic diagram of the scalable encryption network protocol system provided by the embodiments of the application is shown in Figure 1 The application provides a scalable encryption network protocol system, comprising: an application layer, a quantum-resistant encryption network protocol layer, an algorithm compatibility layer, and a scalable layer.

[0024] The algorithm compatibility layer is pre-integrated with an envelope application program interface (Envelope API), a core internal application program interface (CoreInternal API), and a provider module application program interface (Provider Module API); the scalable layer is configured with a post-quantum cryptography algorithm library, and the post-quantum cryptography algorithm library stores at least two post-quantum cryptography algorithms. The functions of each layer are explained as follows: 1. The application layer.

[0025] The application layer can be an application program of a client or an application program of a server. Taking the client application program as an example, when a user performs a data transmission operation on the client, the client application program sends an algorithm calling request to the quantum-resistant encryption network protocol layer according to the security requirements of the data, and specifies the required encryption, signature, and other cryptographic operation types and related parameters.

[0026] 2. The quantum-resistant encryption network protocol layer.

[0027] The anti-quantum encryption network protocol layer is used for implementing an extension method of an expandable encryption network protocol. When receiving an algorithm calling request sent by an application layer, the anti-quantum encryption network protocol layer first analyzes the request content, determines a required cryptographic operation and a corresponding post-quantum cryptographic algorithm. Then, the corresponding post-quantum cryptographic algorithm is called through a uniform program interface Envelope API of an algorithm compatibility layer, and data is processed, such as encryption and signature. In a data transmission process, the anti-quantum encryption network protocol layer is also responsible for encapsulating, transmitting and receiving the encrypted data according to a specific network protocol specification, and performing operations such as decryption and signature verification on the data at a receiving end, so as to ensure the integrity and security of the data.

[0028] 3. Algorithm compatibility layer.

[0029] The uniform program interface (Envelope API) is used as a bridge between the application layer and the underlying cryptographic algorithm, and is used for unified management of encryption and decryption, signature, signature verification, key derivation and the like by shielding the differences between the underlying algorithms. For example, when the application layer needs to encrypt data, the application layer only needs to send an encryption request to the Envelope API, without needing to pay attention to a specific post-quantum cryptographic algorithm used to complete the encryption operation, so that the development difficulty and complexity of the application layer are greatly simplified.

[0030] The core program interface (Core Internal API) is mainly used for internal management functions, and is not directly exposed to an application program, and is mainly used for loading and managing a provider module API. When the system is started or a new cryptographic algorithm needs to be called, the Core Internal API accurately loads the corresponding Provider Module API according to system configuration and requirements, so as to ensure normal operation and function implementation of the Provider Module API.

[0031] The provider module API is a key interface for implementing cryptographic algorithm extension, and supports loading of third-party cryptographic algorithms through a post-quantum cryptographic algorithm library. For example, various domestic post-quantum cryptographic algorithms, such as Aigis-Enc and Aigis-Sig, can be registered into the system according to a standard interface format and a registration process of the Provider Module API. After successful registration, the Envelope API can call the registered post-quantum cryptographic algorithms to implement operations such as encryption and decryption of data, so as to effectively improve the extension of the cryptographic algorithm.

[0032] 4. Extension layer.

[0033] The extensible layer is configured with a post-quantum cryptographic algorithm library, and at least two post-quantum cryptographic algorithms are stored in the post-quantum cryptographic algorithm library. In addition to the Aigis-Enc and Aigis-Sig algorithms mentioned above, various internationally recognized or independently developed post-quantum cryptographic algorithms such as Kyber and Dilithium can be added according to actual needs. These algorithms are stored in the algorithm library in the form of standardized interfaces, facilitating loading and calling by the Provider Module API.

[0034] On this basis, the application embodiment further provides an implementation method of an extensible encryption network protocol, which can be generated by any electronic device with computing and processing capabilities, for example, a client device or a server device.

[0035] The implementation method of the extensible encryption network protocol provided by the application is specifically illustrated by a plurality of examples in combination with the accompanying drawings, and the method can be applied to a client or a server.

[0036] Figure 2 One of the flowcharts of the implementation method of the extensible encryption network protocol provided by an embodiment of the application is shown in FIG. 1, and the method comprises the following steps. Figure 2 S101, obtaining an algorithm calling request of an application layer.

[0037] The application layer is an entrance for user operation and system encryption function interaction, which can be an application program of a client or an application program of a server. When a user performs a data transmission operation on the client or the server needs to encrypt stored data, the application layer generates an algorithm calling request according to the security requirements of the data, and the algorithm calling request includes information of a to-be-called cryptographic algorithm, such as a name (for example, Aigis-Enc) and a version number.

[0038] Taking online bank transfer of the client as an example, the client application program generates an algorithm calling request containing a specified post-quantum cryptographic algorithm name and version number according to the requirement of the bank system for transaction data encryption, and sends the algorithm calling request to the anti-quantum encryption network protocol layer.

[0039] S102, calling a unified program interface of an algorithm compatibility layer according to the information of the to-be-called cryptographic algorithm.

[0040] ​After receiving the algorithm calling request of the application layer, the anti-quantum encryption network protocol layer parses the information of the to-be-called cryptographic algorithm. Then, the anti-quantum encryption network protocol layer calls the unified program interface (Envelope API) of the algorithm compatibility layer according to the information. The unified program interface (Envelope API) is a unified management interface between the application layer and the underlying cryptographic algorithm, and is responsible for shielding the differences in the implementation of the underlying algorithm. At this time, it receives the calling request and prepares to uniformly schedule subsequent encryption and decryption operations. For example, after the anti-quantum encryption network protocol layer parses the request to call the Aigis-Enc algorithm, it sends a calling instruction to the Envelope API, and the Envelope API starts the management process of the Aigis-Enc algorithm related operations.

[0041] S103, using the unified program interface, initiating a query request for the to-be-called cryptographic algorithm to the providing program interface through the core program interface in the algorithm compatibility layer.

[0042] After receiving the calling request, the unified program interface (Envelope API) initiates a query request for the to-be-called cryptographic algorithm to the providing program interface (Provider Module API) through the core program interface (Core Internal API) in the algorithm compatibility layer. The core program interface (Core Internal API) mainly undertakes the internal management and interface scheduling functions, and accurately transmits the query requirements of the Envelope API to the Provider Module API.

[0043] For example, the Envelope API inquires about the calling method of the Aigis-Enc algorithm through the Core Internal API to the Provider Module API. The Core Internal API accurately sends the query request to the Provider Module API according to the system internal configuration and interface calling rules.

[0044] S104, using the providing program interface, querying the calling method of the to-be-called cryptographic algorithm from the preset cryptographic algorithm list based on the query request for the to-be-called cryptographic algorithm.

[0045] The preset cryptographic algorithm list stores the name, basic description, algorithm itself, public and private key length involved in the algorithm, security strength level of the algorithm, type of the algorithm (signature algorithm or key encapsulation algorithm), and function address to be called.

[0046] The Provider Module API queries a calling method of the to-be-called cryptographic algorithm from a preset cryptographic algorithm list based on information of the to-be-called cryptographic algorithm after receiving the query request. The preset cryptographic algorithm list is stored in the post-quantum cryptographic algorithm library in the extensible layer.

[0047] The Provider Module API performs accurate matching in the list according to information such as an algorithm name and a version number, and obtains a corresponding calling method. For example, the Provider Module API finds a calling method of the Aigis-Enc algorithm in the preset cryptographic algorithm list for a query request of the Aigis-Enc algorithm, including a function calling format of the Aigis-Enc algorithm, a parameter passing rule, and the like.

[0048] S105, a Provider Module API is used to load and call the to-be-called cryptographic algorithm in the post-quantum cryptographic algorithm library in the extensible layer according to the calling method of the to-be-called cryptographic algorithm.

[0049] After the Provider Module API obtains the calling method of the to-be-called cryptographic algorithm, the to-be-called cryptographic algorithm in the post-quantum cryptographic algorithm library in the extensible layer is first loaded, and then the algorithm is called according to the calling method.

[0050] During the loading process, the Provider Module API reads the to-be-called algorithm from the algorithm library to a running environment such as a memory according to a system resource allocation and an algorithm loading mechanism, and then strictly executes the algorithm according to the calling method, to implement encryption, decryption, signature, signature verification, and the like of data. For example, the Provider Module API loads the Aigis-Enc algorithm to a system running environment, and then performs encryption processing on online bank transfer transaction data according to the previously obtained calling method, to ensure the security of the data in the transmission process.

[0051] The post-quantum cryptographic algorithm library includes at least two post-quantum cryptographic algorithms, covering domestic post-quantum cryptographic algorithms. For example, the post-quantum cryptographic algorithm library can include a domestic post-quantum cryptographic algorithm and an international post-quantum cryptographic algorithm, and the domestic post-quantum cryptographic algorithm includes a domestic post-quantum encryption algorithm, a domestic post-quantum decryption algorithm, and a domestic post-quantum encapsulation algorithm.

[0052] The post-quantum encryption algorithm after domestication may include, for example, an encryption algorithm Aigis-pke.Enc that is safe against plaintext attacks; the post-quantum decryption algorithm after domestication may include, for example, a decryption algorithm Aigis-pke.Dec that is safe against plaintext attacks; and the post-quantum encapsulation algorithm after domestication may include, for example, a key encapsulation algorithm Aigis-enc.Encaps that is safe against ciphertext attacks and a key decapsulation algorithm Aigis-enc.Decaps that is safe against ciphertext attacks.

[0053] Optionally, the method may further include a key pair generation algorithm Aigis-pke.KeyGen that is safe against plaintext attacks, a key pair generation algorithm Aigis-enc.KeyGen that is safe against ciphertext attacks, a key generation algorithm Aigis-sig.KeyGen, a signature generation algorithm Aigis-sig.Sign, and a signature verification algorithm Aigis-sig.Verify.

[0054] In summary, the present application provides an implementation method of an extensible encryption network protocol, which realizes efficient calling of multiple post-quantum cryptographic algorithms. The method is closely combined with the extensible encryption network protocol system, utilizes the cooperative work of various interfaces, simplifies the algorithm calling process, reduces the application development difficulty, and improves the system adaptation capability to multiple post-quantum cryptographic algorithms, greatly enhances the extensibility and security of the cryptographic algorithm, and can effectively cope with the security challenges brought by quantum computing.

[0055] Figure 3 Fig. 2 is a flowchart of an implementation method of an extensible encryption network protocol according to an embodiment of the present application, as shown in the figure, the method of the present application further includes the following steps. Figure 3 S201, using a cryptographic interface encapsulation module in the extensible layer to encapsulate a newly added post-quantum cryptographic algorithm in the post-quantum cryptographic algorithm library into a unified program interface.

[0056] When a new post-quantum cryptographic algorithm needs to be integrated into the system, for example, a newly developed domestic post-quantum cryptographic algorithm X-Cipher, the system administrator or developer adds the algorithm to the post-quantum cryptographic algorithm library. At this time, the cryptographic interface encapsulation module in the extensible layer starts to work, which analyzes the newly added X-Cipher algorithm, identifies its input and output formats, algorithm running logic and other key characteristics, and then encapsulates the X-Cipher algorithm according to the standard interface specification of the unified program interface (Envelope API).

[0057] ​Through encapsulation, the X-Cipher algorithm can interact with the Envelope API in a unified manner, shielding the differences in the underlying implementation of the algorithm, providing convenient conditions for subsequent application layer calls to the algorithm, and ensuring that the application layer calls to the algorithm are completed through the algorithm compatibility layer. For example, the encryption function, decryption function, and other operation interfaces of the X-Cipher algorithm are redefined and wrapped according to the format of the Envelope API, so that they can be directly called by the Envelope API.

[0058] S202, using the registration intermediate module in the extensible layer, generating a calling method of the newly added post-quantum cryptographic algorithm.

[0059] After completing the encapsulation of the newly added post-quantum cryptographic algorithm, the registration intermediate module generates a calling method of the algorithm based on the encapsulated algorithm information. The registration intermediate module analyzes the interface parameters, function call sequence, and other information of the encapsulated X-Cipher algorithm, combines the system's calling rules and resource management mechanism, and generates a complete calling method. The calling method includes the parameter passing method required for algorithm calling, the specific steps of function calling, the exception handling mechanism, and other contents. For example, for the encryption call of the X-Cipher algorithm, the registration intermediate module will clearly specify the format of the input data, the passing method of the key, and the return value and processing flow when an error occurs in the encryption process, etc., forming a detailed calling guide, so that the subsequent system can accurately call the algorithm.

[0060] S203, using the registration module in the extensible layer, registering the calling method of the newly added post-quantum cryptographic algorithm to the preset cryptographic algorithm list.

[0061] After the registration module obtains the calling method of the newly added post-quantum cryptographic algorithm generated by the registration intermediate module, it registers it to the preset cryptographic algorithm list, which is stored in the post-quantum cryptographic algorithm library and is the basis for the system to query and call cryptographic algorithms. The registration module will associate the calling method of the X-Cipher algorithm with the algorithm name, version number, and other information, and accurately add it to the preset cryptographic algorithm list according to a certain storage format and indexing rule. In this way, when the application layer initiates a call request for the X-Cipher algorithm, the provider interface (Provider Module API) can quickly query the calling method of the algorithm from the preset cryptographic algorithm list, thereby realizing the call to the algorithm. For example, the registration module creates a new entry for the X-Cipher algorithm in the preset cryptographic algorithm list, records the detailed information of the calling method and related algorithm identifier, and ensures that the system can efficiently manage and call the algorithm.

[0062] The embodiment supplements the newly added post-quantum cryptographic algorithm extension process, and further improves the implementation method of the extensible encryption network protocol.

[0063] Through the cooperative work of the cryptographic interface encapsulation module, the registration intermediate module and the registration module, the automatic integration of the newly added post-quantum cryptographic algorithm is realized, without the need for large-scale modification of the system core code, thereby reducing the difficulty and cost of algorithm updating. Meanwhile, the extension process enables the system to quickly accept new cryptographic algorithms, enhances the security and adaptability of the system, effectively deals with the changing network security threats, and further improves the extensibility and practical value of the encryption network protocol.

[0064] In summary, the embodiment of the present application provides an implementation method of an extensible encryption network protocol, which has the following advantages: 1. Efficient algorithm calling: through clear and orderly steps, according to the application layer request, through the cooperation of the interfaces of the algorithm compatibility layer, the post-quantum cryptographic algorithm is accurately called from the extensible layer, the calling process is simplified, the application development difficulty is reduced, and the algorithm calling efficiency is improved.

[0065] 2. Strong expansibility: the extensible layer sets the cryptographic interface encapsulation module, the registration intermediate module and the registration module, which can conveniently integrate the newly added post-quantum cryptographic algorithm into the system without large-scale modification of the core code, thereby enhancing the system's ability to accept new cryptographic algorithms and adapting to the development of cryptography and the emergence of new algorithms.

[0066] 3. Dynamic management capability: the newly added cryptographic algorithm can be dynamically added to the cryptographic algorithm list of the client and the server, so that the system can update the cryptographic algorithm in time, enhance the adaptability to new cryptographic algorithms, and effectively deal with the changing network security threats.

[0067] 4. Safe and reliable guarantee: combined with the extensible encryption network protocol system, a reliable cryptographic algorithm basis is provided for data transmission, through encryption, decryption, signature, signature verification and other operations on data, the security and integrity of the data are ensured, and the network communication security and stability are guaranteed.

[0068] The present application also provides a cryptographic algorithm negotiation method, which is applied to a client, Figure 4 As shown in FIG. 1, the method includes the following steps. Figure 4 S301, a cryptographic algorithm negotiation request is initiated to a server.

[0069] ​Before establishing a communication connection or transmitting data with the server, the client device needs to initiate a password algorithm negotiation request to the server. The password algorithm negotiation request contains a first password algorithm list supported by the client, which records the information of various post-quantum password algorithms supported by the client, such as algorithm name (e.g. Aigis-Enc, NewHope, etc.), version number, etc. The purpose of the password algorithm negotiation request is to let the server negotiate the target password algorithm list supported by both parties based on the first password algorithm list provided by the client and the second password algorithm list supported by the server.

[0070] For example, when the client device performs online shopping payment operation, it initiates a password algorithm negotiation request before sending payment data to the server, which contains the information of post-quantum password algorithms such as Aigis-Enc, NewHope, etc. supported by the client, so that the server can negotiate based on this.

[0071] S302, receiving the target password algorithm list sent by the server, so that the server executes the implementation method of the extensible encryption network protocol based on the target password algorithm list.

[0072] After receiving the password algorithm negotiation request from the client, the server compares and analyzes the second password algorithm list supported by itself with the first password algorithm list of the client, finds out the password algorithms supported by both parties, forms a target password algorithm list, and sends the list back to the client. After receiving the target password algorithm list, the client confirms the negotiation result.

[0073] At this time, the server will execute the implementation method of the extensible encryption network protocol based on the target password algorithm list, and perform encryption, decryption, signature, signature verification, etc. on the data transmitted between the server and the client subsequently. For example, the server analyzes and finds out that both parties support Aigis-Enc algorithm, forms a target password algorithm list containing Aigis-Enc algorithm and sends it to the client. After that, when processing the payment data of the client, the server will call Aigis-Enc algorithm to encrypt the payment data according to the implementation method of the extensible encryption network protocol, to ensure the security of data transmission.

[0074] Before initiating the password algorithm negotiation request to the server, the client can also perform the following operation: adding the first new password algorithm to the first password algorithm list. When the client obtains a new password algorithm (such as a new domestic post-quantum password algorithm X-Cipher) and confirms that the algorithm is suitable for its own security requirements and system environment after evaluation, the client will add the related information (including algorithm name, version number, function description, etc.) of the first new password algorithm to the first password algorithm list.

[0075] The adding process can be manually configured by a system administrator, or automatically added to the list by a preset automatic updating program when a new algorithm is detected to be available. For example, the client detects that the X-Cipher algorithm has advantages in security and performance, and automatically adds it to the first cipher algorithm list. After that, when initiating a cipher algorithm negotiation request, the algorithm information will be included in the request, and the cipher algorithm negotiation process between the participating client and the server is improved, which improves the support ability and negotiation flexibility of the client for new cipher algorithms.

[0076] Taking an online file storage service as an example, a user accesses a cloud server using a client application installed on a personal computer to perform a file upload operation. Before preparing to upload a file, the client application initiates a post-quantum encryption cipher algorithm negotiation request to the server, and the request includes a list of post-quantum cipher algorithms supported by the client, such as Aigis-Enc, Kyber, etc. After receiving the request, the server compares its supported cipher algorithm list with the received list, and finds that both parties support the Aigis-Enc algorithm, so it sends the Aigis-Enc algorithm to the client as a target cipher algorithm list. After receiving and confirming the target cipher algorithm list, the server performs the implementation method of the extensible encryption network protocol based on the Aigis-Enc algorithm to encrypt the file uploaded by the client, ensuring the security of the file during transmission and storage.

[0077] If a new efficient post-quantum cipher algorithm X-Cipher is obtained by the client during use, the client adds the X-Cipher algorithm to the first cipher algorithm list. Before the next communication with the server, the cipher algorithm negotiation request initiated by the client will include the X-Cipher algorithm information, and the server will re-negotiate according to the new request. If both parties support the algorithm, it can be included in the target cipher algorithm list for encryption of subsequent communication data, thereby continuously improving the security and adaptability of the file storage service.

[0078] The application also provides a cipher algorithm negotiation method applied to a server, Figure 5 A flowchart of a cipher algorithm negotiation method provided by an embodiment of the application is shown in FIG. 2, which includes the following steps. Figure 5 S401, receiving a cipher algorithm negotiation request sent by a client.

[0079] ​The server device waits to receive a password algorithm negotiation request sent by the client when establishing a communication connection with the client or preparing to receive client data. The password algorithm negotiation request contains a first password algorithm list supported by the client, which details the relevant information of various post-quantum password algorithms supported by the client, such as algorithm name (for example, Aigis-Enc, NewHope, etc.), version number, algorithm characteristics, etc. For example, when a user initiates a transfer operation through a mobile client to an online bank server, the mobile client will first send a password algorithm negotiation request to the bank server, and the first password algorithm list in the request may contain various post-quantum password algorithms supported by the client. The server accurately receives the request and the list information to prepare for subsequent negotiation.

[0080] S402, performing password algorithm negotiation according to the first password algorithm list and a second password algorithm list supported by the server, to obtain a target password algorithm list.

[0081] After the server receives the password algorithm negotiation request of the client, it compares and analyzes the first password algorithm list provided by the client with the second password algorithm list supported by the server in detail. The second password algorithm list of the server stores information of various post-quantum password algorithms supported by the server. By comparing the algorithm name, version number and other information in the two lists one by one, the password algorithms supported by both parties are found out. These commonly supported password algorithms will constitute the target password algorithm list. For example, the second password algorithm list of the server contains Aigis-Enc, CRYSTALS-Kyber algorithms, and after comparing with the first password algorithm list of the client, it is found that both parties support the Aigis-Enc algorithm, so the Aigis-Enc algorithm will be included in the target password algorithm list. In the actual negotiation process, if there are multiple commonly supported algorithms, the server can sort these algorithms according to the preset priority rules (such as security priority, performance priority, etc.) to finally determine the specific content and order of the target password algorithm list.

[0082] S403, sending the target password algorithm list to the client, so that the client performs the implementation method of the extensible encryption network protocol based on the target password algorithm list.

[0083] The server determines the target password algorithm list and sends the list back to the client. After the client receives and confirms the target password algorithm list, both parties will perform the implementation method of the extensible encryption network protocol based on the list. In the subsequent data transmission process, the server performs encryption, decryption, signature, signature verification and other operations on the data sent by the client according to the algorithm in the target password algorithm list, to ensure the security and integrity of the data. For example, in the above online bank transfer scenario, the server sends the target password algorithm list containing the Aigis-Enc algorithm to the client, and after the client confirms, the server will call the Aigis-Enc algorithm to encrypt the data when receiving the transfer data of the client, to ensure the security of the transfer information in the transmission process.

[0084] Before receiving the password algorithm negotiation request sent by the client, the server can also perform the following operation: adding the second new password algorithm to the second password algorithm list. When the server obtains a new post-quantum password algorithm (such as the new international post-quantum password algorithm Z-Protect), and after security evaluation and performance testing, it is confirmed that the algorithm meets the security policy and operation requirements of the server, the server will add the related information (including algorithm name, version number, function description, applicable scene, etc.) of the second new password algorithm to the second password algorithm list. The addition process can be completed manually by the system administrator, or can be realized through the automatic update program preset by the server. For example, the automatic update program of the server detects that the Z-Protect algorithm performs excellently in security and processing efficiency, and automatically adds it to the second password algorithm list. In this way, in subsequent password algorithm negotiation with the client, the newly added Z-Protect algorithm has the opportunity to participate in the negotiation, and if the client also supports the algorithm, it can be included in the target password algorithm list, thereby improving the security and adaptability of data encryption between the server and the client.

[0085] The password algorithm negotiation method provided by the above embodiment can quickly and accurately determine the target password algorithm list supported by both the client and the server through negotiation based on the password algorithm list between the client and the server, provides a reliable password algorithm basis for the implementation of the extensible encryption network protocol, and guarantees the security of network communication. At the same time, the newly added password algorithm can be dynamically added to the password algorithm list supported by the client and the server, so that the client and the server can timely adapt to new password algorithms, improve the expansibility and adaptability of the system to password algorithms, and effectively cope with the changing network security threats.

[0086] After the algorithm negotiation between the client and the server is completed, remote login can also be performed, which will be described below in combination with Figure 6 The method of remote login between the client and the server using the post-quantum SSH protocol will be described exemplarily.

[0087] In Figure 6 In the example shown, the participating subjects are a client and a server, which are connected based on a network, have completed PQC-SM2 cryptographic algorithm negotiation, and have determined to use the algorithm for subsequent session communication. The following is the session establishment process: 1. Algorithm addition notification (message 1) After successfully adding the PQC+SM2 algorithm in the client's algorithm list, the client actively sends a "client adds PQC+SM2 algorithm to the algorithm list" message to the server. This message is used to inform the server that the client supports the target algorithm, preparing for subsequent negotiation and session establishment. For example, the client is a financial App, after completing the integration and adaptation of the PQC+SM2 algorithm, it sends this notification to the financial server to ensure that the server knows that the client has the algorithm capability.

[0088] 2. Algorithm negotiation confirmation (message 2) After receiving message 1, the server performs algorithm negotiation matching based on its own algorithm support list (which has been pre-configured to support PQC+SM2 algorithm). Since the server also supports PQC+SM2 algorithm, it selects this algorithm and returns a "password algorithm negotiation selects PQC+SM2 algorithm, returns to client" message to the client. This step specifies the cryptographic algorithm used by both parties for the session, which is the basis for session establishment and ensures consistency in subsequent encrypted communication.

[0089] 3. Client key exchange (message 3) After receiving message 2 and confirming the use of PQC+SM2 algorithm, the client generates session key-related parameters (such as public key, temporary key, etc.) using the algorithm, and sends them to the server through the "client uses supported PQC+SM2 cryptographic negotiation algorithm for session key exchange" message. For example, the client uses the key generation mechanism of the PQC+SM2 algorithm to generate a public key PubC, which is encapsulated in message 3 and transmitted to the server for subsequent key negotiation.

[0090] 4. Server key exchange (message 4) After receiving message 3, the server also generates its own session key parameters (such as server public key PubS, temporary key, etc.) based on the PQC+SM2 algorithm, and sends them to the client through the "server uses supported PQC+SM2 cryptographic negotiation algorithm for session key exchange" message. At the same time, the server combines the client's and its own key parameters to generate a session key (such as calculating a shared session key SK using PubC and PubS through the key negotiation algorithm) according to the PQC+SM2 algorithm process.

[0091] 5. Public key and permission information transmission (message 5) After the server generates the session key, it sends the "server sends PQC+SM2 public key and public key authorization information" message to the client. The PQC+SM2 public key is used by the client to verify the server's identity and subsequent encrypted communication, and the public key authorization information includes the valid range of the public key, usage rights (such as login authentication, business data encryption, etc.), and other content. For example, the server sends the public key PubS and the authorization information "this public key is only used for this session login and business data interaction, valid for 30 minutes" to the client, ensuring the security and compliance of key usage.

[0092] 6. Login request (message 6) After receiving message 5, the client verifies the legality of the server's public key and authorization information, and uses the PQC+SM2 public key or the login key protected by the session key (such as encrypting the login password, user identifier, etc. using the session key SK) to initiate a login request to the server through the "login using PQC+SM2 public key or public key protected login key" message. For example, the client encapsulates the user account "user001" and the encrypted password (encrypted using SK) in message 6 and sends it to the server, ensuring that the login information is securely protected during transmission.

[0093] 7. Login authentication feedback (message 7) After receiving message 6, the server decrypts the login information using the session key SK, verifies the user's identity (such as checking the account password and verifying the user's rights). If the verification is successful, it returns a "login success" message to the client, completing the login authentication; if the verification fails, it returns an appropriate error prompt (such as incorrect account password, insufficient rights, etc.). After successful login, the client and server can securely conduct subsequent business data interaction (such as transaction data transmission, user information query, etc.) based on the PQC+SM2 algorithm and the session key.

[0094] The present application also provides an electronic device, which can be a client device or a server device, Figure 7 The structure diagram of the electronic device provided by the present application is shown in Figure 7 As shown, the electronic device includes a processor 100, a storage medium 200, and a bus 300. The storage medium stores program instructions executable by the processor. When the electronic device is running, the processor communicates with the storage medium through the bus. The processor executes the program instructions to implement the implementation method of the extensible encryption network protocol described in any of the above embodiments.

[0095] The present application also provides a readable storage medium, which stores program instructions. When the program instructions are executed by a processor, the implementation method of the extensible encryption network protocol described in any of the above embodiments is implemented.

[0096] The implementation method of the extensible encryption network protocol, the device and the equipment for the method of negotiating a cryptographic algorithm, and the storage medium are explained as follows, and the specific implementation process and the technical effects are the same as those of the corresponding method embodiments. For brevity, the unmentioned parts in the following embodiments can be referred to the corresponding contents in the method embodiments.

[0097] Figure 8 A structural diagram of an implementation device of an extensible encryption network protocol provided in an embodiment of the present application is shown in the figure. The device is applied to a client or a server. As shown in the figure, the device includes the following components. Figure 8 An acquisition module 10 is configured to acquire an algorithm calling request of an application layer. The algorithm calling request includes information of a cryptographic algorithm to be called.

[0098] A calling module 20 is configured to call a uniform program interface of an algorithm compatibility layer according to the information of the cryptographic algorithm to be called.

[0099] A first initiation module 30 is configured to initiate a query request of the cryptographic algorithm to be called to a providing program interface through a core program interface in the algorithm compatibility layer by using the uniform program interface.

[0100] A query module 40 is configured to query a calling method of the cryptographic algorithm to be called from a preset cryptographic algorithm list based on the query request of the cryptographic algorithm to be called by using the providing program interface.

[0101] A loading module 50 is configured to load and call the cryptographic algorithm to be called in a post-quantum cryptographic algorithm library in an extensible layer according to the calling method of the cryptographic algorithm to be called by using the providing program interface. The post-quantum cryptographic algorithm library includes at least two post-quantum cryptographic algorithms.

[0102] Optionally, the device further includes a packaging module configured to package a new post-quantum cryptographic algorithm in the post-quantum cryptographic algorithm library into the uniform program interface by using a cryptographic interface packaging module in the extensible layer; generate a calling method of the new post-quantum cryptographic algorithm by using a registration intermediate module in the extensible layer; and register the calling method of the new post-quantum cryptographic algorithm to the preset cryptographic algorithm list by using a registration module in the extensible layer.

[0103] Figure 9 A structural diagram of a cryptographic algorithm negotiation device provided in an embodiment of the present application is shown in the figure. The device is applied to a client. The device includes the following components. Figure 9 ​​The second initiating module 60 is configured to initiate a password algorithm negotiation request to the server, wherein the password algorithm negotiation request comprises a first password algorithm list supported by the client; and the password algorithm negotiation request is used to make the server perform password algorithm negotiation according to the first password algorithm list and a second password algorithm list supported by the server, to obtain a target password algorithm list.

[0104] The second receiving module 70 is configured to receive the target password algorithm list sent by the server, so that the server performs the implementation method of the extensible encryption network protocol according to any one of the preceding embodiments based on the target password algorithm list.

[0105] Optionally, the apparatus further comprises a first adding module configured to add a first newly-added password algorithm to the first password algorithm list.

[0106] Figure 10 A second structural diagram of a password algorithm negotiation apparatus provided by the embodiments of the present application is shown in FIG. 2, which is applied to a server, and the apparatus comprises: Figure 10 The third receiving module 80 is configured to receive a password algorithm negotiation request sent by the client, wherein the password algorithm negotiation request comprises a first password algorithm list supported by the client.

[0107] The negotiation module 90 performs password algorithm negotiation according to the first password algorithm list and a second password algorithm list supported by the server, to obtain a target password algorithm list; and sends the target password algorithm list to the client, so that the client performs the implementation method of the extensible encryption network protocol according to any one of the preceding embodiments based on the target password algorithm list.

[0108] Optionally, the apparatus further comprises a second adding module configured to add a second newly-added password algorithm to the second password algorithm list.

[0109] The apparatus is used to perform the method provided by the preceding embodiments, and has similar implementation principles and technical effects, which are not described here in detail.

[0110] ​The above modules can be one or more integrated circuits configured to implement the above methods, for example, one or more application specific integrated circuits (ASICs), or one or more microprocessors, or one or more field programmable gate arrays (FPGAs), etc. For another example, when a certain module above is implemented in the form of a processing element scheduling code, the processing element can be a general purpose processor, such as a central processing unit (CPU) or other processor that can invoke code. For another example, the modules can be integrated together to implement a system-on-a-chip (SOC).

[0111] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented in other manners. For example, the described apparatus embodiments are merely schematic. The division of the units is merely a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be electrical, mechanical or in other forms.

[0112] The units described as separated components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e., can be located in one place or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purposes of the embodiments.

[0113] In addition, each functional unit in the embodiments of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be implemented in the form of hardware or hardware plus software function unit.

[0114] The integrated unit implemented in the form of the software function unit can be stored in a computer readable storage medium. The software function unit is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute part of steps of the method described in various embodiments of the present application. The foregoing storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media capable of storing program codes.

[0115] The above merely provides the specific implementation of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of the changes or replacements within the technical range disclosed in the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for implementing an extensible encryption network protocol, characterized in that: Applied to a client or a server, the method includes: Obtaining an algorithm call request from the application layer, the algorithm call request including: information about the cryptographic algorithm to be called; Calling the unified program interface of the algorithm compatibility layer according to the information of the cryptographic algorithm to be called; Using the unified program interface, a query request for the cryptographic algorithm to be called is initiated to the provider program interface through the core program interface in the algorithm compatibility layer; Using the provider interface, based on the query request of the cryptographic algorithm to be called, querying the calling method of the cryptographic algorithm to be called from the preset cryptographic algorithm list; The provider interface is adopted to load and call the cryptographic algorithm to be called in the post-quantum cryptographic algorithm library in the scalable layer according to the calling method of the cryptographic algorithm to be called, wherein the post-quantum cryptographic algorithm library includes: at least two post-quantum cryptographic algorithms.

2. The method according to claim 1, characterized in that The method further comprises: Using the cryptographic interface encapsulation module in the scalable layer, encapsulate the newly added post-quantum cryptographic algorithm in the post-quantum cryptographic algorithm library into the unified program interface; Using the registration intermediate module in the scalable layer to generate a calling method for the newly added post-quantum cryptographic algorithm; The registration module in the scalable layer is used to register the calling method of the newly added post-quantum cryptographic algorithm in the preset cryptographic algorithm list.

3. The method according to claim 1, characterized in that The at least two post-quantum cryptographic algorithms include: a domestic post-quantum cryptographic algorithm and an international post-quantum cryptographic algorithm, wherein the domestic post-quantum cryptographic algorithm includes: a domestic post-quantum encryption algorithm, a domestic post-quantum decryption algorithm, and a domestic post-quantum encapsulation algorithm.

4. A cryptographic algorithm negotiation method, characterized in that: Applied to a client, the method includes: Initiating a cryptographic algorithm negotiation request to a server; the cryptographic algorithm negotiation request includes: a first cryptographic algorithm list supported by the client; the cryptographic algorithm negotiation request is used to cause the server to perform cryptographic algorithm negotiation based on the first cryptographic algorithm list and a second cryptographic algorithm list supported by the server, to obtain a target cryptographic algorithm list; Receive the target cryptographic algorithm list sent by the server, so that the server executes the implementation method of the extensible encryption network protocol according to any one of claims 1 to 3 based on the target cryptographic algorithm list.

5. The method according to claim 4, characterized in that Before initiating a cryptographic algorithm negotiation request to the server, the method further includes: Add the first newly added cryptographic algorithm to the first cryptographic algorithm list.

6. A cryptographic algorithm negotiation method, characterized in that: Applied to the server, the method includes: Receiving a cryptographic algorithm negotiation request sent by a client; the cryptographic algorithm negotiation request includes: a first cryptographic algorithm list supported by the client; Perform cryptographic algorithm negotiation based on the first cryptographic algorithm list and the second cryptographic algorithm list supported by the server to obtain a target cryptographic algorithm list; The target cryptographic algorithm list is sent to the client, so that the client executes the implementation method of the extensible encryption network protocol according to any one of claims 1 to 3 based on the target cryptographic algorithm list.

7. The method according to claim 6, characterized in that Before receiving the cryptographic algorithm negotiation request sent by the client, the method further includes: Add the second newly added cryptographic algorithm to the second cryptographic algorithm list.

8. An extensible encryption network protocol system, characterized in that: include: Application layer, quantum-resistant encryption network protocol layer, algorithm compatibility layer, and scalability layer; the algorithm compatibility layer is pre-integrated with a unified program interface, a core program interface, and a provider program interface; the scalability layer is configured with a post-quantum cryptographic algorithm library; The application layer is used to send an algorithm call request to the quantum-resistant encryption network protocol layer; The quantum-resistant encryption network protocol layer is used to execute the implementation method of the scalable encryption network protocol described in any one of claims 1-3 above.

9. An electronic device, characterized in that: include: A processor, a storage medium, and a bus, wherein the storage medium stores program instructions executable by the processor. When the electronic device is running, the processor and the storage medium communicate via the bus, and the processor executes the program instructions to implement the implementation method of the scalable encrypted network protocol described in any one of claims 1 to 3.

10. A readable storage medium, characterized in that: The readable storage medium stores program instructions, and the program instructions are used by a processor to implement the method for implementing the extensible encryption network protocol according to any one of claims 1 to 3 when executed.

Images