Quantum security signature method and device, equipment, medium and program product

Abstract

The invention provides a quantum security signature method which can be applied to the technical field of quantum communication. The quantum security signature method comprises the following steps: in response to a received quantum security signature request for target plaintext data, performing risk assessment on the quantum security signature request according to a preset security policy, and determining a risk level corresponding to the quantum security signature request; determining a target post-quantum signature algorithm and an algorithm parameter set corresponding to the quantum security signature request according to the risk level; according to the algorithm parameter set, performing dynamic function reconstruction on the computing resource for executing the signature operation to obtain the reconstructed computing resource; and performing quantum security signature on the target plaintext data by using the reconstructed computing resources and a target post-quantum signature algorithm to obtain a quantum security signature result. The invention further provides a quantum security signature device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] This application relates to the field of quantum communication, and more specifically to a quantum-safe signature method, apparatus, device, medium, and program product. Background Technology

[0002] With the development of quantum computing, traditional public-key cryptography faces severe challenges, and post-quantum cryptography has become the cornerstone of future information security. In high-security sectors such as finance and government, applying post-quantum cryptographic signature algorithms to blockchain and digital certificate scenarios has become an inevitable trend. However, existing quantum secure signature schemes generally employ a fixed, single algorithm. This leads to a core contradiction: when facing transactions with different security levels (e.g., small payments versus large transactions), using a high-security algorithm to handle low-risk requests results in unnecessary computation and time overhead, reducing system efficiency; conversely, using an efficient algorithm to handle high-risk requests may lead to insufficient security protection. Current technologies lack a mechanism to dynamically and seamlessly adjust the security strength and computation mode of the signature algorithm based on real-time business risks, making it difficult to achieve an intelligent balance between security and efficiency while ensuring quantum security. Summary of the Invention

[0003] In view of the above problems, this application provides a quantum-safe signature method, apparatus, device, medium and program product.

[0004] According to a first aspect of this application, a quantum-safe signature method is provided, comprising: responding to a received quantum-safe signature request for target plaintext data; performing a risk assessment on the quantum-safe signature request according to a preset security policy to determine the risk level corresponding to the quantum-safe signature request; determining the target post-quantum signature algorithm and algorithm parameter set corresponding to the quantum-safe signature request based on the risk level; dynamically reconstructing the computing resources used to perform the signature operation based on the algorithm parameter set to obtain reconstructed computing resources; and using the reconstructed computing resources and the target post-quantum signature algorithm to perform a quantum-safe signature on the target plaintext data to obtain a quantum-safe signature result.

[0005] According to an embodiment of this application, a risk assessment is performed based on a preset security policy to determine the risk level corresponding to a quantum-secure signature request. This includes: analyzing the context information of the quantum-secure signature request, where the context information includes at least one of the following: request source attributes, data attributes of the target plaintext data, and application scenario attributes; outputting a quantified risk assessment value based on the matching degree between the context information and the preset security policy; and mapping the risk assessment value to a predefined risk level range to determine the risk level corresponding to the quantum-secure signature request.

[0006] According to an embodiment of this application, determining the target post-quantum signature algorithm and algorithm parameter set corresponding to a quantum-secure signature request based on the risk level includes: determining the target post-quantum signature algorithm and algorithm parameter set according to the risk level and a preset mapping relationship; wherein, the risk level includes a first risk level, a second risk level, and a third risk level, the second risk level representing a higher degree of risk than the first risk level, and the third risk level representing a higher degree of risk than the second risk level; the preset mapping relationship includes: the first risk level is mapped to a first target post-quantum signature algorithm and a first algorithm parameter set, the algorithm parameter set indicating the use of a first computational strength; the second risk level is mapped to a second target post-quantum signature algorithm and a second algorithm parameter set, the second algorithm parameter set indicating the use of a second computational strength higher than the first computational strength; the third risk level is mapped to a third target post-quantum signature algorithm and a third algorithm parameter set, the third algorithm parameter set indicating the use of a third computational strength higher than the second computational strength.

[0007] According to an embodiment of this application, the third algorithm parameter set further includes an instruction to enable post-processing function, to perform quantum-safe signature on the target plaintext data, and to obtain a quantum-safe signature result. It also includes: when the current risk level is the third risk level, to perform compression processing on the quantum-safe signed target plaintext data according to the instruction to enable post-processing function, and to obtain a quantum-safe signature result.

[0008] According to an embodiment of this application, before performing quantum-safe signature using the reconstructed computing resources, the method further includes: storing the target plaintext data in a secure data interaction area; and enabling the reconstructed computing resources to read the plaintext data from the data interaction area.

[0009] According to an embodiment of this application, based on an algorithm parameter set, the computing resources used to perform signature operations are dynamically reconfigured, including: generating a reconfiguration control instruction stream based on the algorithm parameter set; and, based on the reconfiguration control instruction stream, switching the operation unit parameters and functional links within the computing resources in real time without interrupting the current service state, so as to complete the adaptation to the target post-quantum signature algorithm within a microsecond time.

[0010] According to an embodiment of this application, based on an algorithm parameter set, the computing resources used to perform signature operations are dynamically reconfigured, including: parsing the algorithm parameter set to obtain multiple algorithm parameters; determining the computing resource configuration required for the quantum signature algorithm after execution based on the multiple algorithm parameters; and loading the computing resource configuration into the computing resources to set the working parameters and functional states of each operation unit in the computing resources.

[0011] A second aspect of this application provides a quantum-safe signature device, comprising: a risk assessment module, configured to, in response to a received quantum-safe signature request for target plaintext data, assess the risk of the quantum-safe signature request according to a preset security policy and determine the risk level corresponding to the quantum-safe signature request; an algorithm determination module, configured to determine the target post-quantum signature algorithm and algorithm parameter set corresponding to the quantum-safe signature request based on the risk level; a dynamic reconstruction module, configured to, based on the algorithm parameter set, dynamically reconstruct the computing resources used to perform the signature operation to obtain reconstructed computing resources; and a quantum signature module, configured to, using the reconstructed computing resources and the target post-quantum signature algorithm, perform a quantum-safe signature on the target plaintext data to obtain a quantum-safe signature result.

[0012] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0013] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0014] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0015] The quantum-safe signature method, apparatus, device, medium, and program product in this application embodiment, after receiving a signature request, performs a risk assessment based on a preset strategy to determine the risk level. Based on the risk level, it determines the corresponding target quantum signature algorithm and algorithm parameter set, and dynamically reconfigures computing resources according to this algorithm parameter set to adapt to the target algorithm. Finally, it completes the signature using the reconfigured resources, achieving an adaptive match between signature security strength and computing resource overhead. This quantum-safe signature method can solve the problem in existing technologies where fixed quantum-safe signature algorithms cannot be dynamically adjusted according to business risks, resulting in insufficient efficiency in high-security scenarios or resource waste in low-risk scenarios. Attached Figure Description

[0016] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0017] Figure 1 The illustrations depict application scenarios of quantum-secure signature methods, apparatuses, devices, media, and program products according to embodiments of this application.

[0018] Figure 2 A flowchart illustrating a quantum-safe signature method according to an embodiment of this application is shown schematically.

[0019] Figure 3 A flowchart illustrating the determination of risk levels according to an embodiment of this application is shown schematically;

[0020] Figure 4 A flowchart illustrating dynamic functional reconfiguration according to an embodiment of this application is shown schematically;

[0021] Figure 5 A schematic diagram illustrating the structure of a quantum-safe signature device according to an embodiment of this application is shown; and

[0022] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a quantum-safe signature method according to an embodiment of this application. Detailed Implementation

[0023] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0024] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0025] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0026] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0027] Figure 1The illustration shows an application scenario diagram of the quantum-safe signature method according to an embodiment of this application.

[0028] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0029] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0030] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0031] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0032] It should be noted that the quantum-safe signature method provided in this application embodiment can generally be executed by server 105. Correspondingly, the quantum-safe signature device provided in this application embodiment can generally be located in server 105. The quantum-safe signature method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the quantum-safe signature device provided in this application embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0033] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0034] The following will be based on Figure 1 The described scene, through Figures 2-4 A quantum-safe signature method according to embodiments of this application will be described in detail.

[0035] Figure 2 A flowchart illustrating a quantum-safe signature method according to an embodiment of this application is shown.

[0036] like Figure 2 As shown, the quantum-secure signature method of this embodiment includes operations S210 to S240.

[0037] In operation S210, in response to the received quantum-secure signature request for the target plaintext data, a risk assessment of the quantum-secure signature request is performed according to the preset security policy to determine the risk level corresponding to the quantum-secure signature request.

[0038] In some embodiments, the target plaintext data refers to the original information or document that has not been encrypted and requires digital signature. A quantum-safe signature request is an instruction or call that requires the system to generate a digital tag with authentication and integrity protection functions for the target plaintext data using cryptographic methods resistant to future quantum computer attacks. A pre-defined security policy is a set of rules pre-set during system deployment or initialization that defines how to assess the potential security impact of a request. The risk level is a classification result output by this assessment process, used to identify the level of security sensitivity associated with the request.

[0039] This operation is the trigger and decision-making stage for initiating the entire adaptive signature process. It begins when the system detects and receives a clear quantum-safe signature request, and this request is associated with the plaintext data to be processed. Its core task is to transform an abstract signature requirement into a specific quantitative security indicator, namely, the risk level.

[0040] Upon receiving a quantum-secure signature request for the target plaintext data, the system invokes a pre-defined security policy. This policy may include a series of logical judgment rules and weighting parameters, such as: "Requests from the internal security network have a lower base risk score," "Data involving fund transfers has an increased risk coefficient," and "Transaction attempts at night or in unusual geographical locations trigger risk accumulation." The system automatically matches and calculates the quantum-secure signature request against these rules. This process may involve reasoning by the rule engine and calculations by a weighted scoring model, ultimately producing a quantitative risk assessment value, such as a score between 0 and 100.

[0041] Finally, the system maps this risk assessment value to several predefined risk level ranges. For example, a score of 0-30 maps to "low risk level," 31-70 to "medium risk level," and 71-100 to "high risk level." Through this mapping, continuous scores are converted into discrete, clear level identifiers. This risk level serves as the core decision-making basis for all subsequent steps, determining which level of security protection resources will be invoked for this signature.

[0042] In operation S220, the target quantum signature algorithm and algorithm parameter set corresponding to the quantum secure signature request are determined according to the risk level.

[0043] In some embodiments, a target post-quantum signature algorithm refers to a specific mathematical scheme for generating and verifying digital signatures that is widely considered in current cryptographic research to maintain its security even with the advent of large-scale general-purpose quantum computers in the future. The algorithm parameter set is a set of configuration data necessary for a post-quantum signature algorithm to function, defining the mathematical structure, computational scale, performance, and on / off states of optional functions when the algorithm is instantiated.

[0044] This operation is the execution and translation phase of the security policy. Its input is the risk level determined by operation S210, and its output is specific executable technical instructions. The system internally maintains a static, predefined mapping table. This mapping table establishes a fixed correspondence between each possible risk level and a specific "algorithm-parameter package" combination.

[0045] During this step, the system uses the received risk level as the lookup key to directly query this mapping table. The mapping relationship is designed according to the core security principle: higher risk levels must correspond to signature algorithms that provide higher theoretical security strength, and are usually accompanied by greater computational overhead. For example, for a "low risk level," the mapping table may specify the use of algorithm A, with an accompanying parameter set A. This parameter set configures the core mathematical operations of the algorithm on a smaller dimension to prioritize computational speed. For a "medium risk level," it may map to algorithm B (or a high-strength variant of algorithm A) and parameter set B, where the mathematical operation dimension is expanded, thereby increasing the difficulty of cracking. For a "high risk level," it may map to algorithm C and parameter set C. This parameter set not only uses the largest operational dimension but may also contain a special control flag to indicate that additional data compression processing needs to be initiated after signature generation.

[0046] This process does not involve real-time evaluation of the algorithm or dynamic optimization of parameters; it is a deterministic lookup or branching process. The result is explicit and unique: it determines which post-quantum cryptography standard will be executed next, as well as all the detailed values ​​and control switches required to run the algorithm. The algorithm parameter set typically includes: the ring dimension or matrix size for the core polynomial operations, the modulus of the finite field or integer ring, noise distribution parameters for sampling, and Boolean flags indicating whether post-signature compression or other post-processing is enabled.

[0047] In operation S230, based on the algorithm parameter set, the computing resources used to perform signature operations are dynamically reconfigured to obtain the reconfigured computing resources.

[0048] In some embodiments, computing resources specifically refer to a set of physical or logical operation units in the system that are specifically designed or highly optimized for performing cryptographic operations. Dynamic functional reconfiguration refers to the process of rapidly and in real-time switching of the working modes, connection relationships, and data formats and parameters of each functional submodule within the computing resource, without interrupting the overall service availability of the computing resource, based on configuration information provided externally.

[0049] This operation is a crucial hardware adaptation step in connecting the strategy and execution, based on the algorithm parameter set provided by the S220. The primary task of this operation is to parse the algorithm parameter set and identify all key technical specifications, such as: the number of points that the core number theory transformation needs to support, the specific large integer modulo values ​​that the modulo operator needs to use, and the flag status that controls whether the post-processing function is enabled.

[0050] After parsing, the system generates a set of fine-grained, low-latency control instruction streams. These instruction streams directly act on a series of configuration registers or programmable logic units within the computing resources. The essence of refactoring is the real-time redirection of hardware data paths and computational logic. Computing resources typically contain configurable arrays of arithmetic logic units, switchable interconnect buses, and multiple independently enable or disable dedicated coprocessors (such as hash units, random number generators, and compression engines).

[0051] The reconfiguration process is completed in an extremely short time (on the order of microseconds) and is characterized by its crucial "seamless" or "uninterrupted" nature. This means that before and after the execution of the reconfiguration instructions, the service interfaces exposed by the computing resources remain active, capable of receiving and responding to task requests, and the internal main circuitry remains powered on and clock-synchronized, without undergoing a complete reset or initialization. The control instruction flow atomically and synchronously updates the configuration of each subunit: for example, switching the operation scale of the polynomial multiplier from 768 points to 1024 points; replacing the modulus constant currently used by the modulus arithmetic unit from Q1 to Q2; and simultaneously opening or closing the output path from the signature computation core to the data compression module based on the flag bits in the parameter set.

[0052] Once all these internal configurations have been switched, the hardware behavior of the computing resource has been reshaped, and its functional characteristics are perfectly aligned with the requirements of the target post-quantum signature algorithm. At this point, it transforms from a general state or a state serving the previous task into a "reconstructed computing resource" dedicated to the current signature request. It has been loaded with the correct "mold" and is ready to handle the upcoming signature computation task with maximum efficiency and specialization.

[0053] In operation S240, using the reconstructed computing resources and the target post-quantum signature algorithm, the target plaintext data is quantum-securely signed to obtain a quantum-secure signature result.

[0054] In some embodiments, the quantum-secure signature result is output data generated by applying the aforementioned quantum-resistant cryptographic scheme to perform a series of mathematical processes on the original data. This result, attached to the original data, proves the authenticity of the data source to the recipient and ensures that the data has not been tampered with in any way during transmission or storage.

[0055] This operation is the final execution and output stage of signature generation. First, the plaintext data to be signed needs to be loaded into a storage buffer that can be directly and efficiently accessed by the reconstructed computing resources through a secure and controllable path. Then, the system issues explicit execution instructions to the reconstructed computing resources, which typically include information such as the starting address of the data in the buffer.

[0056] Upon receiving the instruction, the reconstructed computing resources begin operating according to their pre-reconstructed hardware logic. The process strictly follows the standardized sequence of computational steps defined by the "target post-quantum signature algorithm." These steps are fixed and typically include: generating the required random numbers using an internal secure random number generator; calling a hash function to compress and digest the target plaintext data; performing a series of large-scale polynomial multiplications, additions, or matrix-vector operations within a lattice cryptography or other post-quantum cryptographic mathematical framework, all of which are hardware-accelerated by dedicated arithmetic units (such as modular multiplication-addition units); and finally, assembling the results in a specific format.

[0057] If the algorithm parameter set determined in operation S220 includes an instruction to enable post-processing functions (such as compression), then after the core signature operation is completed, the generated raw signature data block will not be output immediately, but will be automatically routed to the specified post-processing module (such as a lossless compression engine). This module compresses the signature data to reduce its size, and then outputs the final result after processing. If post-processing is not enabled, the output of the core operation is the final result.

[0058] The final quantum-secure signature is a piece of cryptographic data generated based on the target plaintext data, the signer's private key information, and the randomness of the algorithm. It is sent or stored along with the original plaintext data. Any subsequent verifier can use the corresponding public key and the accompanying verification algorithm to check the signature, thus confirming the integrity of the data and the authenticity of its origin. This security is based on mathematical principles resistant to quantum computing attacks.

[0059] The quantum-safe signature method in this application embodiment constructs a closed-loop adaptive quantum-safe signature generation system from risk perception to hardware execution. It realizes the automatic selection of the optimal cryptographic protection strength according to the real-time security requirements of business requests, and drives the underlying computing resources to instantly complete the hardware configuration switch without interrupting services. This solves the problem of wasted computing resources in low-risk scenarios when using fixed signature algorithms.

[0060] Figure 3 A flowchart illustrating the determination of risk levels according to an embodiment of this application is shown schematically.

[0061] like Figure 3 As shown, the quantum-secure signature method of this embodiment includes operations S310 to S330.

[0062] In operation S310, the context information of the quantum-safe signature request is analyzed. The context information includes at least one of the following: request source attribute, data attribute of the target plaintext data, and application scenario attribute.

[0063] In some embodiments, contextual information refers to a set of data associated with a specific operation or event, describing the environment, state, and characteristics of that operation or event. Request source attributes are parameters used to identify and describe the characteristics of the entity or terminal initiating the quantum-secure signature request, such as the entity's identity code, network address, device type, or security domain category. Data attributes of the target plaintext data are parameters used to describe the characteristics of the original information content itself that needs to be signed, such as the business category to which the data belongs, a preset sensitivity level label, the asset value or financial amount it represents, and the data format or size. Application scenario attributes are parameters used to describe the specific business background and environmental conditions in which this signature request occurs, such as the time the request occurred, the geographical or logical location of the operation, and the specific transaction type or service process stage being executed.

[0064] This operation is the initial data collection phase of the risk assessment process. Its core task is to systematically collect and parse all available descriptive information related to the current signature request. This operation is triggered when the system receives a quantum-safe signature request, and its goal is to extract features from the request's metadata, associated data, and system environment that reflect the potential security impact of this signature operation across multiple dimensions.

[0065] During execution, the system concurrently retrieves information from multiple interfaces and logs. Regarding the request source attribute, the system may verify the authentication token attached to the request, parse its corresponding user or service account, record the International Mobile Equipment Identity (IMEI) or Internet Protocol address (IPA) of the terminal device initiating the request, and determine whether the source belongs to a pre-defined internal security network. For the data attributes of the target plaintext data, the system reads the metadata carried by the data, such as business category tags like "Public Announcement" and "High-Value Transfer Voucher" in the file header, or automatically identifies whether it is personal identification information, medical records, or financial contracts based on the data content structure. Simultaneously, the system may query the database to obtain the transaction amount associated with the data. Regarding the application scenario attribute, the system records the current timestamp to determine if it is outside of working hours; obtains the geographical location information of the request access point; and determines whether the operation scenario is "user login authentication," "payment confirmation," or "smart contract deployment" based on the application programming interface or service endpoint name called in this request.

[0066] The collected raw data was then standardized into structured fields. For example, the source Internet Protocol address was converted into the corresponding network area code, the timestamp was converted into a category label of "working hours" or "non-working hours," and the monetary value was mapped to discrete ranges such as "small amount," "large amount," and "large amount." Ultimately, this pre-processed, multi-dimensional attribute information constituted a set of contextual information for subsequent risk calculations.

[0067] When operating the S320, a quantitative risk assessment value is output based on the matching degree between context information and the preset security policy.

[0068] In some embodiments, a pre-defined security policy is a complete and formalized set of decision logic and rules pre-defined and input into the system by security managers before system deployment, based on business security specifications and compliance requirements. Matching degree refers to the measure of compliance or trigger strength obtained by comparing the collected specific contextual information with the conditions specified in the security policy. A quantified risk assessment value is a numerical output that intuitively represents the level of risk, derived from the matching degree through a computable model.

[0069] This operation is the core of the risk assessment calculation. Its function is to integrate the discrete, multi-dimensional contextual information collected by operation S310 into a single comprehensive risk score through an objective and repeatable automated decision-making logic. Its input is a structured set of contextual information, and its output is a numerical value representing the level of risk.

[0070] The execution process relies on a pre-defined security policy. This policy is typically represented by a rule base or a weighted scoring model. If a rule base is used, the policy contains multiple "if-then" conditional statements, such as: "If the request originates from an external network, then the base risk score increases by 20 points," "If the data attribute contains the 'highly sensitive' tag, then the risk score is multiplied by a coefficient of 1.5," and "If the application scenario is 'large nighttime transfer,' then the cumulative risk score increases by 50 points." The system matches each attribute in the context information with the conditional parts of all rules, triggering all rules that meet the conditions and executing the scoring operations in their conclusion parts, ultimately summing up the scores of all rules.

[0071] If a weighted scoring model is used, the strategy predefines a scoring table containing multiple risk factors (corresponding to contextual information attributes). Each factor has a specific base score for different values, and each factor is assigned a weight coefficient. The system looks up the base score for each factor in the scoring table based on the specific values ​​of each attribute in the context information, then multiplies each factor's base score by its weight coefficient and sums the results to obtain the total score. Regardless of the form used, the entire calculation process is deterministic and requires no human intervention. Assuming an initial score of 10, after calculation, the risk assessment value might be (10+20)*1.5 = 45 points. This 45 points is the quantitative risk assessment value requested in this case. It provides a unified numerical scale for risk comparison and subsequent classification.

[0072] In operation S330, the risk assessment value is mapped to a predefined risk level range to determine the risk level corresponding to the quantum secure signature request.

[0073] In some embodiments, the predefined risk level ranges are a series of numerical ranges pre-divided during the system design phase for categorizing continuous risk assessment values ​​into segments. Each range corresponds to a risk level label with a clear business meaning.

[0074] This operation is the final output stage of the risk assessment process. Its purpose is to convert the continuous quantitative score calculated by operation S320 into a discrete strategy instruction that is easy for subsequent processing systems to understand and execute. This process is a simple, stateless interval judgment.

[0075] When initializing a system, system administrators or security architects predefine risk level classification criteria based on business tolerance and security objectives. For example, they might define three risk levels: low risk, medium risk, and high risk. Simultaneously, they assign a corresponding risk assessment value range to each level: low risk corresponds to 0 to 30 points, medium risk to 31 to 70 points, and high risk to 71 to 100 points. These range boundaries and level labels are stored in the system as static configuration.

[0076] When this operation is executed, the system sequentially compares the received risk assessment value (such as 45 points in the previous example) with these predefined intervals. The comparison logic is deterministic: first, it determines whether the score falls within the low-risk interval; if not, it determines whether it falls within the medium-risk interval, and so on. For a score of 45, it is greater than 30 and less than or equal to 70, therefore it is determined to belong to the "medium-risk" level interval.

[0077] Once the interval matching is complete, the system officially determines the risk level label ("medium risk") associated with that interval as the final risk level corresponding to this quantum-safe signature request. This level is a symbolic output that serves as the core input to the entire system's security policy execution engine, directly determining the strength of the cryptographic algorithm and computational resources to be invoked subsequently. The mapping process ensures that requests with different scores but belonging to the same interval (e.g., requests with scores of 45 and 65) are classified into the same risk level and receive the same security processing. This achieves appropriate merging and simplification of the policy based on fine-grained evaluation, improving the execution efficiency and consistency of subsequent steps.

[0078] The quantum-secure signature method described in this application constitutes an automated, data-driven risk assessment pipeline. This pipeline transforms previously vague, experience-dependent security judgments into precise, consistent, and repeatable automated decision-making processes through systematic collection of multi-dimensional contextual information from signature requests, objective quantitative calculations based on pre-defined strategies, and standard mapping to discrete levels. This provides a reliable and unambiguous basis for policy execution, enabling the dynamic allocation of cryptographic protection resources of varying strengths according to risk levels, and fundamentally ensuring a precise match between security measures and actual business risks.

[0079] According to an embodiment of this application, determining the target post-quantum signature algorithm and algorithm parameter set corresponding to a quantum-secure signature request based on the risk level includes: determining the target post-quantum signature algorithm and algorithm parameter set according to the risk level and a preset mapping relationship; wherein, the risk level includes a first risk level, a second risk level, and a third risk level, the second risk level representing a higher degree of risk than the first risk level, and the third risk level representing a higher degree of risk than the second risk level; the preset mapping relationship includes: the first risk level is mapped to a first target post-quantum signature algorithm and a first algorithm parameter set, the algorithm parameter set indicating the use of a first computational strength; the second risk level is mapped to a second target post-quantum signature algorithm and a second algorithm parameter set, the second algorithm parameter set indicating the use of a second computational strength higher than the first computational strength; the third risk level is mapped to a third target post-quantum signature algorithm and a third algorithm parameter set, the third algorithm parameter set indicating the use of a third computational strength higher than the second computational strength.

[0080] In some embodiments, computational intensity is a comprehensive indicator that measures the complexity of an algorithm's computational process and its resistance to attacks. Generally, higher computational intensity means greater computational requirements and higher theoretical security.

[0081] The function of this step is to precisely translate an abstract risk level instruction into a specific, executable technical solution configuration. The system pre-establishes and stores a fixed mapping table. This table uses different risk levels as input conditions, with each level uniquely corresponding to a specific output combination. This combination contains two parts: a specified signature algorithm and a set of parameters configured for that algorithm.

[0082] The risk levels are designed with at least three sequential levels: the first risk level represents the lowest security threat, the second risk level represents the medium security threat, and the third risk level represents the highest security threat. This classification reflects the hierarchical nature of security requirements.

[0083] The pre-defined mapping follows the core principle that higher risk equates to stronger protection. When the input is at the highest risk level, the mapping will point to a primary target post-quantum signature algorithm with computational efficiency advantages, along with a primary set of algorithm parameters. This parameter set configures the algorithm's core mathematical operations at a relatively basic scale, reflecting the primary computational intensity to prioritize processing speed and resource conservation.

[0084] When the input is at a higher second-risk level, the mapping will point to a different, or enhanced, second-target post-quantum signature algorithm, along with a second set of algorithm parameters. This second set of parameters increases the algorithm's core computational scale or adjusts its mathematical structure, thereby activating a second computational strength higher than the first, providing stronger security to match medium-level threats.

[0085] When the input is the highest third-risk level, the mapping will point to a third-objective post-quantum signature algorithm with a more complex or conservative cryptographic design, along with a third set of algorithm parameters. The third set of parameters configures the computational scale of the algorithm to the highest level, or adopts the most conservative parameter choices, thereby initiating the highest third operational strength, aiming to provide the strongest theoretical security protection under current technological conditions for extremely high-value operations or data.

[0086] The execution process is a deterministic query or branch decision: after receiving the risk level, the system compares it with the mapping relationship, and then outputs a unique combination of algorithms and parameter sets bound to it, which serves as a precise blueprint for all subsequent technical operations.

[0087] The quantum-secure signature method in this application establishes a rigid mapping relationship between risk level and specific algorithm configuration, transforming security policy decisions into executable cryptographic instructions. This ensures that different levels of security threats can always trigger computational protection mechanisms of different strengths, achieving a strict positive correlation and automatic matching between security protection strength and business risk level.

[0088] According to an embodiment of this application, the third algorithm parameter set further includes an instruction to enable post-processing function, to perform quantum-safe signature on the target plaintext data, and to obtain a quantum-safe signature result. It also includes: when the current risk level is the third risk level, to perform compression processing on the quantum-safe signed target plaintext data according to the instruction to enable post-processing function, and to obtain a quantum-safe signature result.

[0089] In some embodiments, the third algorithm parameter set is a set of signature algorithm execution parameters configured to address the highest level of security risks. It includes not only numerical values ​​defining the core computational strength but may also contain additional commands to control whether further processing is performed after the signature is completed. The instruction to enable post-processing is a specific control signal included within the third algorithm parameter set. Its function is to indicate that after completing the basic cryptographic signature operation, further processing of the preliminary result is required. Compression is a specific data processing operation whose goal is to reduce the storage space occupied or the amount of data required for transmission without losing the original information content, using specific encoding methods.

[0090] This step is a conditional branch extension of the signature generation process, specifically for signature requests assessed as having the highest security threat (Level 3 risk). It requires that, when determining the technical solution based on the risk level, the third algorithm parameter set assigned to Level 3 risk explicitly includes an instruction field to enable post-processing functionality.

[0091] The entire signing process begins by strictly adhering to the selected third-objective post-quantum signature algorithm and its parameter set (excluding post-processing instructions), just as with other risk levels, to complete all core cryptographic operations. These operations produce a complete and verifiable preliminary signature result that provides the highest level of theoretical security.

[0092] The key difference lies in the subsequent steps. Before outputting the final result, the system checks whether the parameter set for this execution contains an instruction to enable post-processing. Since the current request is at risk level three, this instruction exists and is valid. Therefore, the system does not directly output the preliminary signature result, but instead uses it as input, automatically routing it to a dedicated data compression module.

[0093] The compression module processes the received preliminary signature result (i.e., the target plaintext data after quantum-safe signing) according to its built-in data compression rules. The compression process aims to analyze and eliminate statistical redundancy in the data, re-representing the information in a more compact format. For example, it may identify and shorten recurring character sequences or specific encoding patterns. This process is deterministic, meaning that the same input data will always produce the same, smaller output data after compression, and this output data can be completely and losslessly recovered to the original input through the corresponding decompression process.

[0094] Ultimately, this compressed output, with its smaller data size, will be recognized as the quantum-safe signature result of this signature operation and output. For requests at the first and second risk levels, since their algorithm parameter sets do not contain this instruction, the preliminary results generated by their core operations will be directly output as the final result, without undergoing this compression step.

[0095] The quantum-secure signature method in this application adds lossless compression processing to the signature results under the highest risk scenario. On the basis of the highest level of cryptographic security already provided, it further optimizes the practical performance of the data and effectively reduces the data volume of the final signature result, thereby reducing its occupation of network transmission bandwidth and consumption of storage space. It is particularly suitable for high security-sensitive business scenarios where signature data needs to be frequently transmitted or stored in large quantities for a long time, and achieves synergistic optimization of security strength and transmission and storage efficiency.

[0096] According to an embodiment of this application, before performing quantum-safe signature using the reconstructed computing resources, the method further includes: storing the target plaintext data in a secure data interaction area; and enabling the reconstructed computing resources to read the plaintext data from the data interaction area.

[0097] In some embodiments, a secure data exchange area refers to a temporary data storage area within the system, protected by a dedicated mechanism. Its main design purpose is to provide a controllable and secure temporary storage and transfer environment for the target plaintext data to be processed between the signature preparation phase and the core computation phase.

[0098] This step is a crucial data preparation process that begins before the core signature calculation flow starts. It aims to create conditions for the target plaintext data to securely and efficiently enter the computation unit. This entire operation occurs after the signature algorithm and computational resources have been determined and adapted, but before the computation instructions are formally triggered.

[0099] This step begins by transmitting the raw information to be signed—the target plaintext data—completely from its initial location or receive buffer through a controlled internal path to a pre-defined secure data exchange area. The security of this data exchange area is typically ensured by a combination of hardware and software access control mechanisms, guaranteeing that only authorized system components (such as the subsequent signature calculation unit) can read its contents, while other unrelated processes or external access are strictly prohibited. During the data storage process, its integrity may be protected through verification mechanisms to prevent transmission errors or accidental tampering.

[0100] Once the target plaintext data is successfully stored in the data exchange area, the system will immediately start or notify the reconstructed computing resources that are ready. This is done by sending an explicit read command to the computing resource or by making it aware that the data is ready. This command or status information typically includes the starting address identifier of the target data within the data exchange area.

[0101] After being reconstructed, the computing resource, upon receiving an instruction or status signal, will proactively extract the target plaintext data from the secure data exchange area through its internal data path, based on the address identifier. This reading process is direct and point-to-point, without any other unnecessary processing steps, thereby minimizing data exposure and latency. Once the data reading is complete and loaded into the computing resource's internal arithmetic registers or cache, the computing resource possesses all the input conditions required to begin executing the core signature algorithm, thus seamlessly entering the subsequent computation stages.

[0102] The quantum-secure signature method in this application establishes a protected dedicated data transfer area, enabling secure and orderly connection between the data to be signed and the core computing unit. This ensures that sensitive plaintext data is in a controllable and isolated environment during the loading of the computing engine, effectively preventing the risk of unauthorized access or tampering of data during the preparation stage.

[0103] According to an embodiment of this application, based on an algorithm parameter set, the computing resources used to perform signature operations are dynamically reconfigured, including: generating a reconfiguration control instruction stream based on the algorithm parameter set; and, based on the reconfiguration control instruction stream, switching the operation unit parameters and functional links within the computing resources in real time without interrupting the current service state, so as to complete the adaptation to the target post-quantum signature algorithm within a microsecond time.

[0104] In some embodiments, a reconfiguration control instruction flow refers to a set of low-level control signals organized in a specific order and containing detailed operational commands. These instructions are used to directly direct configuration changes of hardware resources. Arithmetic unit parameters are core settings that determine the behavior of specific arithmetic components within a computing resource, such as arithmetic logic units or dedicated processors, including the range of numbers they process, the number of iterations performed, or the specific mathematical constants used. Functional links refer to the pathways and logical connections between different functional modules within a computing resource used to transmit data and control signals. Current service state refers to the operational state of the computing resource when it receives a reconfiguration instruction, indicating that it is capable of receiving tasks and processing data. This state needs to be maintained during the reconfiguration process, meaning the computing resource will not enter a shutdown, reset, or unavailable mode.

[0105] The core task of this step is to transform and execute a set of guiding algorithm parameters into a precise and rapid reconfiguration of the internal structure of the physical computing resources. The entire process begins with parsing and translating the input algorithm parameter set. Based on the meaning of each value and control flag in the parameter set, the system generates a series of corresponding low-level reconfiguration control instructions that can be directly recognized and executed by the internal control circuitry of the computing resources. These instructions are very specific, such as: "Set the operating mode register of arithmetic unit A to mode X", "Connect the switch of data path B to port Y", and "Update the value of the Zth item in constant memory C to Q".

[0106] After generating a complete reconfiguration control command flow, the system sends it to the computing resource and triggers execution. Within the computing resource, there exists a control unit responsible for managing the reconfiguration process. Upon receiving the command flow, this unit coordinates all internal components requiring changes to update their configurations synchronously or nearly synchronously within a very short time window, typically on the order of microseconds. This means that, according to the instructions, new values ​​are written to the parameter registers of multiple arithmetic units, and simultaneously, the states of the bus switches or multiplexers connecting these units are changed, thereby establishing new data flow paths. The entire switching action is designed as an atomic operation or a series of fast, continuous operations, aiming to minimize the time the resource is in an uncertain intermediate state.

[0107] Crucially, the entire reconfiguration process was completed while the computing resources maintained their current service state. Specifically, this means: the main functional interfaces of the computing resources remained active and responsive to status queries; their core clock signal continued to run; and their internal logic for task scheduling and management was not cleared or reset. The reconfiguration process only changed its functional configuration without interrupting its service capabilities. After the instructions were executed, the behavior and logic of the internal circuitry of the computing resources changed, and their computing power and data flow precisely matched the requirements of the target quantum signature algorithm. The adaptation was thus completed, and the resources could immediately be used for the next computing task.

[0108] The quantum-secure signature method in this application embodiment enables microsecond-level, online, and uninterrupted dynamic reconfiguration of the functional characteristics of dedicated computing resources. This allows the same set of physical hardware to flexibly and quickly transform into its most efficient execution form according to the needs of different algorithms, greatly improving the utilization rate of hardware resources and the overall service elasticity of the system.

[0109] Figure 4 A flowchart illustrating dynamic functional reconfiguration according to an embodiment of this application is shown schematically.

[0110] like Figure 4 As shown, the quantum-secure signature method of this embodiment includes operations S410 to S430.

[0111] During operation of S410, the algorithm parameter set is parsed to obtain multiple algorithm parameters.

[0112] In some embodiments, this operation is the first substantive step in initiating dynamic functional refactoring, the task of which is to convert the set of algorithm parameters passed down from upstream into a set of discrete algorithm parameters that can be directly processed by subsequent steps.

[0113] During execution, the system reads the algorithm parameter set data. This dataset typically has a predefined structure and format; for example, it may consist of a series of key-value pairs or follow a specific binary or text protocol. The parsing process first identifies and verifies the validity of the data structure, ensuring its integrity and conformity to the expected format.

[0114] Next, the system extracts the content item by item according to the pre-defined format specifications. For example, the parameter set may contain a field named "A". The parsing process will locate this field and read its value, such as "1024". This value "1024" is then extracted as an independent algorithm parameter. In addition, the parameter set may also contain some Boolean or enumerated control flags, which the parsing process will also identify and extract as control parameters.

[0115] Each extracted algorithm parameter is assigned a clear semantic label and temporarily stored in a specific variable or data structure in memory for subsequent steps to query and use. The parsing process is deterministic; that is, the same set of algorithm parameters will always be parsed to produce the same set of algorithm parameters. This step itself does not change any hardware state; its core function is to transform the configuration information from an encapsulated state into a discrete set of data that can be directly manipulated and interpreted by subsequent logic, laying the foundation for precise resource configuration. In complex cases, the parsing process may also include basic validation of parameter validity, such as checking whether the values ​​are within the allowed range.

[0116] In operation, S420 determines the computational resource configuration required for the quantum signature algorithm after executing the target based on multiple algorithm parameters.

[0117] In some embodiments, computing resource configuration refers to a description of a series of specific settings required for the internal components of physical computing resources to correctly perform a particular task. It specifies in detail the operating mode of each relevant hardware unit, the specific numerical parameters used, and how they are connected and cooperate with each other.

[0118] This operation is the planning and decision-making stage of dynamic function reconfiguration. It receives multiple discrete algorithm parameters parsed from operation S410 as input, and outputs a detailed computing resource configuration scheme for the current target quantum signature algorithm, which can be directly loaded into hardware.

[0119] During execution, the system maintains an internal resource configuration knowledge base or mapping rules. This knowledge base defines how each algorithm parameter affects the specific configuration of the underlying hardware. It may be represented as a lookup table or a set of "if-then" configuration rules. The system uses each extracted algorithm parameter as input to query or match these rules.

[0120] The system comprehensively processes all input algorithm parameters, iterates through all relevant configuration rules, and generates a complete and conflict-free configuration list. This list constitutes the computing resource configuration, enumerating all hardware units that need adjustment (such as specific registers, multiplexers, and function module enable pins) and their target states (such as specific mode codes, specific constant values, and logic "high" or "low" levels). This step completes the logical transformation from abstract algorithm requirements to specific hardware control commands, but it has not yet been actually applied to the hardware; the generated configuration scheme awaits final application.

[0121] In operation S430, the computing resource configuration is loaded into the computing resource to set the working parameters and functional status of each computing unit in the computing resource.

[0122] In some embodiments, operating parameters are predefined values ​​or codes used to control the specific behavior of an arithmetic unit, such as clock division coefficients, arithmetic precision bit width, or specific mathematical constants. Functional status refers to the current activity and connection relationships of an arithmetic unit or functional module, such as whether it is enabled or disabled, and which upstream or downstream unit its data input / output ports are currently connected to.

[0123] This operation is the execution and activation phase of dynamic function reconfiguration. It receives the computing resource configuration scheme generated by operation S420 as input and is responsible for physically implementing it on the computing resources, thereby actually changing the behavior characteristics of their internal circuits.

[0124] The execution process is led by a configuration management controller within the computing resources. This controller first receives the complete configuration data packet to be loaded. Then, under precisely coordinated timing control, the controller issues write commands to each target unit via the internal configuration bus, according to the list in the configuration scheme.

[0125] Specifically, for the arithmetic units specified in the list as requiring configured operating parameters, the controller writes new values ​​to their corresponding configuration registers. For example, it might write a new bit-width code to a register controlling arithmetic precision, or write a new constant value to a specific address in memory storing mathematical constants. These write operations directly alter the benchmark upon which the unit subsequently performs calculations.

[0126] Simultaneously, for the parts specified in the list that require setting a functional state, the controller will operate the corresponding hardware switches. For example, setting the control signal of a multiplexer to a specific value will switch the output of a certain arithmetic unit from path A to path B; or, setting the "enable" pin of a functional module (such as a compression engine) to an active level will activate the module. These operations change the data flow and available functional combinations within the computing resources.

[0127] The loading of all configuration items is typically completed in batches within a very short time. Once the loading process is complete, all relevant computing units within the computing resource are running according to the new parameters, and the functional links are connected according to the new topology. At this point, the overall functional characteristics of the computing resource are fully matched with the requirements of the target post-quantum signature algorithm, meaning that the reconstructed computing resource has been transformed into a reconstructed computing resource and is ready to begin processing the corresponding signature calculation task at any time.

[0128] The quantum-secure signature method in this application constitutes a complete dynamic functional reconfiguration closed loop from configuration parsing and scheme planning to hardware execution. This closed-loop system can accurately, automatically and efficiently convert high-level algorithm configuration instructions into actual state changes of the underlying computing hardware, realizing flexible and rapid reshaping of dedicated computing resources. This allows it to seamlessly adapt to a variety of different post-quantum cryptographic algorithms without replacing the hardware, thereby providing excellent computing performance and security while greatly improving the utilization efficiency of hardware resources and the overall flexibility of the system in dealing with diverse tasks.

[0129] Based on the above-described quantum-safe signature method, this application also provides a quantum-safe signature device. The following will combine... Figure 5 The device is described in detail.

[0130] Figure 5 A schematic block diagram of a quantum-safe signature device according to an embodiment of this application is shown.

[0131] like Figure 5 As shown, the quantum secure signature device 500 of this embodiment includes a risk assessment module 510, an algorithm determination module 520, a dynamic reconstruction module 530, and a quantum signature module 540.

[0132] The risk assessment module 510 is used to respond to a received quantum-secure signature request for target plaintext data, perform a risk assessment on the quantum-secure signature request according to a preset security policy, and determine the risk level corresponding to the quantum-secure signature request. In one embodiment, the risk assessment module 510 can be used to perform the operation S210 described above, which will not be repeated here.

[0133] The algorithm determination module 520 is used to determine the target post-quantum signature algorithm and algorithm parameter set corresponding to the quantum-secure signature request based on the risk level. In one embodiment, the algorithm determination module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0134] The dynamic reconstruction module 530 is used to dynamically reconstruct the computing resources used to perform signature operations based on the algorithm parameter set, thereby obtaining the reconstructed computing resources. In one embodiment, the dynamic reconstruction module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0135] The quantum signature module 540 is used to perform a quantum-secure signature on the target plaintext data using the reconstructed computing resources and the target post-quantum signature algorithm, thereby obtaining a quantum-secure signature result. In one embodiment, the quantum signature module 540 can be used to perform the operation S240 described above, which will not be repeated here.

[0136] According to embodiments of this application, any multiple modules among the risk assessment module 510, algorithm determination module 520, dynamic reconstruction module 530, and quantum signature module 540 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this application, at least one of the risk assessment module 510, algorithm determination module 520, dynamic reconstruction module 530, and quantum signature module 540 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the risk assessment module 510, algorithm determination module 520, dynamic reconstruction module 530, and quantum signature module 540 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0137] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a quantum-safe signature method according to an embodiment of this application.

[0138] like Figure 6 As shown, an electronic device 600 according to an embodiment of this application includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0139] RAM 603 stores various programs and data required for the operation of electronic device 600. Processor 601, ROM 602, and RAM 603 are interconnected via bus 604. Processor 601 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 602 and / or RAM 603. It should be noted that the programs may also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0140] According to embodiments of this application, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to a bus 604. The electronic device 600 may also include one or more of the following components connected to the input / output (I / O) interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0141] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0142] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 602 and / or RAM 603 and / or one or more memories other than ROM 602 and RAM 603 described above.

[0143] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the quantum-safe signature method provided in the embodiments of this application.

[0144] When the computer program is executed by the processor 601, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0145] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 609, and / or installed from the removable medium 611. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0146] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0147] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0148] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0149] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A quantum-safe signature method, characterized in that, include: In response to a received quantum-safe signature request for target plaintext data, a risk assessment is performed on the quantum-safe signature request according to a preset security policy to determine the risk level corresponding to the quantum-safe signature request; The target post-quantum signature algorithm and algorithm parameter set corresponding to the quantum secure signature request are determined based on the risk level. Based on the algorithm parameter set, the computing resources used to perform signature operations are dynamically reconfigured to obtain the reconfigured computing resources; Using the reconstructed computing resources and the target post-quantum signature algorithm, the target plaintext data is quantum-safely signed to obtain a quantum-safe signature result.

2. The method according to claim 1, characterized in that, The step of conducting a risk assessment based on a pre-defined security policy to determine the risk level corresponding to the quantum-secure signature request includes: Analyze the context information of the quantum-safe signature request, which includes at least one of the following: request source attribute, data attribute of the target plaintext data, and application scenario attribute; Based on the matching degree between the context information and the preset security policy, a quantitative risk assessment value is output; The risk assessment value is mapped to a predefined risk level range to determine the risk level corresponding to the quantum secure signature request.

3. The method according to claim 1, characterized in that, The step of determining the target quantum signature algorithm and algorithm parameter set corresponding to the quantum-safe signature request based on the risk level includes: Based on the risk level and the preset mapping relationship, the target quantum signature algorithm and the algorithm parameter set are determined; The risk levels include a first risk level, a second risk level, and a third risk level. The second risk level represents a higher degree of risk than the first risk level, and the third risk level represents a higher degree of risk than the second risk level. The preset mapping relationship includes: The first risk level is mapped to a first target quantum signature algorithm and a first algorithm parameter set, wherein the algorithm parameter set indicates the use of a first computational strength; The second risk level is mapped to the second target, the quantum signature algorithm, and the second algorithm parameter set, the second algorithm parameter set indicating the use of a second computational strength higher than the first computational strength; The third risk level is mapped to the third target quantum signature algorithm and the third algorithm parameter set, the third algorithm parameter set indicating the use of a third computational strength higher than the second computational strength.

4. The method according to claim 3, characterized in that, The third algorithm parameter set also includes instructions to enable post-processing. The step of performing a quantum-safe signature on the target plaintext data to obtain a quantum-safe signature result further includes: Under the current risk level of level three, the target plaintext data after quantum secure signature is compressed according to the instruction to enable post-processing function, so as to obtain the quantum secure signature result.

5. The method according to claim 1, characterized in that, Prior to performing quantum-safe signatures using the reconstructed computational resources, the method further includes: Store the target plaintext data in a secure data interaction area; The reconstructed computing resources read the plaintext data from the data interaction area.

6. The method according to claim 1, characterized in that, The dynamic functional reconstruction of computing resources used for performing signature operations based on the algorithm parameter set includes: Generate a reconstruction control command stream based on the algorithm parameter set; Based on the reconstructed control command flow, the parameters of the computing units and the functional links within the computing resources are switched in real time without interrupting the current service state, so as to complete the adaptation with the target post-quantum signature algorithm within microseconds.

7. The method according to claim 1, characterized in that, The dynamic functional reconstruction of computing resources used for performing signature operations based on the algorithm parameter set includes: The algorithm parameter set is parsed to obtain multiple algorithm parameters; Based on the multiple algorithm parameters, determine the computational resource configuration required to execute the target post-quantum signature algorithm; The computing resource configuration is loaded into the computing resource to set the working parameters and functional status of each computing unit in the computing resource.

8. A quantum-safe signature device, characterized in that, The device includes: The risk assessment module is used to respond to a received quantum-safe signature request for target plaintext data, perform a risk assessment on the quantum-safe signature request according to a preset security policy, and determine the risk level corresponding to the quantum-safe signature request. The algorithm determination module is used to determine the target post-quantum signature algorithm and algorithm parameter set corresponding to the quantum-safe signature request based on the risk level. The dynamic reconstruction module is used to dynamically reconstruct the computing resources used to perform signature operations based on the algorithm parameter set, so as to obtain the reconstructed computing resources. The quantum signature module is used to perform a quantum-safe signature on the target plaintext data using the reconstructed computing resources and the target post-quantum signature algorithm, and obtain a quantum-safe signature result.

9. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images