Lattice-based semi-quantum key distribution method and equipment

Abstract

The invention provides a lattice-based semi-quantum key distribution method and equipment. The method comprises the steps that a public key and trap door information are generated based on a generation algorithm of a lattice-based noisy trap door claw-free function, and a classic user side sends the public key to a quantum server; receiving image information, bit string information and measurement base information sent by the quantum server; performing inversion processing on image information based on an inversion algorithm of a lattice-based noisy trap door claw-free function and trap door information, calculating an exact state of a quantum state in a quantum server according to an inversion result, the image information and bit string information, and determining a session key of a classic user side based on the exact state of the quantum state and measurement base information; and the classic user side judges the correctness of the measurement base information and sends a correctness judgment result of the measurement base information to the quantum server, and the quantum server further derives a session key consistent with the classic user side. According to the embodiment, a quantum channel is not needed, and post-quantum provable security is achieved.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of quantum cryptography, and particularly relates to a lattice-based semi-quantum key distribution method and device. BACKGROUND

[0002] The BB84 quantum key distribution (QKD) protocol is a quantum cryptography achievement with epoch-making significance. The BB84-QKD protocol realizes unconditional security in the information theory sense by introducing a quantum channel and using quantum mechanics principles.

[0003] However, the quantum channel is difficult to build and has extremely high cost, poor scalability and stability; meanwhile, the key distribution process of the BB84-QKD protocol still needs to realize identity authentication based on a classical channel, so that the overall security still needs to rely on the computational difficulty assumption.

[0004] In addition, quantum computing resources are costly, and an important application scenario in the future is that a classical user only interacts with a large quantum server through a classical communication channel. This mode is called the "quantum computing-classical communication" (QCCC) model. Under the QCCC model, how to negotiate a classical session key with quantum randomness through only a classical channel while allowing the use of quantum computing power of the quantum server is a key scientific problem. SUMMARY

[0005] Therefore, the purpose of the present disclosure is to provide a lattice-based semi-quantum key distribution method and device.

[0006] To achieve the above purpose, the present disclosure provides a lattice-based semi-quantum key distribution method according to a first aspect, applied to a classical user end, comprising:

[0007] generating a public key and trapdoor information based on a generation algorithm of a lattice-based noisy trapdoor claw-free function, and sending the public key to a quantum server;

[0008] receiving image information, bit string information and measurement basis information sent by the quantum server, wherein the image information and the bit string information are obtained by processing the public key according to a sampling algorithm of the lattice-based noisy trapdoor claw-free function;

[0009] performing inverse processing on the image information based on an inverse algorithm of the lattice-based noisy trapdoor claw-free function and the trapdoor information, calculating the exact state of a quantum state in the quantum server according to the inverse result and the image information and the bit string information, and determining a session key on the classical user end side based on the exact state of the quantum state and the measurement basis information;

[0010] judging correctness of the measurement base information, and sending the correctness judging result of the measurement base information to the quantum server, so that the quantum server obtains the session key of the quantum server side based on the correctness judging result of the measurement base information.

[0011] In some embodiments, the calculating the exact state of the quantum state in the quantum server according to the inverse result and the image information and the bit string information comprises:

[0012] processing the image information based on a random oracle model to obtain random information of the image information;

[0013] calculating the exact state of the quantum state in the quantum server based on the random information, the inverse result and the bit string information.

[0014] In some embodiments, the determining the session key of the classical user side based on the exact state of the quantum state and the measurement base information comprises:

[0015] determining the session key of the classical user side based on the mapping and encoding relationship between the exact state of the quantum state and the measurement base information and the BB84 protocol.

[0016] The second aspect of the present disclosure provides a lattice-based semi-quantum key distribution method applied to a quantum server, comprising:

[0017] receiving a public key sent by a classical user, the public key being generated based on a lattice-based no-claw function with a noisy trapdoor;

[0018] sampling the public key based on a sampling algorithm of the lattice-based no-claw function with a noisy trapdoor to obtain image information and an entangled state of claws;

[0019] preparing a quantum state based on the image information and the entangled state of claws, and measuring the quantum state to obtain bit string information and a BB84 quantum state;

[0020] randomly selecting measurement base information, and sending the image information, the bit string information and the measurement base information to the classical user;

[0021] receiving a correctness judging result of the measurement base information sent by the classical user, and determining a measurement result of the quantum state based on the correctness judging result of the measurement base information;

[0022] determining the session key of the quantum server side based on the measurement result.

[0023] In some embodiments, the preparing the quantum state based on the image information and the entangled state of claws comprises:

[0024] Process the image information based on a random oracle model to obtain random information of the image information.

[0025] Process the superposition state of the claw based on the random information through a controllable non-gate to obtain the quantum state.

[0026] In some embodiments, the measuring the quantum state to obtain bit string information and a BB84 quantum state comprises:

[0027] Performing Hadamard measurement on a second register of the quantum state to obtain the bit string information.

[0028] The first register of the quantum state collapses into a random BB84 state.

[0029] In some embodiments, the determining the session key of the quantum server side based on the measurement result comprises:

[0030] Determining the session key of the quantum server side based on the measurement result and a preset mapping and encoding relationship between the session key and the BB84 protocol.

[0031] A third aspect of the present disclosure provides a classical user end, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the lattice-based semi-quantum key distribution method according to the first aspect when executing the program.

[0032] A fourth aspect of the present disclosure provides a quantum server, comprising a quantum memory, a quantum processor, and a quantum computer program stored in the memory and executable on the processor, wherein the processor implements the lattice-based semi-quantum key distribution method according to the second aspect when executing the program.

[0033] A fifth aspect of the present disclosure provides a lattice-based semi-quantum key distribution system, comprising the classical user end according to the third aspect and the quantum server according to the fourth aspect.

[0034] As can be seen from the above, the lattice-based semi-quantum key distribution method and device provided by the present disclosure uses a lattice-based noisy trapdoor claw-free function to construct a BB84-QKD protocol, avoids the introduction of a quantum channel in the traditional BB84-QKD protocol, is suitable for a cryptographic application scenario in which a classical user device and a quantum server only interact through a classical channel, has post-quantum provable security, and the security is based on the quantum-resistant difficulty of the standard LWE on a lattice, which can ensure the security during the interaction process and achieve a balance between security and practicality. BRIEF DESCRIPTION OF DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the present disclosure or the related art, the drawings needed to be used in the embodiments or the related description will be briefly introduced. Obviously, the drawings in the following description are only embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without any creative effort based on these drawings.

[0036] Figure 1 A flowchart of an exemplary method provided by an embodiment of the present disclosure is shown.

[0037] Figure 2 An interaction diagram of an exemplary method provided by an embodiment of the present disclosure is shown.

[0038] Figure 3 A flowchart of an exemplary method provided by an embodiment of the present disclosure is shown.

[0039] Figure 4 A hardware structure diagram of an exemplary computer device provided by an embodiment of the present disclosure is shown.

[0040] Figure 5 A hardware structure diagram of an exemplary computer device provided by an embodiment of the present disclosure is shown.

[0041] Figure 6 A framework diagram of an exemplary system provided by an embodiment of the present disclosure is shown.

[0042] Figure 7 An interaction diagram of an exemplary method provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0043] In order to make the purposes, technical solutions and advantages of the present disclosure clearer, the present disclosure will be further described in detail with specific embodiments and with reference to the drawings.

[0044] It should be noted that, unless otherwise defined, technical terms or scientific terms used in the embodiments of the present disclosure shall have the common meaning understood by one of ordinary skill in the art to which the present disclosure belongs. The terms "first", "second", and similar terms used in the embodiments of the present disclosure do not denote any order, quantity, or importance, but are used to distinguish different components. The terms "include", "contain", and similar terms mean that the elements or objects before the terms encompass the elements or objects listed after the terms and their equivalents, and do not exclude other elements or objects. The terms "connect" or "connected" and similar terms are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. The terms "upper", "lower", "left", "right", and the like are used only to represent relative positional relationships, and when the absolute positions of the described objects are changed, the relative positional relationships can also be changed accordingly.

[0045] The BB84 protocol is a commonly used quantum key distribution protocol. The basic principle of the BB84 protocol is to use the characteristics of quantum bits through a quantum channel to achieve secure key distribution. Two different polarization modes are prepared, and the polarization channels corresponding to 0 and 1 are two orthogonal polarization modes, for example, horizontal and vertical polarization modes, or diagonal and anti-diagonal polarization modes. A polarization mode is randomly selected, and a quantum bit is sent to a quantum server (Bob). The quantum server (Bob) also randomly selects a polarization mode to measure the received quantum bit. The user end (Alice) and the quantum server (Bob) confirm their selected polarization modes through a public channel. If the polarization modes selected by the user end (Alice) and the quantum server (Bob) are the same, the quantum server (Bob) can successfully measure the bit value sent, otherwise he will get a random value.

[0046] The core of the quantum channel is that when an eavesdropper attempts to measure the quantum state, it will inevitably interfere with the quantum state, which will be detected by the legitimate user. This mechanism relying on the basic principles of quantum mechanics makes the key distribution process reach the security level of information theory, so it no longer relies on the computational complexity assumption in traditional cryptography.

[0047] As described in the background, the physical construction of the quantum channel faces many technical challenges: for example, the loss problem in optical fiber quantum signal transmission, the destruction of quantum states by noise interference, and the vulnerability of quantum channels to environmental conditions such as temperature and vibration; at the same time, the transmission distance of quantum signals is limited by existing technologies (such as the physical bottleneck of quantum repeaters and quantum entanglement distribution), which makes the construction cost of quantum channels extremely high in large-scale deployment, and also limits the actual scalability and stability of the system.

[0048] In addition, although the BB84-QKD protocol can achieve unconditional security in the quantum channel, the distribution process still needs to use the classical channel for base matching, eavesdropping detection and information verification. This means that the security of the entire system is still affected by the classical channel, i.e., the overall security of the system is still subject to the "bucket principle". If the security of the classical channel depends on the computational assumption (such as public key cryptography), the attacker can still indirectly threaten the security of key distribution by breaking the classical channel.

[0049] Therefore, the present disclosure provides a lattice-based semi-quantum key distribution method, which can ensure the post-quantum security of the communication process through only classical channel interaction between the classical device and the quantum server.

[0050] As shown in Figure 1 , the lattice-based semi-quantum key distribution method is applied to a classical user end (Alice) and includes the following steps:

[0051] In step S101, a public key and trapdoor information are generated based on a lattice-based noisy trapdoor claw function key generation algorithm, and the public key is sent to a quantum server.

[0052] In some embodiments, the noisy trapdoor claw function family (NTCF family) refers to: let λ be a security parameter, and are finite sets, is a finite key set. If a function family is called a noisy trapdoor claw function family (Noisy trapdoor claw free (NTCF) family), it must satisfy the following four conditions:

[0053] Condition 1: Efficient Function Generation: there is an efficient probabilistic algorithm that can generate a public key and a trapdoor t k :

[0054] Condition 2: Trapdoor Injective Pair:

[0055] (a) Trapdoor refers to: there is an efficient deterministic algorithm such that for all possible generated by , in most cases, the following condition is satisfied: for all b∈{0,1}, and y∈Supp(f k,b(x)) all have

[0056] (b) An injective pair is defined as: for all There exists a perfect Make f k,0 (x0)=f k,1 (x1), if and only if

[0057] Condition 3, Efficient Range Superposition: For all public keys For b∈{0,1}, there exists a function The following conditions must be met:

[0058] (a) For all and y∈Supp(f′) k,b (x)) all have as well as

[0059] (b) There exists an efficient deterministic algorithm. This satisfies the condition that when the input k,b∈{0,1}, and When y∈Supp(f′) k,b (x)), then the algorithm The output is 1; otherwise, the output is 0. Note the algorithm. The trap will not be revealed. k .

[0060] (c) For every k and b∈{0,1}, we have

[0061]

[0062] Where negl(·) is a negligible function, H 2 (·) represents the Hellinger distance. Furthermore, there exists an efficient algorithm... The algorithm outputs a quantum state given input k, b ∈ {0, 1}.

[0063]

[0064] The superposition state of the claw can be obtained by measuring the last register containing the image information.

[0065] Condition 4, Claw-Free Property: For any PPT opponent There exists a negligible function negl(·) such that the following condition holds:

[0066]

[0067] Where Pr[·] is a probability operation, and the meaning of this condition is: The probability of it occurring is negligible.

[0068] In this embodiment, the lattice-based noisy trapdoor clawless function is constructed based on the quantum intractability assumption of the fault-tolerant learning problem (LWE).

[0069] Among them, the fault-tolerant learning problem (LWE) refers to: Let λ be a safety parameter, Let χ = ​​χ(λ) be an integer function of λ. Distribution on LWE n,m,q,χ The problem is defined as: distinguishing between two distributions (A, As+e(mod q)) and (A, u), where Typically, we consider solving the LWE problem for any polynomial function satisfying m is at most nlogq, therefore the problem can be represented as LWE n,q,χ .

[0070] LWE n,q,χ The quantum intractability hypothesis states that, given the parameters n, m, q, χ of the corresponding LWE problem, even if quantum states of LWE samples of quantum polynomial size can be obtained, there is no solution to the LWE problem with an advantage exceeding negl(λ). n,q,χ A quantum polynomial-time algorithm for the problem.

[0071] Based on the above, the construction of the trapdoor function based on LWE includes: Let n, m≥1, q be a modulus and q≥2 satisfying m=Ω(nlogq), and there exists an effective random function GenTrap(1 n ,1 m ,q), can output a matrix and a trapdoor A The distribution of A satisfies the indistinguishability from a uniform distribution. Furthermore, there exists an efficient algorithm, INVERT, that satisfies the condition that when the input is A, t... A and As+e, where C T It is a universal constant, and the algorithm outputs s and e with an absolutely high probability, where (A,t) A )←GenTrap(1 n ,1 m ,q).

[0072] based on Quantum intractability hypothesis, function family To form a noisy trapdoor-free function family, the relevant parameters need to satisfy conditions (a)-(e):

[0073] (a) λ is a safety parameter;

[0074] (b)

[0075] (c)m=Ω(nlogq);

[0076] (d)

[0077] (e)B L V P And satisfy B P / B V and B V / B L All are hyperpolynomial functions of λ.

[0078] Based on the above, the noisy trapdoor function of the lattice basis is... The function family is: Let key space for A subset of b, for b∈{0,1}, And the public key k = (a, As + e), for any function f k,b (x) is defined as:

[0079]

[0080] in, For discrete Gaussian distribution, it is defined as:

[0081]

[0082] Based on LWE and the LWE quantum intractability assumption, lattice-based noisy trapdoor clawless function Generation algorithm Inverse algorithm Query Algorithm and sampling algorithm Its structure is as follows:

[0083] 1. Efficient Function Generation:

[0084] Noisy trapdoor functions in lattice bases Generating functions Includes: GenTrap based (1 n ,1 m ​​The algorithm, q), first samples a random matrix. and the corresponding trapdoor t A Subsequently, a secret message s∈{0,1} is selected uniformly and randomly. n And according to the distribution Each coordinate is sampled independently to obtain a vector. Output k = (A, As + e) ​​and t k =t A .

[0085] 2. Trapdoor Injective Pair:

[0086] (a) Trapdoor: For any key k = (a, As + e) ​​and all

[0087]

[0088] Here, Supp(f) refers to the support of f, that is: for any f belonging to distribution D X The function f, f∈D X The support of f is represented as Supp(f) = {x∈X|f(x)>0}.

[0089] Inverse algorithm The input is t A b∈{0,1} and Inverse algorithm Then use the INVERT algorithm to determine if s0 and e0 satisfy y = As0 + e0, and output the result. Among them, the algorithm It will return a uniquely correct result, provided that there exists some e0 such that y = As0 + e0, and satisfies Therefore, as long as B is selected P satisfy Then for all y∈Supp(f) k,b (x)) All of these conditions are true.

[0090] (b) Injective pair: Definition For all satisfying f k,0 (x0)=f k,1 The set of preimage pairs (x0, x1) of (x1). By definition, this occurs if and only if x1 = x0 - s (mod q).

[0091] 3. Efficient Range Superposition:

[0092] For all b∈{0,1} and set up

[0093] Among them, for all They all have f′ k,0 (x)=f k,0 (x), but the distribution f′ k,1 (x) and f k,1 There is an offset e between (x). In fact, given the key k and... f′ k,1 (x) and f k,1 (x) can also be computed efficiently. For all

[0094] Supp(f′ k,0 (x))=Supp(f k,0 (x)),

[0095]

[0096] (a) Due to B V P Therefore, the norm of the term e0+e can only be at most 0. Therefore, the algorithm In B P Meet the conditions When the input is t, it is possible to A ,b∈{0,1},y∈Supp(f′ k,b When (x) is true, ensure that x is output; similarly, for all b∈{0,1}, and y∈Supp(f′) k,b (x)), the enhanced trapdoor requirements can still be met.

[0097] (b) Given input k = (a, As + e), b ∈ {0, 1}, and Query Algorithm The execution is as follows: If b = 0, the algorithm calculates e′ = y - Ax. At this point, if... The algorithm returns 1 otherwise; if b = 1, the algorithm calculates e′ = y - Ax - (As + e), and in this case, if The algorithm returns 1 otherwise.

[0098] (c) For the density function f′ k,b (x) and f​k,b The Hellinger distance between (x) is used as a delimiter. When b = 0, the two are the same; when b = 1, the offset between them is calculated to be e. As mentioned earlier, e is taken from the distribution. therefore Therefore, the Hellinger distance between the two satisfies the following condition:

[0099] H 2 (f k,1 (x),f′ k,1 (x))≤1-exp(-2πmB V / B P ).

[0100] Because of B P / B V Since is a hyperpolynomial function of λ, the right-hand side of the above equation is a negligible function of λ, satisfying the condition.

[0101] Sampling algorithm The structure is as follows:

[0102] First, the following quantum states are generated according to the Grover-Rudolph algorithm:

[0103]

[0104] Then, a new state is generated on top of this state. Uniform superposition states on:

[0105]

[0106] Finally, using the key k = (A, As + e) ​​and the input bits b, calculate

[0107]

[0108] Here, e0 can be calculated based on b, k, x and the value of the last quantum register. Therefore, the second quantum register containing e0 can be further deentangled to obtain the following quantum state:

[0109]

[0110] The superposition state of the claw can be obtained by measuring the last register containing the image information.

[0111] 4. Claw-Free Property: Assuming an enemy exists... When the input is k = (A, As + e), the output can be... The adversary is then able to solve the LWE problem hypothesis because x1-x0=smodq.

[0112] Based on the constructed lattice-based noisy trapdoor function NTCF, taking a 1-bit session key as an example, as follows: Figure 2 As shown, this embodiment demonstrates the algorithm for generating the noisy trapdoor function NTCF based on lattice bases. Generate public key k and trapdoor information td k Save trapdoor information td k The public key k is then sent to the quantum server (Bob).

[0113] Next, the quantum server (Bob) receives the public key k sent by the classical client (Alice) and runs the sampling algorithm of the lattice-based noisy trapdoor function NTCF. The public key k is sampled to obtain image information y and the superposition state ρ of the claw; the quantum server (Bob) then prepares a quantum state |φ> based on the image information y and the superposition state ρ of the claw, and measures the quantum state |φ> to obtain bit string information d; the quantum server (Bob) randomly selects a measurement basis θ and sends the image information y, the bit string information d, and the selected measurement basis θ to the classical user terminal (Alice).

[0114] Step S103: Receive image information, bit string information, and measurement basis information sent by the quantum server. The image information and bit string information are obtained by processing the public key according to the sampling algorithm of the lattice basis noisy trapdoor clawless function.

[0115] Step S105: Based on the inversion algorithm of the lattice-based noisy trapdoor function and the trapdoor information, the image information is inverted. The exact state of the quantum state in the quantum server is calculated based on the inversion result, the image information, and the bit string information. The session key of the classical user side is determined based on the exact state of the quantum state and the measurement basis information.

[0116] In this embodiment, the classical user terminal (Alice) receives the image information y, the bit string information d, and the selected measurement basis information θ sent by the quantum server (Bob), and then uses the previously saved trapdoor information td... k The algorithm for inverting the noisy trapdoor function NTCF of the lattice basis is run. The image information y is inverted to obtain the inverted result, i.e., the original image pair (x0, x1). Based on the inverted result (x0, x1), the image information y, and the bit string information d, the exact state of the quantum state |φ> in the quantum server is calculated. Then, combined with the measurement basis information, the session key K on the classical user terminal (Alice) side is determined. Alice .

[0117] Step S107: Perform a correctness judgment on the measurement basis information and send the correctness judgment result of the measurement basis information to the quantum server.

[0118] In this embodiment, the correctness of the measurement basis information θ selected by the quantum server (Bob) is judged based on the exact state of the calculated quantum state, resulting in a correctness judgment result θ′. This correctness judgment result θ′ is then sent to the quantum server (Bob) so that the quantum server (Bob) can determine the session key K on its side based on the correctness judgment result θ′ of the measurement basis information. Bob .

[0119] In this embodiment, the BB84-QKD protocol is constructed using a lattice-based noisy trapdoor without claw functions, which avoids the introduction of quantum channels in the traditional BB84-QKD protocol. It is suitable for cryptographic application scenarios where classical user equipment and quantum servers interact only through classical channels. It has post-quantum provable security, and the security is based on the quantum difficulty resistance of the lattice standard LWE, which can guarantee the security during the interaction process, thus achieving a balance between security and practical applicability.

[0120] In some embodiments, the lattice-based semi-quantum key distribution method further includes:

[0121] Step S109: Communicate with the quantum server based on the session key.

[0122] In this embodiment, after obtaining the session key, the classic client (Alice) can communicate with the quantum server (Bob) based on the session key.

[0123] In some embodiments, step S105, which involves calculating the exact state of the quantum state in the quantum server based on the inversion result, the image information, and the bit string information, includes:

[0124] Step S201: Process the image information based on the random oracle model to obtain random information of the image information.

[0125] In this embodiment, the random information r of the image information can be obtained by parameterizing the image information y based on the random oracle model.

[0126] In some embodiments, the random oracle model can be modeled as a hash function. In this embodiment, the image information y can be parameterized based on the hash function to obtain the random information r = Hash(y) of the image information.

[0127] Step S203: Calculate the exact state of the quantum state in the quantum server based on the random information, the inversion result, and the bit string information.

[0128] In this embodiment, after obtaining the random information r, the inversion result (i.e., the preimage pair (x0, x1), and the bit string information d, the quantum state in the quantum server (Bob) can be calculated based on the combination of the above information (x0, x1, r, d). To determine the exact state, and thus the session key K on the classic user side (Alice). Alice .

[0129] In this embodiment, a random oracle model is introduced into the communication between the classical user terminal (Alice) and the quantum server (Bob). This allows local information to be processed directly based on the random oracle model during information processing, without the need to send the processed information through the channel. As a result, the key distribution method described in this embodiment can be completed with only three classical communications, reducing the number of interaction steps.

[0130] In some embodiments, the step S105 of determining the session key on the classical user side based on the exact state of the quantum state and the measurement basis information includes: determining the session key on the classical user side based on the exact state of the quantum state and the mapping encoding relationship between the measurement basis information and the BB84 protocol.

[0131] In this embodiment, the mapping and encoding relationship between bits K∈{0,1} and BB84 quantum states {|0>,|1>,|+>,|->} can be preset. For example, under the computational basis (θ=0), K=0 corresponds to quantum state |0>, and K=1 corresponds to quantum state |1>; under the Hadamard basis (θ=1), K=0 corresponds to quantum state |+>, and K=1 corresponds to quantum state |->.

[0132] Based on this pre-defined encoding relationship and quantum state The exact state of the session key K on the classic user terminal (Alice) side can then be determined. Alice :if or Let K Alice =0; if or Let K Alice =1.

[0133] In this embodiment, all messages of the above-mentioned lattice-based semi-quantum key distribution method can be protected for their integrity, non-repudiation, and authentication requirements using lattice-based signature algorithms (such as CRYSTALS-Dilithium).

[0134] Based on the same inventive concept, corresponding to any of the above embodiments, this disclosure also provides a lattice-based semi-quantum key distribution method, applied to a quantum server (Bob). Figure 3 As shown, the method includes:

[0135] Step S301: Receive the public key sent by the classic user terminal, the public key being generated based on the lattice-based noisy trapdoor clawless function.

[0136] In this embodiment, based on the lattice-based noisy trapdoor function NTCF, taking a 1-bit session key as an example, as follows: Figure 2 As shown, in this embodiment, the classic user client (Alice) runs the algorithm for generating the NTCF (Noisy Trapgate Function Without Claws) based on lattice bases. Generate a public key k and send it to the quantum server (Bob). The quantum server (Bob) then receives the public key k from the classical client (Alice).

[0137] Step S303: The public key is sampled based on the sampling algorithm of the lattice-based noisy trapdoor without claw function to obtain image information and the superposition state of the claw.

[0138] In this embodiment, the quantum server (Bob) runs the sampling algorithm of the lattice-based noisy trapdoor-free function NTCF. The public key k is sampled to obtain the image information y and the superposition state ρ of the claw.

[0139] Step S305: Prepare a quantum state based on the superposition state of the image information and the claw, and measure the quantum state to obtain bit string information and BB84 quantum state.

[0140] In this embodiment, the quantum server (Bob) prepares a quantum state |φ> based on the image information y and the superposition state ρ of the claw, and measures the quantum state |φ> to obtain the bit string information d.

[0141] Step S307: Randomly select measurement base information and send the image information, the bit string information, and the measurement base information to the classic user terminal.

[0142] In this embodiment, the quantum server (Bob) randomly selects one from the computational basis (θ=0) and the Hadamard basis (θ=1) as the measurement basis information θ, and sends the image information y, the bit string information d, and the selected measurement basis information θ to the classical user terminal (Alice).

[0143] Step S309: Receive the correctness judgment result of the measurement basis information sent by the classical user terminal, and determine the measurement result of the quantum state based on the correctness judgment result of the measurement basis information.

[0144] In some embodiments, the correctness judgment result of the measurement basis information is obtained based on the calculation result of the exact state of the quantum state and the correctness judgment of the measurement basis information based on the calculation result.

[0145] In this embodiment, after the classic user terminal (Alice) obtains the image information, bit string information, and measurement basis information {y,d,θ}, it then uses the previously saved trapdoor information td k The algorithm for inverting the noisy trapdoor function NTCF of the lattice basis is run. The image information y is inverted to obtain the inversion result (x0, x1). Based on the inversion result (x0, x1), the image information y, and the bit string information d, the exact state of the quantum state |φ> in the quantum server is calculated. Then, the correctness of the measurement basis information is judged based on the exact state of the quantum state |φ> to obtain the correctness judgment result θ′ of the measurement basis information. Finally, the correctness judgment result θ′ of the measurement basis information is sent to the quantum server (Bob).

[0146] After obtaining the correctness judgment result θ′ of the measurement basis information, the quantum server (Bob) calculates the measurement result of the quantum state based on the correctness judgment result θ′ of the measurement basis information.

[0147] Step S311: Determine the session key on the quantum server side based on the measurement results.

[0148] In this embodiment, the quantum server (Bob) can determine the session key K on the quantum server (Bob) side based on the measurement result. Bob .

[0149] In this embodiment, the BB84-QKD protocol is constructed using a lattice-based noisy trapdoor without claw functions, which avoids the introduction of quantum channels in the traditional BB84-QKD protocol. It is suitable for cryptographic application scenarios where classical user equipment and quantum servers interact only through classical channels. It has post-quantum provable security, and the security is based on the quantum difficulty resistance of the lattice standard LWE, which can guarantee the security during the interaction process, thus achieving a balance between security and practical applicability.

[0150] In some embodiments, the method further includes:

[0151] Step S313: Communicate with the classic client based on the session key.

[0152] In this embodiment, after obtaining the session key, the quantum server (Bob) can communicate with the classical client (Alice) based on the session key.

[0153] In some embodiments, the preparation of the quantum state based on the superposition state of the image information and the claw in step S305 includes:

[0154] Step S401: Process the image information based on the random oracle model to obtain random information of the image information.

[0155] In this embodiment, the random information r of the image information can be obtained by parameterizing the image information y based on the random oracle model.

[0156] In some embodiments, the random oracle model can be a hash function. In this embodiment, the image information y can be parameterized based on the hash function to obtain the random information r = Hash(y).

[0157] Step S403: Based on the random information, the superposition state of the claw is processed by a controllable NOT gate to obtain the quantum state.

[0158] In this embodiment, based on the random information r, the superposition state ρ of the claw is processed by a controllable NOT gate (CNOT) to obtain the quantum state |φ>.

[0159] In this embodiment, a random oracle model is introduced into the communication between the classical user terminal (Alice) and the quantum server (Bob). This allows local information to be processed directly based on the random oracle model during information processing, without the need to send the processed information through the channel. As a result, the key distribution method described in this embodiment can be completed with only three classical communications, reducing the number of interaction steps.

[0160] In some embodiments, the measurement of the quantum state to obtain bit string information and BB84 quantum state in step S305 includes: measuring the second register of the quantum state to obtain the bit string information; and the first register of the quantum state collapsing into a random BB84 state.

[0161] In this embodiment, the second register of the quantum state |φ> undergoes a Hadamard measurement to obtain bit string information d. At this time, the first register of the quantum state |φ> collapses into a random BB84 state, which is any one of the four states in the set {|0>,|1>,|+>,|->}.

[0162] In some embodiments, determining the session key on the quantum server side based on the measurement results in step S311 includes: determining the session key on the quantum server side based on the measurement results and the mapping encoding relationship between the measurement base information and the BB84 protocol.

[0163] In this embodiment, the mapping and encoding relationship between bits K∈{0,1} and BB84 quantum states {|0>,|1>,|+>,|->} can be preset. For example, under the computational basis (θ=0), K=0 corresponds to quantum state |0>, and K=1 corresponds to quantum state |1>; under the Hadamard basis (θ=1), K=0 corresponds to quantum state |+>, and K=1 corresponds to quantum state |->.

[0164] Based on the preset encoding relationship and the measurement results, if the measurement result is |0> or |+>, then the session key K on the quantum server side is set... Bob =0, otherwise, let the session key K on the quantum server side be 0. Bob =1.

[0165] In this embodiment, all messages of the above-mentioned lattice-based semi-quantum key distribution method can be protected for their integrity, non-repudiation, and authentication requirements using lattice-based signature algorithms (such as CRYSTALS-Dilithium).

[0166] This embodiment provides a BB84-QKD scheme based on LWE that relies solely on classical channels. By utilizing lattice basis trapdoor clawless functions and a random oracle model, this scheme avoids the introduction of quantum channels in the traditional BB84 protocol, providing a solution that balances security and practical applicability. It is suitable for key negotiation applications where purely classical devices interact with quantum servers. This scheme does not require the use of quantum channels, and the protocol interaction only requires three classical communications. This scheme has post-quantum provable security, which is based on the quantum hardness resistance of the lattice standard LWE.

[0167] It is understood that before using the technical solutions of the various embodiments in this disclosure, users will be informed of the type, scope of use, and usage scenarios of the personal information involved in an appropriate manner, and user authorization will be obtained.

[0168] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose, based on the prompt message, whether to provide personal information to the software or hardware such as electronic devices, applications, servers, or storage media performing the operations of this disclosed technical solution.

[0169] As an optional but not limited implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0170] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0171] It should be noted that the method of this disclosure embodiment can be executed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method of this disclosure embodiment, and the multiple devices will interact with each other to complete the method described.

[0172] It should be noted that the above description describes some embodiments of this disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0173] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this disclosure also provides a classic user terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the lattice-based semi-quantum key distribution method described in any of the above embodiments.

[0174] Figure 4 This embodiment illustrates a more specific classic user terminal hardware structure, which may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0175] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0176] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0177] The input / output interface 1030 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0178] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0179] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0180] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, this classic user terminal may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described classic user terminal device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0181] The electronic devices described above are used to implement the corresponding lattice-based semi-quantum key distribution methods in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0182] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this disclosure also provides a quantum server, including a memory, a processor, and a quantum computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the lattice-based semi-quantum key distribution method described in any of the above embodiments.

[0183] Figure 5 This embodiment illustrates a more specific hardware structure diagram of a quantum server. (See attached diagram.) Figure 5 The quantum server 800 includes at least one quantum processor 801, a quantum bus system 802, a quantum memory 803, and at least one quantum transceiver 804.

[0184] The quantum memory 803 is used to store application code that executes the methods described in the embodiments of this disclosure, and its execution is controlled by the quantum processor 801. The quantum processor 801 is used to store qubits in the quantum memory 803, and to operate on the qubits by executing the application code stored in the quantum memory 803, thereby realizing the functions in the methods of the embodiments of this disclosure.

[0185] The quantum bus system 802 may include a pathway for transmitting information between the aforementioned components.

[0186] The quantum transceiver 804 is used to communicate with classical computers and can be used to receive pulse signals or send signal sequences.

[0187] In a specific implementation, as one example, the quantum server 800 may include multiple quantum processors. Here, a quantum processor may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0188] It should be noted that although the above-described device only shows the quantum processor 801, quantum bus system 802, quantum memory 803, and quantum transceiver 804, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0189] The electronic devices described above are used to implement the corresponding lattice-based semi-quantum key distribution methods in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0190] Based on the same inventive concept, corresponding to any of the methods in the above embodiments, this disclosure also provides a quantum key distribution system based on lattice cryptography, such as... Figure 6 As shown, it includes the classic client 11 as described in the above embodiments and the quantum server 12 as described in the above embodiments. Figure 2 As shown, the lattice-based semi-quantum key distribution method is used to negotiate a 1-bit session key between the classical user terminal 11 and the quantum server 12, satisfying K Alice =K Bob∈{0,1}:

[0191] Step S501, setting preset parameter values, including:

[0192] Let the security parameter be λ, and the modulus q be a prime number with q≥2. The noisy trapdoor family of clawless functions NTCF based on LWE is derived from... describe;

[0193] Let n and m be bounded polynomial functions of λ, and m = Ω(n·logq).

[0194] The method described in this embodiment is parameterized by the hash function Hash(·): {0,1} m·logq →{0,1} n·logq (It will be modeled as a random oracle model in the security proof).

[0195] Let θ = 0 denote the computational basis, and θ = 1 denote the Hadamard basis;

[0196] Let the mapping relationship between bits K∈{0,1} and BB84 quantum states {|0>,|1>,|+>,|->} be as follows: Under the computational basis (θ=0), K=0 corresponds to quantum state |0>, and K=1 corresponds to quantum state |1>; under the Hadamard basis (θ=1), K=0 corresponds to quantum state |+>, and K=1 corresponds to quantum state |->.

[0197] Step S503: The classic user client (Alice) runs the algorithm for generating the NTCF (Noisy Trapgate Function Without Claws) based on lattice bases. Where k = (A, t = As + e0), the public key k and trapdoor information td are generated. k ,td k This is the trapdoor information corresponding to k, and the trapdoor information td is saved. k The public key k is then sent to the quantum server (Bob).

[0198] Step S505, the quantum server (Bob) runs the sampling algorithm of the lattice-based noisy trapdoor-free function NTCF. The public key k is sampled to obtain the image information y and the superposition state ρ of the claw.

[0199] Among them, the sampling algorithm of the noisy trapdoor function NTCF based on lattice bases.

[0200] Step S507: The quantum server (Bob) performs parameterization processing on the image information y based on the random oracle model to obtain the random information r = Hash(y) of the image information.

[0201] In step S509, the quantum server (Bob) processes the superposition state ρ of the claw using a controllable NOT gate (CNOT) based on the random information r, thereby obtaining the quantum state. Where r T ·x0 represents the bit inner product of r and x0.

[0202] Step S511: The quantum server (Bob) performs a Hadamard measurement on the second register of the quantum state |φ> to obtain the bit string information d∈{0,1}. n·logq At this point, the first register of the quantum state |φ> collapses to Here, quantum state It is a random BB84 state.

[0203] In step S513, the quantum server (Bob) randomly selects a measurement basis information from the computational basis (θ=0) and the Hadamard basis (θ=1), denoted as θ∈{0,1}, and combines the image information y, the bit string information d, and the selected measurement basis information θ into {y,d,θ} and sends it to the classical user terminal (Alice).

[0204] Step S515, the classic client (Alice) uses the previously saved trapdoor information td k The algorithm for inverting the noisy trapdoor function NTCF of the lattice basis is run. The image information y is inverted to obtain the inverted result, which is the original image pair (x0, x1).

[0205] Step S517: The classical user terminal (Alice) parameterizes the image information y based on the random oracle model to obtain the random information r = Hash(y). Then, based on the inversion result (x0, x1) and the information of the image information y and the bit string information d, it calculates the exact state of the quantum state |φ> in the quantum server. Finally, based on the mapping and encoding relationship between bits K ∈ {0, 1} and BB84 quantum states {|0>, |1>, |+>, |->}, the session key K on the classical user terminal (Alice) side can be determined. Alice :if or Let K Alice =0; if or Let K Alice =1.

[0206] Step S519: The classical user terminal (Alice) judges the correctness of the measurement basis information θ selected by the quantum server (Bob), obtains the correctness judgment result θ′∈{0,1}, and then sends the correctness judgment result θ′ to the quantum server (Bob).

[0207]

[0208] Step S521: After obtaining the correctness judgment result θ′ of the measurement basis information, the quantum server (Bob) calculates the measurement result of the quantum state based on the correctness judgment result θ′ of the measurement basis information.

[0209] Where, if θ′=1, record Measurement results under the θ basis If θ′=0, record Measurement results in 1-θ basis

[0210] Step S523: The quantum server (Bob) determines the session key on the quantum server side based on the measurement results and the mapping and encoding relationship between the measurement base information and the BB84 protocol.

[0211] If the measurement result is |0> or |+>, then let the session key K on the quantum server side be... Bob =0, otherwise, let the session key K on the quantum server side be 0. Bob =1.

[0212] In this embodiment, ideally, the noisy trapdoor function without claws will not fail during its execution. However, the noisy trapdoor function without claws does have a negligible probability of failure; this probability exists, but it is small.

[0213] In this embodiment, all messages of the above-mentioned lattice-based semi-quantum key distribution method can be protected for their integrity, non-repudiation, and authentication requirements using lattice-based signature algorithms (such as CRYSTALS-Dilithium).

[0214] In some embodiments, a multi-bit (N-bit) key distribution protocol based on LWE can be constructed using parallel repetition techniques. For example... Figure 7 As shown, the lattice-based semi-quantum key distribution method is used to negotiate an N-bit session key between the classical user terminal 11 and the quantum server 12, satisfying K Alice =K Bob ∈{0,1} N .

[0215] Step S601, setting preset parameter values, including:

[0216] Let the security parameter be λ, and the modulus q be a prime number with q≥2. The noisy trapdoor family of clawless functions NTCF based on LWE is derived from... describe;

[0217] Let n and m be bounded polynomial functions of λ, and m = Ω(n·logq).

[0218] The method described in this embodiment is parameterized by the hash function Hash(·): {0,1} m·logq →{0,1} n·logq (It will be modeled as a random oracle model in the security proof).

[0219] Let θ = 0 denote the computational basis, and θ = 1 denote the Hadamard basis;

[0220] Let the mapping relationship between bits K∈{0,1} and BB84 quantum states {|0>,|1>,|+>,|->} be as follows: Under the computational basis (θ=0), K=0 corresponds to quantum state |0>, and K=1 corresponds to quantum state |1>; under the Hadamard basis (θ=1), K=0 corresponds to quantum state |+>, and K=1 corresponds to quantum state |->.

[0221] Step S603: The classic user client (Alice) runs the algorithm for generating the NTCF (Noisy Trapgate Function Without Claws) N times. Where k i =(A i ,t i =A i s i +e 0,i Generate public key {k i} i∈[N] And the Trap Gate Letter It is k i The corresponding trapdoor information is saved. And the public key {k i} i∈[N] Send to the quantum server (Bob), [N] = {1,…,N}.

[0222] Step S605, for each public key k i The quantum server (Bob) runs the sampling algorithm of the lattice-based noisy trapdoor clawless function NTCF. For the public key k i Sampling is performed to obtain information like y i and the superposition state ρ of the claw i .

[0223] Among them, the sampling algorithm of the noisy trapdoor function NTCF based on lattice bases. (ρ i ,y i );

[0224] Step S607, the quantum server (Bob) uses a random oracle model to analyze the object information y. i Parameterization is performed to obtain random information r of the image information. i =Hash(y) i ).

[0225] Step S609, the quantum server (Bob) uses this random information r i The superposition state ρ of each claw is obtained through a controllable NOT gate (CNOT). i Processing is performed to obtain a quantum state. in Indicates r i The bit inner product of x0 and x0.

[0226] Step S611, the quantum server (Bob) processes each quantum state |φ i The second register is used for Hadamard measurement to obtain the bit string information d. i ∈{0,1} n·logq At this point, the quantum state |φ i The first register collapsed to Here, each quantum state |φ i >∈{|0>,|1>,|+>,|->} is a random BB84 state.

[0227] In step S613, the quantum server (Bob) only needs to randomly select from the computational basis (θ=0) and the Hadamard basis (θ=1) each time, and select N measurement basis information denoted as {θ}. i} i∈[N] , where θ i ∈{0,1}, and combine the image information, the bit string information, and the selected measurement basis information into {y i ,d i ,θ i} i∈[N] Send to the classic client (Alice).

[0228] Step S615, the classic client (Alice) uses the previously saved trapdoor information... For the corresponding y i The algorithm for inverting the noisy trapdoor function NTCF of a running lattice basis Performing the inverse operation yields the inverse result, which is the preimage pair (x).0,i ,x 1,i ).

[0229] Step S617, the classic client (Alice) uses a random oracle model to process each image information y. i Parameterization is performed to obtain random information r of the image information. i =Hash(y) i Then, based on the result of the inversion (x) 0,i ,x 1,i ) and information like y i The bit string information d i Information combination (x) 0,i ,x 1,i ,r i ,d i ) Calculate each quantum state in the quantum server The exact state of the bits K∈{0,1} and the mapping encoding relationship between the bits K∈{0,1} and the BB84 quantum states {|0>,|1>,|+>,|->} can be used to determine the session key K on the classic user terminal (Alice) side. Alice ={K i} i∈[N] .

[0230] Step S619, the classical user terminal (Alice) selects the measurement basis information {θ} on the quantum server (Bob) side. i} i∈[N] The correctness is judged, and the correctness judgment result {θ} is obtained. i ′} i∈[N] Then, the correctness judgment result {θ i ′} i∈[N] Send to the quantum server (Bob). Where θ i ′∈{0,1} is a pair of θ i The correctness of the judgment is 1 for correct and 0 for incorrect.

[0231]

[0232] In step S621, after obtaining the correctness judgment result of the measurement basis information, the quantum server (Bob) calculates the measurement result of the quantum state based on the correctness judgment result of the measurement basis information.

[0233] Where, for i∈[1,…N], when θ i When ′=1, record In θ i Measurement results under the base And when θ i When ′=0, record In 1-θ i Measurement results under the base

[0234] Step S623: The quantum server (Bob) determines the session key on the quantum server side based on the measurement results and the mapping and encoding relationship between the measurement base information and the BB84 protocol.

[0235] In this embodiment, based on the above N states The negotiation key K can be calculated from the results of each measurement using the encoding rules. Bob ={K i} i∈[N] As can be easily seen from the analysis, under ideal conditions, K Bob =K Alice ∈{0,1} N .

[0236] In this embodiment, ideally, the noisy trapdoor function without claws will not fail during its execution. However, the noisy trapdoor function without claws does have a negligible probability of failure; this probability exists, but it is small.

[0237] In this embodiment, all messages of the above-mentioned lattice-based semi-quantum key distribution method can be protected for their integrity, non-repudiation, and authentication requirements using lattice-based signature algorithms (such as CRYSTALS-Dilithium).

[0238] Those skilled in the art will recognize that embodiments of this disclosure can be implemented as a system, method, or computer program product. Therefore, this disclosure can be implemented as entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to herein as a "circuit," "module," or "system." Furthermore, in some embodiments, this disclosure can also be implemented as a computer program product contained in one or more computer-readable media, which includes computer-readable program code.

[0239] Any combination of one or more computer-readable media may be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example,, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (not exhaustive) of a computer-readable storage medium may include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0240] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0241] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0242] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0243] It should be understood that each block of a flowchart and / or block diagram, as well as combinations of blocks in a flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine that, when executed by a computer or other programmable data processing device, creates means for implementing the functions / operations specified in the blocks of the flowchart and / or block diagram.

[0244] These computer program instructions may also be stored in a computer-readable medium that enables a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable medium produce a product comprising an instruction apparatus that implements the functions / operations specified in the boxes of a flowchart and / or block diagram.

[0245] Computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, such that the instructions that execute on the computer or other programmable apparatus can provide a process for implementing the functions / operations specified in the boxes of a flowchart and / or block diagram.

[0246] Furthermore, although the operations of the methods of this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all of the operations shown must be performed to achieve the desired result. Rather, the steps depicted in the flowcharts may be executed in a different order. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0247] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0248] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0249] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this disclosure (including the claims) is limited to these examples; within the framework of this disclosure, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this disclosure as described above, which are not provided in detail for the sake of brevity.

[0250] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this disclosure, the provided drawings may or may not show well-known power / ground connections to integrated circuit (IC) chips and other components. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this disclosure, and this also takes into account the fact that the details of implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this disclosure will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuitry) have been set forth to describe exemplary embodiments of this disclosure, it will be apparent to those skilled in the art that the embodiments of this disclosure may be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0251] Although this disclosure has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0252] This disclosure is intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A lattice-based semi-quantum key distribution method, applied to classical user terminals, comprising: A public key and trapdoor information are generated based on a generation algorithm of a lattice-based noisy trapdoor function, and the public key is sent to a quantum server. The system receives image information, bit string information, and measurement basis information sent by the quantum server. The image information and bit string information are obtained by processing the public key according to the sampling algorithm of the lattice basis noisy trapdoor clawless function. Based on the inversion algorithm of the lattice-based noisy trapdoor without claw function and the trapdoor information, the image information is inverted. Based on the inversion result, the image information, and the bit string information, the exact state of the quantum state in the quantum server is calculated. Based on the exact state of the quantum state and the measurement basis information, the session key of the classical user side is determined. The correctness of the measurement base information is determined, and the result of the correctness determination is sent to the quantum server so that the quantum server can obtain the session key on the quantum server side based on the result of the correctness determination of the measurement base information.

2. The method according to claim 1, wherein, The step of calculating the exact state of the quantum state in the quantum server based on the inversion result, the image information, and the bit string information includes: The image information is processed based on a random oracle model to obtain random information about the image information; The exact state of the quantum state in the quantum server is calculated based on the random information, the inversion result, and the bit string information.

3. The method according to claim 1, wherein, Determining the session key on the classical user side based on the exact state of the quantum state and the measurement basis information includes: Based on the exact state of the quantum state and the mapping and encoding relationship between the measurement basis information and the BB84 protocol, the session key on the classical user side is determined.

4. A lattice-based semi-quantum key distribution method, applied to a quantum server, comprising: Receive a public key sent by a classic user client, the public key being generated based on a lattice-based noisy trapdoor without claw function; The public key is sampled based on the sampling algorithm of the lattice-based noisy trapdoor without claw function to obtain image information and the superposition state of the claws; A quantum state is prepared based on the superposition of the image information and the claw, and the bit string information and BB84 quantum state are obtained by measuring the quantum state; Randomly select measurement base information, and send the image information, the bit string information, and the measurement base information to the classic user terminal; Receive the correctness judgment result of the measurement basis information sent by the classical user terminal, and determine the measurement result of the quantum state based on the correctness judgment result of the measurement basis information; The session key on the quantum server side is determined based on the measurement results.

5. The method according to claim 4, wherein, The preparation of the quantum state based on the superposition of the image information and the claw includes: The image information is processed based on a random oracle model to obtain random information about the image information; Based on the random information, the superposition state of the claw is processed by a controllable NOT gate to obtain the quantum state.

6. The method according to claim 4, wherein, The measurement of the quantum state to obtain bit string information and BB84 quantum state includes: The second register of the quantum state is subjected to a Hadamard measurement to obtain the bit string information; The first register of the quantum state collapses into a random BB84 state.

7. The method according to claim 4, wherein, Determining the session key on the quantum server side based on the measurement results includes: Based on the measurement results and the mapping and encoding relationship between the measurement base information and the BB84 protocol, the session key on the quantum server side is determined.

8. A classic user terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the lattice-based semi-quantum key distribution method as described in any one of claims 1 to 3.

9. A quantum server comprising a quantum processor, a quantum bus system, a quantum memory, and at least one quantum transceiver and a quantum computer program stored on the quantum memory and executable on the quantum processor, wherein the quantum processor, when executing the program, implements the lattice-based semi-quantum key distribution method as described in any one of claims 4 to 7.

10. A lattice-based semi-quantum key distribution system, comprising a classical client as described in claim 8 and a quantum server as described in claim 9.

Images