Lightweight authentication method for quantum digital certificate

Abstract

The invention discloses a lightweight authentication method for a quantum digital certificate, which comprises the following steps: S1, a client initiates an authentication request to a unified authentication service, and the authentication request contains authentication information based on the quantum digital certificate; s2, the unified authentication service receives the authentication request, and sends the ciphertext or signature data needing key operation and the quantum key identifier to a quantum secret service system; s3, according to the received quantum key identifier, the quantum secret service system indexes and calls a corresponding quantum key in a safe internal environment, and performs decryption or signature verification operation on the ciphertext or signature data; the method has the beneficial effects that the true random key is generated by using the quantum key entropy source, the quantum computing-resistant trust chain is constructed from the root certificate level, and in the authentication process, the transmitted quantum key identifier is not the key itself but has no computing significance, so that the risk that the key is intercepted in transmission and is used for reverse cracking is avoided.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security and power communication technology, in particular to a lightweight authentication method of quantum digital certificate. BACKGROUND

[0002] With the rapid development of smart grid and power internet of things, a large number of terminal devices (such as smart meters, line monitoring terminals, distributed energy controllers, etc.) need to access the power communication network. The identity authentication of these devices is the first line of defense to ensure the safe and stable operation of the power grid.

[0003] In the standard authentication process of the existing digital certificate authentication, the public key and other key information used for signature verification are usually transmitted in plaintext form in the certificate or transmitted in the communication link. Although the attacker cannot directly calculate the private key from the public key, the attacker can intercept these key information, conduct offline analysis and accumulation, and provide data basis for future cracking (including using more powerful classical computers or future quantum computers for reverse cracking). At the same time, the authentication server itself needs to store and use important keys such as root keys for operation. Once the server is attacked, the entire trust system will collapse. Therefore, we propose a lightweight authentication method of quantum digital certificate. SUMMARY

[0004] The purpose of the present application is to provide a lightweight authentication method of quantum digital certificate to solve the problems raised in the background technology.

[0005] To achieve the above purpose, a lightweight authentication method of quantum digital certificate includes the following steps: S1, the client initiates an authentication request to the unified authentication service, and the authentication request contains authentication information based on quantum digital certificate, wherein the key information involved in the quantum digital certificate is replaced by the corresponding quantum key identifier; S2, the unified authentication service receives the authentication request, and sends the ciphertext or signature data requiring key operation and the quantum key identifier to the quantum key service system; S3, the quantum key service system indexes and calls the corresponding quantum key in a secure internal environment according to the received quantum key identifier, and performs decryption or signature verification operation on the ciphertext or signature data; S4, the quantum key service system returns the decryption or signature verification result to the unified authentication service; S5, the unified authentication service completes the authentication process of the client according to the result.

[0006] As a preferred, the root key of the quantum digital certificate is generated by a quantum key entropy source, and at least the public key information of the root certificate exists in the form of quantum key representation in the certificate issuance and verification link.

[0007] As preferred, the quantum key identifier is a unique index number or hash value of a real quantum key generated by a quantum key entropy source and stored in the quantum key service system, which does not have the operation function of encryption and decryption or signature itself.

[0008] As preferred, in the authentication process, the authentication information transmitted between the client and the unified authentication service does not contain any complete key data that can be directly used for cryptographic operations, but only contains the quantum key identifier.

[0009] As preferred, the ciphertext or signature data requiring key operation includes at least one of encrypted information in a certificate application, signature of a certificate revocation list, or challenge signature generated by the client in the authentication process.

[0010] As preferred, after completing the decryption or signature verification operation, the quantum key service system only returns "success", "failure" or desensitized plaintext data to the unified authentication service, and does not return any intermediate process data or the quantum key used.

[0011] As preferred, the quantum key service system and the unified authentication service communicate through a secure private network, and the quantum key service system is deployed in a physically secure and controllable environment.

[0012] A quantum digital certificate lightweight authentication system for implementing the lightweight authentication method of the quantum digital certificate described above, comprising a client device, a unified authentication service and a quantum key service system. The client device is used to initiate a digital certificate authentication request containing a quantum key identifier. The unified authentication service is used to receive the authentication request and interact with the quantum key service system. The quantum key service system is used to receive key information from the unified authentication service, parse the quantum key representation therein, and complete decryption and signature verification operations to return the results to the unified authentication service.

[0013] As preferred, the unified authentication service is further configured to complete the final authentication of the client device according to the results returned by the quantum key service system.

[0014] Compared with the prior art, the beneficial effects of the present application are: The present application uses a quantum key entropy source to generate a true random key, and constructs a quantum computing-resistant trust chain from the root certificate level. In the authentication process, the transmitted is not the key itself but the "quantum key identifier" without computational significance, effectively eliminating the risk of key interception and reverse cracking during transmission, and establishing a quantum security barrier for digital certificates facing the future.

[0015] The application separates the complex quantum correlation operation from the standard authentication process, and the quantum digital certificate system in the back end is uniformly completed, so that the front-end unified authentication service and the client device do not need to be quantumized, and the benefits of quantum security can be enjoyed, which greatly reduces the upgrading cost and deployment threshold of the existing system, and is conducive to the rapid promotion of technology.

[0016] The application concentrates all key storage, decryption and signature verification operations in the highly secure quantum digital certificate system, physically and logically isolates the key assets from the authentication service exposed in the open network environment, and the centralized and fortified management shrinks the attack surface, so that even if the authentication server is attacked, the core key is still safe, thereby greatly enhancing the defense-in-depth capability of the entire system. BRIEF DESCRIPTION OF DRAWINGS

[0017] Fig. 1 The logical block diagram of the application is shown in the figure; Fig. 2 The method flowchart of the application is shown in the figure. DETAILED DESCRIPTION

[0018] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, not all. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0019] Please refer to Figs. 1-2 The application provides a technical solution: a lightweight authentication method for quantum digital certificates, including the following steps: S1, the client initiates an authentication request to the unified authentication service, and the authentication request contains authentication information based on quantum digital certificates, wherein the key information involved in the quantum digital certificates is replaced by the corresponding quantum key identifier; the root key of the quantum digital certificate is generated by a quantum key entropy source, and at least the public key information of the root certificate exists in the form of quantum key representation in the certificate issuing and verification link.

[0020] It needs to be noted that the client holds a special digital certificate, namely a "quantum digital certificate", which may be compatible with standard X.509 certificates in terms of format, but the core key field is not the real public key data, but one or more quantum key identifiers (QKI); the QKI is a "pointer" or "receipt" to the real quantum key stored in the backend quantum key service system, which is a string of random numbers or strings and has no mathematical cryptographic value, and even if intercepted, the attacker cannot use it for any cryptographic operation or derive the original key; the trust anchor (root certificate) of the entire certificate system is itself represented by a quantum key identifier, and the corresponding real quantum public key is generated by a quantum key entropy source (such as a quantum random number generator QRNG) and securely stored in the quantum key service system; when the client initiates authentication, it will construct authentication information according to the standard protocol, and finally send the signature result and the quantum key identifier representing the public key to the unified authentication service, instead of the public key itself.

[0021] S2, the unified authentication service receives the authentication request, and sends the ciphertext or signature data requiring key operation and the quantum key identifier to the quantum key service system, the quantum key identifier being a unique index number or hash value of the real quantum key generated by the quantum key entropy source and stored in the quantum key service system, which itself has no encryption or decryption or signature operation function.

[0022] It needs to be noted that the unified authentication service does not hold any critical long-term private key and does not need to have complex cryptographic operation capability, and its main function is to verify the protocol flow, manage the session state, and act as a security intermediary between the client and the quantum key service system; after receiving the client request, the unified authentication service will parse the request packet, identify the part requiring cryptographic verification and the associated quantum key identifier; then, it will package the "data to be verified" (such as the original text and signature value) and the "corresponding quantum key identifier" into a new internal service request, and send it to the quantum key service system through a secure and authenticated channel.

[0023] S3, the quantum key service system indexes and calls the corresponding quantum key according to the received quantum key identifier in a secure internal environment, and performs decryption or signature verification operation on the ciphertext or signature data; the ciphertext or signature data requiring key operation includes at least one of the encrypted information in the certificate application, the signature of the certificate revocation list, or the challenge signature generated by the client in the authentication process.

[0024] It should be noted that the quantum secret service system is deployed in a high-security area with physical isolation and strictly controlled access. The communication link between the system and the unified authentication service is usually a secure private network or an internal network protected by high-strength encryption, greatly reducing the risk of eavesdropping or man-in-the-middle attacks. After receiving the request, the system first verifies the legitimacy of the request, then uses the received quantum key identifier as an index to query its secure key database, which stores a large number of real quantum key pairs generated and managed by the quantum entropy source. The system calls the real private key or public key corresponding to the quantum key identifier to perform the required cryptographic operations.

[0025] S4, the quantum secret service system returns the decryption or signature verification result to the unified authentication service. After completing the decryption or signature verification operation, the quantum secret service system only returns "success", "failure", or desensitized plaintext data to the unified authentication service, and does not return any intermediate process data or quantum keys used. The quantum secret service system and the unified authentication service communicate through a secure private network, and the quantum secret service system is deployed in a physically secure and controllable environment.

[0026] It should be noted that the quantum secret service system strictly follows the "minimum information return" principle and never returns any original key, intermediate calculation result, or decrypted sensitive plaintext used in the operation process directly to the unified authentication service. For signature verification operations, only "success" or "failure" is usually returned. For decryption operations, if decrypted data needs to be returned, the data may be desensitized or re-encrypted.

[0027] S5, the unified authentication service completes the authentication process for the client according to the result. During the authentication process, the authentication information transmitted between the client and the unified authentication service does not contain any complete key data that can be directly used for cryptographic operations, but only contains quantum key identifiers.

[0028] It should be noted that after receiving the explicit result from the quantum secret service system, the unified authentication service pushes the authentication process based on this result. If the signature verification result is "success", the client's identity is considered legitimate and the authentication is passed, and a session is established. If the result is "failure", the authentication fails, the connection is disconnected, and logs are recorded.

[0029] In the application, the quantum secret service system is deployed in a physical access controlled and network isolated machine room, the system comprises a quantum random number generator, a quantum key management module and a cryptographic service engine; the quantum random number generator is used to generate real random numbers as the entropy source of all keys; the quantum key management module is used to generate, store and manage quantum key pairs, each key pair is assigned a globally unique quantum key identifier, which can be a serial number in the database or a hash value of the key data; the cryptographic service engine provides decryption, signature verification and other cryptographic operation capabilities; the system first generates a pair of quantum keys (public key and private key) for the root certificate authority, and the public key will become the trust anchor of the entire system; The employee client initiates a certificate application, the enterprise CA receives the application, requests the quantum secret service system to generate a key pair for a new user, the quantum secret service system generates a new pair of quantum keys (user public key and user private key) and returns the user public key identifier to the CA; the CA signs the user's certificate information (including the user public key) using its quantum private key (the corresponding real private key is in the quantum secret service system), sends the to-be-signed certificate text and the quantum private key to the quantum secret service system, and returns the signature result after the quantum secret service system completes the signature; the user public key and the quantum digital certificate signed by the CA, and the employee client is issued.

[0030] When the application is used, the employee inputs the OA system address in the browser, the client (browser) establishes a TLS connection with the unified authentication service (as the gateway of the OA system), in the TLS handshake process, the server requires the client to provide a certificate, the client sends the quantum digital certificate to the unified authentication service (the certificate contains the user public key identifier, not the real public key data), at the same time, the client generates a temporary random number and signs the random number using the private key corresponding to the quantum certificate, the signature operation cannot be completed in the client because the client does not have the private key, therefore, the client actually sends the to-be-signed random number and the user public key to a local security agent, the agent forwards the signature request to the quantum secret service system, the quantum secret service system completes the signature using the real private key corresponding to the user public key, and returns the signature result to the client; the client sends the signature value together with the certificate; After receiving the certificate and the signature of the client, the unified authentication service starts verification, the unified authentication service packs the verification task, sends the received “to-be-verified certificate chain, the signature sent by the client and the original random number generated by the client” to the quantum secret service system through an internal secure API, and requests to perform “certificate and signature verification”; The system verifies from the user certificate, step by step, to the root certificate, when verifying the signature of each step, it uses the issuer quantum key identification carried in the certificate to find the corresponding real public key to verify the validity of the certificate signature; the system uses the user public key extracted from the user certificate to find the corresponding real public key to verify whether the signature sent by the client is generated by the corresponding private key to the original random number generated by the client; After the quantum key service system completes all verifications, it does not return any key or certificate plaintext content, but returns a structured and simple verification result message to the unified authentication service; after receiving the verification result as "success", the unified authentication service determines that the client identity authentication is passed; it continues to complete the subsequent steps of the TLS handshake and allows the employee to access the OA system, and if "failure" is received, the connection is terminated immediately.

[0031] In summary, the application replaces the real key with the quantum key identification in the authentication process, and all core cryptographic operations are stripped to the quantum key service system in the background for unified processing, which fundamentally improves the security, realizes excellent lightness and compatibility, and significantly enhances the overall resilience of the system by centralized control of the key and operation in the security bastion. Even if the front-end authentication service is broken, the core key assets are still safe.

[0032] Although the embodiments of the application have been shown and described, it can be understood by those skilled in the art that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and spirits of the application, and the scope of the application is defined by the appended claims and their equivalents.

Claims

1. A lightweight authentication method for quantum digital certificates, characterized in that, Includes the following steps: S1. The client initiates an authentication request to the unified authentication service. The authentication request contains authentication information based on the quantum digital certificate. In this case, the key key information involved in the quantum digital certificate is replaced with the corresponding quantum key identifier. S2. The unified authentication service receives the authentication request and sends the ciphertext or signature data that requires key operation along with the quantum key identifier to the quantum security service system. S3. The quantum security system, based on the received quantum key identifier, indexes and calls the corresponding quantum key in a secure internal environment to decrypt or verify the ciphertext or signature data. S4. The quantum security system returns the decryption or signature verification result to the unified authentication service. S5. The unified authentication service completes the authentication process for the client based on the result.

2. The lightweight authentication method for quantum digital certificates according to claim 1, characterized in that, The root key of the quantum digital certificate is generated by a quantum key entropy source, and at least the public key information of the root certificate exists in the form of a quantum key representation in the certificate issuance and verification chain.

3. The lightweight authentication method for quantum digital certificates according to claim 1, characterized in that, The quantum key identifier is a unique index number or hash value of the real quantum key generated by the quantum key entropy source and stored internally in the quantum security system. It does not have encryption, decryption or signature functions on its own.

4. The lightweight authentication method for quantum digital certificates according to claim 1, characterized in that, During the authentication process, the authentication information transmitted between the client and the unified authentication service does not contain any complete key data that can be directly used for cryptographic operations, but only the quantum key identifier.

5. A lightweight authentication method for quantum digital certificates according to claim 1, characterized in that, Ciphertext or signature data requiring key operations includes at least one of the following: encrypted information in a certificate application, a signature on a certificate revocation list, or a challenge signature generated by the client during the authentication process.

6. The lightweight authentication method for quantum digital certificates according to claim 1, characterized in that, After completing the decryption or signature verification operation, the quantum cryptographic service system only returns "success", "failure" or de-identified plaintext data to the unified authentication service, without returning any intermediate process data or the quantum key itself.

7. The lightweight authentication method for quantum digital certificates according to claim 1, characterized in that, The quantum security service system communicates with the unified authentication service via a secure private network, and the quantum security service system is deployed in a physically secure and controllable environment.

8. A lightweight authentication system for a quantum digital certificate used to implement a lightweight authentication method for a quantum digital certificate as described in any one of claims 1-7, characterized in that, This includes client devices, unified authentication services, and quantum-based security systems. The client device is used to initiate a digital certificate authentication request containing a quantum key identifier; The unified authentication service is used to receive authentication requests and interact with the quantum cryptographic service system; The quantum key distribution system is used to receive key information from the unified authentication service, parse the quantum key representation therein, complete the decryption and signature verification operations, and return the results to the unified authentication service.

9. A lightweight authentication method for quantum digital certificates according to claim 8, characterized in that, The unified authentication service is further configured to complete the final authentication of the client device based on the results returned by the quantum security system.

Images