Anti-quantum cryptography agile migration method of dynamic adaptive algorithm

Abstract

The invention relates to the field of digital certificates and certificate application, and discloses an anti-quantum cryptography agile migration method capable of dynamically adapting to an algorithm, which is cooperatively executed by a strategy server, a certificate server and an application terminal: the strategy server monitors a migration progress and dynamically generates and issues a migration strategy; the application terminal analyzes the strategy and applies for a specified type of certificate from the certificate server; the certificate server carries out processing and issues a certificate; and the application terminal dynamically selects an algorithm compatible with the target application to establish secure connection according to the strategy during communication. According to the method, through automatic certificate management driven by a strategy and terminal self-adaptive algorithm selection, agile and smooth migration of the cryptographic algorithm is realized, and the problems of compatibility and safety management in the migration process are effectively solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of digital certificates and certificate applications, and particularly relates to an agile migration method of quantum-resistant cryptography with dynamically adaptive algorithms. BACKGROUND

[0002] Currently, traditional cryptographic systems are gradually migrating to quantum-resistant cryptographic systems to address the security threats posed by quantum computing. However, due to the complexity of different application systems and the limitations of actual migration conditions, compatibility and security issues during the migration process have become difficult problems to be solved.

[0003] During the migration process of cryptographic systems, the following problems often exist: 1. Inconsistent migration progress: Different applications or services have different migration time points due to technical limitations or business needs, resulting in the coexistence of traditional cryptographic algorithms and quantum-resistant cryptographic algorithms in the system.

[0004] 2. Increased security risks: Due to inconsistent migration, some systems or data may be exposed to security risks during the migration period.

[0005] 3. Low efficiency: Traditional fixed strategies cannot dynamically adapt to different migration progress and security needs, resulting in resource waste and low efficiency.

[0006] Therefore, an algorithm adaptive strategy that can dynamically adapt to the migration progress and security needs of quantum-resistant cryptography is proposed, and the security and compatibility optimization during the migration process is achieved through the algorithm adaptive strategy, which has important technical value and practical significance. SUMMARY

[0007] In view of the deficiencies of the prior art, the purpose of the present application is to provide an agile migration method of quantum-resistant cryptography with dynamically adaptive algorithms.

[0008] The scheme of the present application is: An agile migration method of quantum-resistant cryptography with dynamically adaptive algorithms, which is cooperatively executed by a policy server, a certificate server, and an application terminal, the application terminal and the policy server, and the target business application belong to the same regulated trusted system domain; comprising the following steps: S1, policy dynamic management and distribution, the policy server monitors the migration progress and security needs of each application in real time, dynamically generates a migration policy based on the monitoring results, and distributes the migration policy to the corresponding application terminal; S2, adaptive certificate application and issuance, The application terminal receives and parses the migration policy, initiates a certificate application request to the certificate server according to the policy indication, and the certificate type includes one of traditional certificate, quantum-resistant certificate, and hybrid certificate; The certificate service end receives the application, issues corresponding type of certificate after processing, and returns to the application terminal; the application terminal receives and stores the certificate; S3, adaptive algorithm selection and secure communication, the application terminal initiates communication to the target service application, dynamically selects an algorithm compatible with the target service application according to the migration progress of the target service application in the migration strategy, establishes a secure connection with the target service application, and performs encrypted communication.

[0009] As a preferred technical solution, the strategy dynamic management and delivery includes the following steps: 1) Service end monitoring, the strategy service end periodically or in real time collects the migration progress and security requirement data of each application, including application identification, application version, migrated algorithm type, and algorithm usage strategy; 2) Strategy generation, the strategy service end dynamically calculates and generates the strategy content of this migration according to the collected data and the predefined security strategy template, and the strategy content includes identity field, certificate configuration field, algorithm control field and progress management field; the identity field is used to specify at least one terminal or terminal group, and the identity field includes terminal ID or group ID; the certificate configuration field is used to indicate the certificate type configured for the target terminal or target terminal group; the algorithm control field includes application customized algorithm flag bit, which is used to indicate whether to enable the customized algorithm for the target terminal or target terminal group; the progress management field includes an application progress list, which is used to record the application state of the strategy; The application progress list includes application identification, application version, migrated algorithm type, and algorithm usage strategy; 3) Strategy delivery, the strategy service end delivers the strategy document to the corresponding application terminal through a secure communication channel; 4) Real-time update, when the application migration state or security requirement changes, the strategy service end regenerates and pushes the updated strategy, which takes effect immediately after being received by the application terminal.

[0010] As a preferred technical solution, in the S2 step, the application terminal determines the type of certificate to be applied by analyzing the certificate configuration field in the migration strategy.

[0011] As a preferred technical solution, the S3 step includes: 1) Dynamic flag detection, the application terminal re-reads and analyzes the application progress list and algorithm flag bit in the latest migration strategy every time it initiates communication or service call; 2) Algorithm decision, determine the algorithm type according to the migration progress of the target service application; If the target application has completed the anti-quantum algorithm migration, preferentially select the specified anti-quantum algorithm; If the target application has not migrated the anti-quantum algorithm, a traditional algorithm is selected; 3) Secure communication establishment, the application terminal uses the selected algorithm to perform handshake negotiation with the target service application, and sends the outbound service data after encryption.

[0012] The application also discloses a system of an agile migration method of an anti-quantum password using a dynamically adaptive algorithm, comprising a policy server, a certificate server and an application terminal. The policy server is configured to monitor the migration progress and security requirements of the application, dynamically generate a migration policy, and issue the policy to the application terminal. The certificate server, as an authentication agency, is configured to receive a certificate application of the application terminal and issue a certificate of the requested type. The application terminal is configured to receive the migration policy, apply for a certificate from the certificate server according to the policy, and dynamically select an algorithm to establish a secure connection with the target service application according to the policy.

[0013] As a preferred technical solution, the policy server comprises a monitoring module, a policy generation module and a policy issuing module. The monitoring module is used to collect migration progress data and security requirement data of each service application in real time. The policy generation module is used to dynamically generate a migration policy according to the data collected by the monitoring module. The policy issuing module is used to issue and update the migration policy to the application terminal through a secure channel.

[0014] As a preferred technical solution, the application terminal comprises a policy analysis module, a certificate management module and an algorithm execution module. The policy analysis module is used to receive and analyze the migration policy from the policy server. The certificate management module is used to apply for and manage certificates of corresponding types from the certificate server according to the analysis of the policy. The algorithm execution module is used to dynamically select a corresponding algorithm for password operation according to the migration policy and the state of the target service application.

[0015] Compared with the prior art, the application has the following advantages: (1) Dynamic and agile, through centralized management and real-time issuance of the migration policy by the policy server, dynamic regulation and control of the entire migration process is realized. When the migration progress or network security environment of an application changes, the system can quickly respond and push a new policy, ensuring that all terminals can immediately adapt to changes, realizing true "password agility" and greatly improving the flexibility and response speed of the system.

[0016] (2) Excellent compatibility and smooth migration capability. Through the application terminal adaptive selection algorithm mechanism, the compatibility problem of the coexistence of the old and new systems during the migration process is perfectly solved. The application terminal can intelligently switch between traditional algorithm and quantum-resistant algorithm according to the actual support of the target application, ensuring that business communication can always proceed normally during the long migration transition period, and realizing a seamless and smooth migration.

[0017] (3) Optimal balance between security and performance: The method provides refined security control capabilities. The policy server can formulate differentiated policies based on the security risk level of the application. When the application terminal executes the application, it can prioritize the use of quantum-resistant algorithms to ensure security in high-risk scenarios and select efficient traditional algorithms to ensure performance in low-risk scenarios. This on-demand allocation of security resources achieves the best balance between security strength and system performance.

[0018] (4) Quantum-resistant security design: By supporting the application and use of hybrid certificates, it prepares for the security threats posed by future quantum computers. This approach not only solves the current migration compatibility problem, but also constructs a framework that can smoothly transition to the post-quantum cryptography era, which has significant forward-looking and strategic value.

[0019] (5) Centralized and automated management concentrates complex policy decision-making and status monitoring functions on the policy server, thereby significantly reducing the deployment and management complexity of the application terminal itself. The application terminal only needs to follow the issued policy to execute, which is highly automated, reduces human configuration errors, and improves the management efficiency and reliability of the entire migration process. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating the migration strategy generation and distribution process for Example 1. Figure 2 Here is a flowchart of the adaptive certificate application process for Example 1; Figure 3 The flowchart for the adaptive algorithm selection in Example 1 is shown. Detailed Implementation

[0022] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below with reference to specific embodiments. Example 1

[0023] A quantum-resistant cryptographic transfer method with a dynamically adaptive algorithm, comprising the following steps for generating and distributing the transfer strategy: 1) Server-side monitoring: The strategy server periodically or in real time collects the migration progress and security requirements of each application, including application identifier, application version, type of migrated algorithm, and algorithm usage strategy; 2) Policy generation: The policy server dynamically calculates and generates the policy content for this migration based on the collected data and predefined security policy templates. This includes the terminal ID / group ID, required certificate type, application-customized algorithm flag, and application progress list (application identifier, application version, migrated algorithm type, and algorithm usage policy). 3) Policy distribution: The policy server distributes the policy document to the corresponding application terminal through a secure communication channel; 4) Real-time updates: When the application migration status or security requirements change, the policy server regenerates and pushes the updated policy, which takes effect immediately upon receipt by the application terminal (see...). Figure 1 ).

[0024] The adaptive certificate application and issuance process can be triggered when the application terminal first receives the policy during initialization, or when a change in certificate requirements in the latest issued policy is detected during operation. This ensures that the application terminal always holds the certificate necessary for executing the algorithm selection locally. The steps are as follows: 1) Policy parsing: After receiving the migration policy from the policy server, the application terminal parses the policy content and determines the type of certificate to be applied for (traditional certificate, quantum-resistant certificate, or hybrid certificate). 2) Certificate application: The application terminal initiates a certificate application request to the certificate server; 3) Certificate Issuance: The certificate server receives the application, processes it, issues the requested certificate type, and returns it to the application terminal; 4) Local storage: The application terminal receives the certificate and loads it into the local certificate storage module for subsequent encrypted communication (see...). Figure 2 ).

[0025] The adaptive algorithm selection and secure communication process steps are as follows: 1) Dynamic flag detection: When the application terminal initiates communication or business calls, it rereads and parses the application progress list and algorithm flag bits in the latest migration strategy; 2) Algorithm decision: Determine the type of algorithm to use based on the migration progress of the target business application; If the target application has already completed the quantum-resistant algorithm migration, the specified quantum-resistant algorithm will be selected first. If the target application has not yet migrated to quantum-resistant algorithms, then the traditional algorithm should be selected; 3) Secure Communication Establishment: The application terminal uses the selected algorithm to complete authentication and key negotiation with the target business application (server-business application service), and encrypts the outbound business data before sending it, thereby completing secure communication (see...). Figure 3 ). Example 2

[0026] A system employing a quantum-resistant cryptographic agile migration method using a dynamically adaptive algorithm includes a policy server, a certificate server, and an application terminal. The policy server configuration is used to monitor the migration progress and security requirements of the application, dynamically generate migration policies, and distribute the policies to the application terminal. The certificate server, acting as a certification authority, is configured to receive certificate applications from application terminals and issue certificates of the requested type. The application terminal is configured to receive the migration policy, apply for a certificate from the certificate server according to the policy, and dynamically select an algorithm to establish a secure connection with the target business application according to the policy.

[0027] The policy server includes a monitoring module, a policy generation module, and a policy distribution module; The monitoring module is used to collect migration progress data and security requirement data of various business applications in real time; The strategy generation module is used to dynamically generate migration strategies based on the data collected by the monitoring module; The policy distribution module is used to distribute and update migration policies to the application terminal through a secure channel.

[0028] The application terminal includes a policy parsing module, a certificate management module, and an algorithm execution module. The policy parsing module is used to receive and parse migration policies from the policy server; The certificate management module is used to apply for and manage certificates of the corresponding types from the certificate server according to the parsed policy instructions; The algorithm execution module is used to dynamically select the appropriate algorithm for cryptographic operations based on the migration strategy and the status of the target business application.

[0029] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A quantum-resistant cryptographic agile transfer method with a dynamically adaptive algorithm, characterized in that, The application terminal, policy server, and target business application belong to the same regulated trusted system domain; Includes the following steps: S1. Dynamic management and distribution of policies: The policy server monitors the migration progress and security requirements of each application in real time, dynamically generates migration policies based on the monitoring results, and distributes the migration policies to the corresponding application terminals. S2, Adaptive Certificate Application and Issuance The application terminal receives and parses the migration policy, and adaptively initiates a certificate application request to the certificate server according to the policy instructions. The certificate type includes one of traditional certificate, quantum-resistant certificate and hybrid certificate. The certificate server receives the application, processes it, issues the corresponding type of certificate, and returns it to the application terminal; the application terminal receives and stores the certificate. S3. Adaptive Algorithm Selection and Secure Communication: When the application terminal initiates communication with the target business application, it dynamically selects a compatible algorithm based on the migration progress of the target business application in the migration strategy, so as to establish a secure connection with the target business application and conduct encrypted communication.

2. The quantum-resistant cryptographic agile migration method with a dynamically adaptive algorithm as described in claim 1, characterized in that, The dynamic management and distribution of the strategy includes the following steps: 1) Server-side monitoring: The strategy server periodically or in real time collects migration progress and security requirement data of each application, including application identifier, application version, migrated algorithm type, and algorithm usage strategy; 2) Policy Generation: The policy server dynamically calculates and generates the policy content for this migration based on the collected data and predefined security policy templates. The policy content includes an identity field, a certificate configuration field, an algorithm control field, and a progress management field. The identity field is used to specify at least one terminal or terminal group, and the identity field includes a terminal ID or a group ID. The certificate configuration field is used to indicate the certificate type configured for the target terminal or target terminal group. The algorithm control field includes an application custom algorithm flag, which indicates whether to enable the custom algorithm for the target terminal or target terminal group. The progress management field includes an application progress list, which records the application status of the policy. The application progress list includes the application identifier, application version, migrated algorithm type, and algorithm usage strategy; 3) Policy distribution: The server distributes the policy document to the corresponding application terminal through a secure communication channel; 4) Real-time updates: When the application migration status or security requirements change, the policy server regenerates and pushes the updated policy, which takes effect immediately upon receipt by the application terminal.

3. The quantum-resistant cryptographic agile transfer method with a dynamically adaptive algorithm as described in claim 1, characterized in that: In step S2, the application terminal determines the type of certificate to be applied for by parsing the certificate configuration field in the migration strategy.

4. The quantum-resistant cryptographic agile migration method with a dynamically adaptive algorithm as described in claim 1, characterized in that, Step S3 includes: 1) Dynamic flag detection: Each time the application terminal initiates a communication or service call, it rereads and parses the application progress list and algorithm flag bits in the latest migration strategy; 2) Algorithm decision: Determine the type of algorithm to use based on the migration progress of the target business application; If the target application has already completed the quantum-resistant algorithm migration, the specified quantum-resistant algorithm will be selected first. If the target application has not yet migrated to quantum-resistant algorithms, then the traditional algorithm should be selected; 3) Secure communication is established. The application terminal uses the selected algorithm to perform a handshake negotiation with the target service application and encrypts the outbound service data before sending it.

5. A system for a quantum-resistant cryptographic agile transfer method using the dynamically adaptive algorithm according to any one of claims 1 to 4, characterized in that: This includes policy server, certificate server, and application terminal: The policy server configuration is used to monitor the migration progress and security requirements of the application, dynamically generate migration policies, and distribute the policies to the application terminal. The certificate server, acting as a certification authority, is configured to receive certificate applications from application terminals and issue certificates of the requested type. The application terminal is configured to receive the migration policy, apply for a certificate from the certificate server according to the policy, and dynamically select an algorithm to establish a secure connection with the target business application according to the policy.

6. The system as described in claim 5, characterized in that: The policy server includes a monitoring module, a policy generation module, and a policy distribution module; The monitoring module is used to collect migration progress data and security requirement data of various business applications in real time; The strategy generation module is used to dynamically generate migration strategies based on the data collected by the monitoring module; The policy distribution module is used to distribute and update migration policies to the application terminal through a secure channel.

7. The system as described in claim 5, characterized in that: The application terminal includes a policy parsing module, a certificate management module, and an algorithm execution module. The policy parsing module is used to receive and parse migration policies from the policy server; The certificate management module is used to apply for and manage certificates of the corresponding types from the certificate server according to the parsed policy instructions; The algorithm execution module is used to dynamically select the appropriate algorithm for cryptographic operations based on the migration strategy and the status of the target business application.

Images