Electronic authentication service method combining federated key management and post quantum cryptography algorithm, storage medium and equipment

What is AI technical title?
AI technical title is built by Patsnap AI team. It summarizes the technical point description of the patent document.
By combining federated key management and post-quantum cryptography algorithms, the problems of traditional electronic authentication services being vulnerable to quantum cracking and single points of failure in centralized management are solved, realizing secure and stable electronic authentication services, simplifying the authentication process and enhancing privacy protection.

CN121308980APending Publication Date: 2026-01-09LAIXI (NANTONG) CERTIFICATION CO LTD

View PDF 0 Cites 0 Cited by

Patent Information

Application Number: CN202511519551.3
Authority / Receiving Office: CN · China
Patent Type: Applications(China)
Current Assignee / Owner
Filing Date: 2025-10-23
Publication Date: 2026-01-09

AI Technical Summary

Technical Problem

Existing electronic authentication services rely on traditional public-key cryptography algorithms, which are easily cracked by quantum computing. Furthermore, centralized key management leads to a high risk of single point of failure, affecting system stability and security.

Method used

By employing federated key management and post-quantum cryptography algorithms, and through the distributed generation and storage of private-public key pairs, combined with pseudo-random number generation and Gaussian random sampling, the system ensures key dispersion, resists quantum attacks, and simplifies the authentication process.

Benefits of technology

It enhances the security and stability of electronic authentication services, prevents key leakage, simplifies the authentication process, strengthens privacy protection, improves authentication efficiency, and prevents identity information from being forged or stolen.

✦ Generated by Eureka AI based on patent content.

Smart Images

Figure CN121308980A_ABST

Patent Text Reader

Abstract

The invention discloses an electronic authentication service method combining federated key management and a post quantum cryptography algorithm, a storage medium and equipment, and the method comprises the steps that an electronic data receiver generates a receiver private key-public key pair through a local electronic authentication center, uploads the receiver private key-public key pair to a central electronic authentication center for storage, transmits a private key to the receiver, and transmits the private key to the receiver; the public key is transmitted to an electronic authentication center connected with the electronic data sender; the electronic authentication center where the electronic data sender is located encapsulates the identity information of the electronic data sender by using the public key, generates a shared hash value of the electronic data sender, and transmits the encapsulated identity information back to the electronic data sender; the electronic data sender signs the file by using the packaged identity information and transmits the signed file to the electronic data receiver; and the electronic data receiver analyzes the identity information packaged by the electronic data sender by using the private key, calculates a hash value, and indicates that the authentication is passed and the signed file is valid if the hash value is consistent with the shared hash value.

Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] This invention relates to the field of electronic authentication service technology, and more specifically, to an electronic authentication service method, storage medium, and device that combines federated key management and post-quantum cryptography algorithms. Background Technology

[0002] Electronic authentication services are a type of security service based on cryptographic technology that provides identity verification, data integrity protection, and non-repudiation for electronic transactions, information exchanges, and other scenarios through authoritative third-party institutions. It ensures the authenticity of the identities of all parties, the confidentiality of information, and the non-repudiation of actions in the network environment, and serves as the infrastructure for building a viable digital environment.

[0003] However, existing electronic authentication services mainly rely on traditional public-key cryptography algorithms such as RSA and ECC. Their security is based on number theory problems, such as large integer factorization and elliptic curve discrete logarithms. Shor's algorithm for quantum computers can solve these problems in polynomial time, causing existing electronic authentication systems to fail. At the same time, existing electronic authentication services usually adopt centralized key management, with all key generation, storage and distribution relying on a single node. Once this server is attacked or fails, the entire electronic authentication service will be paralyzed, and the risk of key leakage will be increased. Summary of the Invention

[0004] To address the problems existing in the prior art, this invention provides an electronic authentication service method, storage medium, and device that combines federated key management and post-quantum cryptography algorithms. By using federated key management, the risk of a single authentication node failure is avoided, and by using post-quantum cryptography algorithms to generate private-public key pairs, the security of the electronic authentication service is greatly improved.

[0005] To achieve the above technical objectives, the present invention adopts the following technical solution: An electronic authentication service method combining federated key management and post-quantum cryptography includes the following steps: Step S1: Deploy post-quantum cryptography in each local electronic authentication center, and the electronic data recipient generates a private key-public key pair through the corresponding local electronic authentication center; Step S2: Upload the generated recipient private key-public key pair to the central electronic certification center for storage, and transmit the private key in the recipient private key-public key pair to the recipient, and transmit the public key in the recipient private key-public key pair to the electronic certification center connected to the electronic data sender. Step S3: The electronic certification center where the electronic data sender is located encapsulates the identity information of the electronic data sender using the public key in the private key-public key pair of the receiver, generates a shared hash value of the electronic data sender, sends the encapsulated identity information back to the electronic data sender, and stores the shared hash value in the central electronic certification center. Step S4: The electronic data sender signs the document using the encapsulated identity information and transmits it to the electronic data receiver; Step S5: The electronic data recipient uses the private key to parse the identity information encapsulated by the electronic data sender and calculates the hash value. If the hash value matches the shared hash value, the authentication is successful and the signed file is valid.

[0006] Further, step S1 includes the following sub-steps: Step S1.1: The local electronic certification center randomly sets the dimensions of the grid. Modulus and error distribution parameters ; Step S1.2: Based on the modulus Determine the first finite ring From the first finite ring Random values are randomly selected to form a random matrix. ,in, Represents a random matrix Dimensions ; Step S1.3: In the first finite ring Based on error distribution parameters Perform discrete Gaussian distribution random sampling to form the private key. ; Step S1.4: Based on the private key random matrix and modulus Calculate the public key vector ,in, Represents the random sampling error vector; Step S1.5: [The text appears to be incomplete and contains several grammatical errors. A more accurate translation would require The recipient's public key is composed of the private key. The private key used as the recipient's private key.

[0007] Furthermore, if the local electronic certification center corresponding to the electronic data recipient is in normal status, the private key in the recipient's private key-public key pair is sent back to the recipient through the local electronic certification center; otherwise, the private key in the recipient's private key-public key pair is transmitted through the central electronic certification center to an electronic certification center adjacent to the local electronic certification center, and then transmitted by the adjacent electronic certification center to the recipient.

[0008] Furthermore, if the local electronic certification center corresponding to the electronic data sender is in normal status, the public key in the receiver's private key-public key pair is transmitted to the local electronic certification center corresponding to the electronic data sender through the central electronic certification center; otherwise, the public key in the receiver's private key-public key pair is transmitted to the electronic certification center adjacent to the electronic data sender through the central electronic certification center.

[0009] Furthermore, step S3 includes the following sub-steps: Step S3.1: The electronic data sender sends its identity information to the electronic authentication center, which converts the electronic data sender's identity information into an identity hash value; Step S3.2: Use the identity hash value as the initialization vector of the pseudo-random number generator to initialize the pseudo-random number generator, and randomly generate the first bit string, the second bit string and the third bit string using the initialized pseudo-random number generator; Step S3.3: Divide the first bit string into elements of the second finite ring, and randomly select values from the second finite ring to obtain a random vector. The second and third bit strings are respectively segmented and mapped onto discrete Gaussian distributions to generate the first error vector. Second error vector ; Step S3.4: Based on the public key and random vector of the electronic data recipient and the first error vector Encrypted text used to identify the sender of electronic data and the hash value of the encrypted identity ,in, This represents a random matrix in the public key of the electronic data recipient. This indicates the transpose operation. Denotes the modulus of the second finite ring. Represents a hash function; Step S3.5: Based on the public key and random vector of the electronic data recipient Second error vector Determine the shared hash value of the electronic data sender ,in, This represents the public key vector in the public key of the electronic data recipient; Step S3.6: Encrypt the identity of the electronic data sender. The hash value of the identity ciphertext The shared hash value of the electronic data sender is sent back to the sender. Stored in the central electronic certification center.

[0010] Furthermore, step S5 includes the following sub-steps: Step S5.1: The electronic data recipient extracts the identity information encapsulated by the electronic data sender from the received file, parses the encapsulated identity information using the private key, and calculates the hash value. ,in, Ciphertext indicating the identity of the electronic data sender This indicates the transpose operation. This represents the private key of the recipient of the electronic data. Represents the modulus. Represents a hash function; Step S5.2: If the hash value Shared hash value stored in the central electronic certification center Consistency indicates successful authentication and that the signed document is valid.

[0011] Furthermore, the present invention also provides a computer-readable storage medium storing a computer program that causes a computer to execute the described electronic authentication service method combining federated key management and post-quantum cryptography algorithms.

[0012] Furthermore, the present invention also provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the aforementioned electronic authentication service method combining federated key management and post-quantum cryptography algorithms.

[0013] Compared with the prior art, the present invention has the following beneficial effects: (1) The electronic authentication service method combining federated key management and post-quantum cryptography algorithm generates private key-public key pairs through post-quantum cryptography algorithm, which can resist attacks from quantum computers, avoid leakage of authentication information, and ensure the security of electronic authentication service. (2) The electronic authentication service method of the present invention, which combines federated key management and post-quantum cryptography, uses the distributed architecture of federated key management to make the generation and storage of keys decentralized. Even if an electronic authentication center fails or is attacked, it will not affect the normal operation of the electronic authentication service. (3) In the electronic authentication service method combining federated key management and post-quantum cryptography algorithm of the present invention, when the electronic data receiver uses the private key to parse the identity information encapsulated by the electronic data sender, authentication can be performed by hash value matching, which simplifies the electronic authentication process, improves authentication efficiency, avoids obtaining the specific identity information of the electronic data sender, reduces the risk of information leakage, enhances privacy protection, and can prevent attackers from impersonating the sender by forging or stealing the identity information of the electronic data sender, thereby improving the security of authentication. Attached Figure Description

[0014] Figure 1 This is a flowchart of the electronic authentication service method combining federal key management and post-quantum cryptography algorithms according to the present invention; Figure 2 A flowchart illustrating how to encapsulate the identity information of the electronic data sender using the public key in the receiver's private-public key pair and generate a shared hash value for the electronic data sender. Detailed Implementation

[0015] The technical solution of the present invention will be further explained and described below with reference to the accompanying drawings.

[0016] like Figure 1 This is a flowchart of the electronic authentication service method combining federated key management and post-quantum cryptography algorithms according to the present invention. The electronic authentication service method includes the following steps: Step S1: Deploy the quantum cryptography algorithm in each local electronic authentication center. The electronic data recipient generates a private-public key pair through the corresponding local electronic authentication center, which can resist attacks from quantum computers, prevent the leakage of authentication information, and ensure the security of electronic authentication services. Specifically, this includes the following sub-steps: Step S1.1: The local electronic certification center randomly sets the dimensions of the grid. Modulus and error distribution parameters ; Step S1.2: Based on the modulus Determine the first finite ring From the first finite ring Random values are randomly selected to form a random matrix. ,in, Represents a random matrix Dimensions ; Step S1.3: In the first finite ring Based on error distribution parameters Perform discrete Gaussian distribution random sampling to form the private key. ; Step S1.4: Based on the private key random matrix and modulus Calculate the public key vector ,in, Represents the random sampling error vector; Step S1.5: [The text appears to be incomplete and contains several grammatical errors. A more accurate translation would require The recipient's public key is composed of the private key. The private key used as the recipient's private key.

[0017] Step S2: Upload the generated recipient's private key-public key pair to the central electronic certification center for storage, and transmit the private key from the recipient's private key-public key pair to the recipient. The public key from the recipient's private key-public key pair is transmitted to the electronic certification center connected to the electronic data sender. Through the distributed architecture of federated key management, the generation and storage of keys are decentralized, so even if an electronic certification center fails or is attacked, it will not affect the normal operation of the electronic certification service. Specifically: if the local electronic certification center corresponding to the electronic data recipient is in normal status, the private key from the recipient's private key-public key pair is transmitted back to the recipient through the local electronic certification center; otherwise, the private key from the recipient's private key-public key pair is transmitted through the central electronic certification center to the electronic certification center adjacent to the local electronic certification center, and then transmitted by the adjacent electronic certification center to the recipient. If the local electronic certification center corresponding to the electronic data sender is in normal status, the public key in the receiver's private-public key pair will be transmitted to the local electronic certification center corresponding to the electronic data sender through the central electronic certification center; otherwise, the public key in the receiver's private-public key pair will be transmitted to the electronic certification center adjacent to the electronic data sender through the central electronic certification center.

[0018] Step S3: The electronic certification center where the electronic data sender resides encapsulates the electronic data sender's identity information using the public key from the receiver's private-public key pair. This ensures that only the corresponding electronic data receiver can decrypt and access the sender's identity information, preventing attackers or unauthorized third parties from obtaining it during transmission. A shared hash value for the electronic data sender is generated for authentication, simplifying the authentication process. The encapsulated identity information is then sent back to the electronic data sender, and the shared hash value is stored in the central electronic certification center. The central electronic certification center, as a trusted third party, stores and provides the shared hash value, enhancing trust between the electronic data sender and receiver. Figure 2 This includes the following sub-steps: Step S3.1: The electronic data sender sends the identity information to the electronic certification center. Since the identity information usually contains sensitive data, such as personal identity information and enterprise registration information, the identity information needs to be strictly protected during transmission. The electronic certification center converts the electronic data sender's identity information into an identity hash value to prevent it from being stolen or tampered with. Step S3.2: Use the identity hash value as the initialization vector of the pseudo-random number generator to initialize the pseudo-random number generator. The initialized pseudo-random number generator randomly generates the first bit string, the second bit string, and the third bit string to ensure that the generated bit string is closely related to the identity information of the electronic data sender. Step S3.3: Divide the first bit string into elements of the second finite ring, and randomly select values from the second finite ring to obtain a random vector. The second and third bit strings are respectively segmented and mapped onto discrete Gaussian distributions to generate the first error vector. Second error vector It can increase the random vector First error vector Second error vector Unpredictability; Step S3.4: Based on the public key and random vector of the electronic data recipient and the first error vector Encrypted text used to identify the sender of electronic data and the hash value of the encrypted identity The encrypted identity of the sender of electronic data prevents unauthorized access and disclosure. The hash value of this encrypted identity serves as the sender's unique digital fingerprint; any alteration to the identity information will result in a change to the hash value of the encrypted identity, thus verifying data integrity. This represents a random matrix in the public key of the electronic data recipient. This indicates the transpose operation. Denotes the modulus of the second finite ring. Represents a hash function; Step S3.5: Based on the public key and random vector of the electronic data recipient Second error vector Determine the shared hash value of the electronic data sender ,in, This represents the public key vector in the public key of the electronic data recipient; Step S3.6: Encrypt the identity of the electronic data sender. The hash value of the identity ciphertext The shared hash value of the electronic data sender is sent back to the sender. Stored in the central electronic certification center.

[0019] Step S4: The electronic data sender signs the document using the encapsulated identity information and transmits it to the electronic data receiver.

[0020] Step S5: The electronic data recipient uses their private key to parse the identity information encapsulated by the electronic data sender and calculates a hash value. If the hash value matches the shared hash value, authentication is successful, and the signed file is valid. Authentication is achieved through hash value matching, simplifying the electronic authentication process, improving efficiency, avoiding the need to obtain the electronic data sender's specific identity information, reducing the risk of information leakage, enhancing privacy protection, and preventing attackers from impersonating the sender by forging or stealing the electronic data sender's identity information, thus improving authentication security. Specifically, it includes the following sub-steps: Step S5.1: The electronic data recipient extracts the identity information encapsulated by the electronic data sender from the received file, parses the encapsulated identity information using the private key, and calculates the hash value. ,in, Ciphertext indicating the identity of the electronic data sender This indicates the transpose operation. This represents the private key of the recipient of the electronic data. Represents the modulus. Represents a hash function; Step S5.2: If the hash value Shared hash value stored in the central electronic certification center Consistency indicates successful authentication and that the signed document is valid.

[0021] Although the sender of electronic data uses a random vector during the encapsulation of identity information, the generation of the shared hash value is based on mathematical operations. The receiver of electronic data uses their own private key and the received encrypted identity information to recover the hash value through the same mathematical operations. Due to the deterministic nature of the data operations, as long as the sender and receiver use the same private-public key pair, the same encrypted information, and the same hash function, the consistency between the hash value calculated by the receiver and the shared hash value can be guaranteed. This enables rapid electronic authentication, improves authentication efficiency, and avoids the risk of identity information leakage.

[0022] This invention combines federated key management and post-quantum cryptography algorithms to significantly improve the security and efficiency of electronic authentication services.

[0023] In one embodiment of the present invention, a computer-readable storage medium is also provided, storing a computer program that enables a computer to execute the electronic authentication service method of the present invention, which combines federated key management and post-quantum cryptography algorithms.

[0024] In one technical solution of the present invention, an electronic device is also provided, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the electronic authentication service method of the present invention that combines federated key management and post-quantum cryptography algorithms.

[0025] In the embodiments disclosed in this application, a computer storage medium may be a tangible medium that may contain or store programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of computer storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0026] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0027] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should be considered within the scope of protection of the present invention.

Claims

1. A method for providing electronic authentication services that combines federated key management and post-quantum cryptography algorithms, characterized in that, The steps include: Step S1: Deploy the quantum cryptography algorithm in each local electronic certification center, and the electronic data recipient generates the recipient's private key-public key pair through the corresponding local electronic certification center; Step S2: Upload the generated recipient private key-public key pair to the central electronic certification center for storage, and transmit the private key in the recipient private key-public key pair to the recipient, and transmit the public key in the recipient private key-public key pair to the electronic certification center connected to the electronic data sender. Step S3: The electronic certification center where the electronic data sender is located encapsulates the identity information of the electronic data sender using the public key in the private key-public key pair of the receiver, generates a shared hash value of the electronic data sender, sends the encapsulated identity information back to the electronic data sender, and stores the shared hash value in the central electronic certification center. Step S4: The electronic data sender signs the document using the encapsulated identity information and transmits it to the electronic data receiver; Step S5: The electronic data recipient uses the private key to parse the identity information encapsulated by the electronic data sender and calculates the hash value. If the hash value matches the shared hash value, the authentication is successful and the signed file is valid.

2. The electronic authentication service method combining federated key management and post-quantum cryptography algorithms according to claim 1, characterized in that, Step S1 includes the following sub-steps: Step S1.1: The local electronic certification center randomly sets the dimensions of the grid. Modulus and error distribution parameters ; Step S1.2: Based on the modulus Determine the first finite ring From the first finite ring Random values are randomly selected to form a random matrix. ,in, Represents a random matrix Dimensions ; Step S1.3: In the first finite ring Based on error distribution parameters Perform discrete Gaussian distribution random sampling to form the private key. ; Step S1.4: Based on the private key random matrix and modulus Calculate the public key vector ,in, Represents the random sampling error vector; Step S1.5: [The text appears to be incomplete and contains several grammatical errors. A more accurate translation would require the full context.] The recipient's public key is composed of the private key. The private key used as the recipient's private key.

3. The electronic authentication service method combining federated key management and post-quantum cryptography algorithms according to claim 1, characterized in that: If the local electronic certification center corresponding to the electronic data recipient is in a normal state, the private key in the recipient's private-public key pair is sent back to the recipient through the local electronic certification center; otherwise, the private key in the recipient's private-public key pair is transmitted through the central electronic certification center to the electronic certification center adjacent to the local electronic certification center, and then transmitted by the adjacent electronic certification center to the recipient.

4. The electronic authentication service method combining federated key management and post-quantum cryptography algorithms according to claim 1, characterized in that: If the local electronic certification center corresponding to the electronic data sender is in normal status, the public key in the receiver's private-public key pair will be transmitted to the local electronic certification center corresponding to the electronic data sender through the central electronic certification center; otherwise, the public key in the receiver's private-public key pair will be transmitted to the electronic certification center adjacent to the electronic data sender through the central electronic certification center.

5. The electronic authentication service method combining federated key management and post-quantum cryptography algorithms according to claim 1, characterized in that, Step S3 includes the following sub-steps: Step S3.1: The electronic data sender sends its identity information to the electronic authentication center, which converts the electronic data sender's identity information into an identity hash value; Step S3.2: Use the identity hash value as the initialization vector of the pseudo-random number generator to initialize the pseudo-random number generator, and randomly generate the first bit string, the second bit string and the third bit string using the initialized pseudo-random number generator; Step S3.3: Divide the first bit string into elements of the second finite ring, and randomly select values from the second finite ring to obtain a random vector. The second and third bit strings are respectively segmented and mapped onto discrete Gaussian distributions to generate the first error vector. Second error vector ; Step S3.4: Based on the public key and random vector of the electronic data recipient and the first error vector Encrypted text used to identify the sender of electronic data and the hash value of the encrypted identity ,in, This represents a random matrix in the public key of the electronic data recipient. This indicates the transpose operation. Denotes the modulus of the second finite ring. Represents a hash function; Step S3.5: Based on the public key and random vector of the electronic data recipient Second error vector Determine the shared hash value of the electronic data sender ,in, This represents the public key vector in the public key of the electronic data recipient; Step S3.6: Encrypt the identity of the electronic data sender. The hash value of the identity ciphertext The shared hash value of the electronic data sender is sent back to the sender. Stored in the central electronic certification center.

6. The electronic authentication service method combining federated key management and post-quantum cryptography algorithms according to claim 1, characterized in that, Step S5 includes the following sub-steps: Step S5.1: The electronic data recipient extracts the identity information encapsulated by the electronic data sender from the received file, parses the encapsulated identity information using the private key, and calculates the hash value. ,in, Ciphertext indicating the identity of the electronic data sender This indicates the transpose operation. This represents the private key of the recipient of the electronic data. Represents the modulus. Represents a hash function; Step S5.2: If the hash value Shared hash value stored in the central electronic certification center Consistency indicates successful authentication and that the signed document is valid.

7. A computer-readable storage medium storing a computer program, characterized in that, The computer program causes the computer to perform the electronic authentication service method combining federal key management and post-quantum cryptography as described in any one of claims 1-6.

8. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the electronic authentication service method combining federal key management and post-quantum cryptography as described in any one of claims 1-6.