Wireless ad hoc network quantum security authentication method and related device

Abstract

The invention belongs to the field of wireless ad hoc networks, and discloses a wireless ad hoc network quantum security authentication method and a related device, in a master station mode, a quantum protection key is written into equipment offline and is used for encrypting a one-time quantum authentication key, and symmetric challenge-response authentication is realized through ciphertext transmission and decryption; in the independent mode of the device, the device generates quantum random public and private keys and requests for a digital certificate, the server signs with a root certificate and then distributes, and certificate exchange and challenge-response authentication are supported. By adopting the method, the network security is remarkably improved, illegal access and data leakage are effectively prevented, stable operation of the key information infrastructure is ensured, the authentication reliability is enhanced, and different deployment requirements are met.

Description

Technical Field

[0001] This invention belongs to the field of wireless ad hoc network technology, and particularly relates to a quantum-secure authentication method and related device for wireless ad hoc networks. Background Technology

[0002] In the field of communication networking, wireless ad hoc network communication devices often serve as key link nodes, capable of connecting to terminal devices such as cameras via network interfaces and enabling microwave wireless relay transmission of data. Considering signal transmission requirements and equipment security, these wireless ad hoc network communication devices and the connected cameras and other terminal devices are often deployed on poles tens of meters high. This deployment method significantly reduces the possibility of attackers accessing the network via physical wired connections, making it a common equipment deployment and application model in the industry.

[0003] However, current wireless communication networks have significant security shortcomings. On the one hand, wireless ad hoc network communication devices rely on wireless networks with coverage areas of several kilometers for relay interconnection. This wireless transmission characteristic makes it possible for unauthorized wireless ad hoc network communication devices to access the network. Once an unauthorized device successfully accesses the network, it can easily lead to security incidents such as data leakage and service interruption, and may even pose a serious threat to the stable operation of the entire critical information infrastructure. On the other hand, most existing microwave ad hoc network systems in the industry adopt an authentication mechanism based on device ID blacklists and whitelists. This mechanism completes authentication and identification by pre-entering authorized device ID information into the device whitelist. However, this method has a significant flaw: the device identity information of wireless ad hoc network communication devices is easily forged and counterfeited. If an attacker obtains or successfully forges the ID of a legitimate device, they can easily bypass the authentication process and achieve unauthorized access to the network.

[0004] It is evident that current wireless communication networks suffer from several problems: the characteristics of wireless links make it easy for unauthorized devices to access the network, and existing authentication mechanisms based on device ID blacklists and whitelists are easily breached by identity forgery. Consequently, it is difficult to guarantee network security and the stable operation of critical information infrastructure. Summary of the Invention

[0005] This invention provides a quantum-safe authentication method and related device for wireless self-organizing networks. This method can effectively solve the problems in current wireless communication networks, such as the ease with which unauthorized devices can access the network due to the characteristics of wireless links, and the vulnerability of existing authentication mechanisms based on device ID blacklists and whitelists to identity forgery.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: A quantum-safe authentication method for wireless self-organizing networks is applied to a quantum-safe authentication system, wherein the authentication method is configured in master station mode or device-independent mode. In master station mode, the security authentication method includes: In a secure environment, the randomly generated quantum protection key is written offline to each wireless ad hoc network communication device; A one-time quantum authentication key is generated based on the key negotiation request from the key negotiation requester; the key negotiation requester is one of the wireless ad hoc network communication devices to be authenticated and the online wireless ad hoc network communication devices. Both parties encrypt the quantum authentication key using their respective quantum protection keys, generating two different ciphertexts. These two ciphertexts are then sent to the key negotiation requester, who forwards one of them to the other. The ciphertexts are used by both parties to decrypt them using their respective quantum protection keys, resulting in two quantum authentication keys. These keys are then used by both parties to complete secure authentication using a symmetric challenge-response authentication method. In device-independent mode, all wireless ad hoc network communication devices are pre-connected to the quantum-safe authentication system, and the authentication method includes: Receive certificate signing requests from each wireless ad hoc network communication device; the certificate signing request includes the device ID of each wireless ad hoc network communication device and a public-private key pair generated by a quantum random number generator; A digital certificate is generated by signing the certificate signing request using a pre-configured root certificate private key. The generated digital certificate is then distributed to each wireless ad hoc network communication device. This allows both the wireless ad hoc network communication device to be authenticated and the online wireless ad hoc network communication device to complete security authentication using a certificate exchange and challenge-response authentication method based on the digital certificate. The digital certificate includes the public key and device ID corresponding to each wireless ad hoc network communication device.

[0007] Furthermore, in the master station mode, the quantum security authentication system adopts a quantum security service platform; the quantum security service platform serves as the master station; the quantum random number generator of the quantum security service platform generates a unique quantum protection key for each wireless ad hoc network communication device; the quantum protection key is stored by the quantum security authentication medium of the wireless ad hoc network communication device; the quantum security authentication medium adopts a software development kit of a quantum security chip, a quantum security module, or a quantum software cryptography module.

[0008] Furthermore, in the master station mode, both parties complete security authentication using a symmetric challenge-response authentication method based on their respective quantum authentication keys, including: The wireless ad hoc network communication device to be authenticated generates a random number A, encrypts the random number A using a quantum authentication key, and generates a signature for the random number A, forming the first quantum key challenge authentication data; The wireless ad hoc network communication device to be authenticated sends the first quantum key challenge authentication data to the online wireless ad hoc network communication device; The online wireless ad hoc network communication device decrypts the random number A and verifies the signature. Based on the result of verifying the first quantum key challenge authentication data of the wireless ad hoc network communication device to be authenticated, an authentication tag for the wireless ad hoc network communication device to be authenticated is generated. An online wireless self-organizing network communication device generates a random number B, encrypts the random number A using a quantum authentication key, and generates a signature for the random number A, forming the second quantum key challenge authentication data; An online wireless ad hoc network communication device sends a second quantum key challenge authentication data and an authentication mark of the wireless ad hoc network communication device to be authenticated; The wireless ad hoc network communication device to be authenticated decrypts the random number B and verifies the signature, and generates an authentication tag for the online wireless ad hoc network communication device based on the result of verifying the second quantum key challenge authentication data of the online wireless ad hoc network communication device; The wireless ad hoc network communication device to be authenticated sends the authentication mark of the online wireless ad hoc network communication device to the online wireless ad hoc network communication device; If an online wireless ad hoc network communication device confirms that the online wireless ad hoc network communication device authentication mark is valid, the authentication is successful, and the wireless ad hoc network communication device to be authenticated is connected to the wireless ad hoc network; otherwise, the authentication fails, and the wireless ad hoc network communication device to be authenticated is refused access to the wireless ad hoc network.

[0009] Furthermore, in the device-independent mode, the quantum-secure authentication system adopts a quantum certificate authorization system; it uses the quantum random number generator built into the wireless self-organizing network communication device and the quantum-secure authentication medium to generate a pair of public and private keys; the quantum-secure authentication medium adopts a quantum-secure chip or a quantum-secure module.

[0010] Furthermore, the quantum certificate authorization system is used to issue a unique digital signature certificate conforming to the X.509 standard for each legitimate wireless ad hoc network communication device.

[0011] Furthermore, in the device-in-standby mode, the wireless ad hoc network communication device to be authenticated and the online wireless ad hoc network communication device complete security authentication using a certificate exchange and challenge-response authentication method based on digital certificates, including: The wireless ad hoc network communication device to be authenticated generates a random number and sends the random number to the online wireless ad hoc network communication device. The online wireless ad hoc network communication device uses its own private key to sign the random number, obtains the signature result, and packages the signature result and the digital signature certificate of the online wireless ad hoc network communication device and returns it to the wireless ad hoc network communication device to be authenticated. The wireless ad hoc network communication device to be authenticated verifies the legitimacy of the online wireless ad hoc network communication device using the root certificate public key of the quantum certificate authorization system based on the digital signature certificate of the online wireless ad hoc network communication device; After the digital signature certificate is verified, the wireless ad hoc network communication device to be authenticated extracts the public key of the online wireless ad hoc network communication device from the digital signature certificate, and decrypts the signature result according to the public key of the online wireless ad hoc network communication device. If the signature result is successfully verified, the authentication is successful, and the wireless ad hoc network communication device to be authenticated is connected to the wireless ad hoc network; otherwise, the authentication fails, and the wireless ad hoc network communication device to be authenticated is refused access to the wireless ad hoc network.

[0012] Furthermore, in the process of verifying the legitimacy of an online wireless ad hoc network communication device using the root certificate public key of the quantum certificate authorization system, the legitimacy of the online wireless ad hoc network communication device includes checking whether the digital signature certificate is within its validity period, whether the signature of the quantum certificate authorization system is correct, and whether the digital signature certificate is on the digital signature certificate revocation list.

[0013] A wireless self-organizing network quantum security authentication system, wherein the security authentication system is configured in master station mode or device-independent mode; In master station mode, the security authentication system includes: The filling module is used to write randomly generated quantum protection keys offline into each wireless ad hoc network communication device in a secure environment; The key generation module is used to generate a one-time quantum authentication key based on a key negotiation request from a key negotiation requester; the key negotiation requester is one of the wireless ad hoc network communication devices to be authenticated and the online wireless ad hoc network communication devices. The ciphertext generation module is used to encrypt the quantum authentication key using the respective quantum protection keys of both parties, generating two different ciphertexts. The two generated ciphertexts are then sent to the key negotiation requester, and one of the ciphertexts is forwarded to the other party by the key negotiation requester. The ciphertexts are used by both parties to decrypt them using their respective quantum protection keys, obtaining two quantum authentication keys. These keys are then used by both parties to complete security authentication using a symmetric challenge-response authentication method. In device-independent mode, all wireless ad hoc network communication devices are pre-connected to a quantum-safe authentication system, which includes: The receiving module is used to receive certificate signing requests from each wireless ad hoc network communication device; the certificate signing request includes the device ID of each wireless ad hoc network communication device and a public-private key pair generated by a quantum random number generator. The certificate generation module is used to sign the certificate signing request using a pre-configured root certificate private key to generate a digital certificate, and distribute the generated digital certificate to each wireless ad hoc network communication device; so that the wireless ad hoc network communication device to be authenticated and the online wireless ad hoc network communication device can complete the security authentication using the certificate exchange and challenge-response authentication method based on the digital certificate; the digital certificate includes the public key and device ID corresponding to each wireless ad hoc network communication device.

[0014] A quantum-safe authentication device for wireless self-organizing networks, comprising: Memory, used to store computer programs; A processor is used to implement the steps of the above-described quantum-safe authentication method for wireless ad hoc networks when executing the computer program.

[0015] A computer-readable storage medium storing a computer program, which, when executed by a processor, is used to implement the steps of the above-described wireless ad hoc network quantum security authentication method.

[0016] Compared with the prior art, the present invention has the following beneficial effects: This invention provides a quantum-secure authentication method for wireless ad hoc networks. In master station mode, a quantum protection key is written offline to the device and used to encrypt a one-time quantum authentication key. Symmetric challenge-response authentication is achieved through ciphertext transmission and decryption. In device-independent mode, the device generates a quantum random public / private key and requests a digital certificate. The server signs the certificate with a root certificate and distributes it, supporting certificate exchange and challenge-response authentication. This method addresses the issue of easy access for unauthorized devices due to the openness of wireless transmission by utilizing a quantum protection key or key material generated by quantum random numbers to ensure initial security and unpredictability, preventing key interception or replay. It also addresses the vulnerability of existing ID blacklist / whitelist mechanisms to forgery by binding the device ID to the key or certificate through a quantum mechanism, making identity information difficult to counterfeit. Furthermore, the authentication process relies on encryption and decryption operations, ensuring that only legitimate devices can complete the authentication. This method significantly improves network security, effectively prevents unauthorized access and data leakage, ensures the stable operation of critical information infrastructure, enhances authentication reliability, and adapts to different deployment requirements. Attached Figure Description

[0017] Figure 1 A schematic diagram illustrating the operating principle of the wireless self-organizing network quantum security authentication method provided in the embodiment of the present invention in master station mode; Figure 2 A diagram illustrating the symmetric challenge-response authentication process provided in this embodiment of the invention; Figure 3 A schematic diagram illustrating the operation of the wireless self-organizing network quantum security authentication method provided in this embodiment of the invention in device-independent mode; Figure 4An interactive diagram of the certificate exchange and challenge-response authentication process provided in an embodiment of the present invention; Figure 5 A flowchart of a quantum-safe authentication method for wireless self-organizing networks provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of a wireless self-organizing network quantum security authentication system provided in an embodiment of the present invention. Detailed Implementation

[0018] To further understand the content of this invention, the invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments are merely illustrative and not limiting of the invention.

[0019] To facilitate a better understanding of this technical solution, the technical terms involved in this invention are explained as follows: ID stands for Identity, which is an identity identifier.

[0020] SDK stands for Software Development Kit.

[0021] As described in the background section, wireless ad hoc network communication devices rely on relays from wireless communication devices with a coverage range of several kilometers for interconnection. This provides an opportunity for unauthorized wireless ad hoc network communication devices to access the network. Once an unauthorized device successfully accesses the network, it may lead to data leakage, service interruption, and even pose a serious threat to the stable operation of the entire critical information infrastructure. Currently, microwave ad hoc network systems in the industry use an authentication mechanism based on device ID blacklists and whitelists. This mechanism authenticates and identifies devices by pre-entering the ID information of authorized devices into the whitelist. However, this method has the security vulnerability of forging and counterfeiting the device identity information of wireless ad hoc network communication devices. Once an attacker obtains or successfully forges the ID of a legitimate device, they can easily bypass authentication and illegally access the network.

[0022] like Figure 5 As shown, to address the above problems, this embodiment provides a quantum-secure authentication method for wireless ad hoc networks, including: In master station mode, the security authentication method includes: In a secure environment, the randomly generated quantum protection key is written offline to each wireless ad hoc network communication device; A one-time quantum authentication key is generated based on the key negotiation request from the key negotiation requester; the key negotiation requester is one of the wireless ad hoc network communication devices to be authenticated and the online wireless ad hoc network communication devices. Both parties encrypt the quantum authentication key using their respective quantum protection keys, generating two different ciphertexts. These two ciphertexts are then sent to the key negotiation requester, who forwards one of them to the other. The ciphertexts are used by both parties to decrypt them using their respective quantum protection keys, resulting in two quantum authentication keys. These keys are then used by both parties to complete secure authentication using a symmetric challenge-response authentication method. In device-independent mode, all wireless ad hoc network communication devices are pre-connected to the quantum-safe authentication system, and the authentication method includes: Receive certificate signing requests from each wireless ad hoc network communication device; the certificate signing request includes the device ID of each wireless ad hoc network communication device and a public-private key pair generated by a quantum random number generator; A digital certificate is generated by signing the certificate signing request using a pre-configured root certificate private key. The generated digital certificate is then distributed to each wireless ad hoc network communication device. This allows both the wireless ad hoc network communication device to be authenticated and the online wireless ad hoc network communication device to complete security authentication using a certificate exchange and challenge-response authentication method based on the digital certificate. The digital certificate includes the public key and device ID corresponding to each wireless ad hoc network communication device.

[0023] Therefore, this embodiment proposes two modes for quantum-secure authentication in wireless ad hoc networks: a master station mode and a device-independent mode (without a master station). This provides two mainstream quantum-secure authentication schemes: a centralized scheme with master station authentication and a decentralized scheme without master station authentication. With a master station, the aim is to establish a centralized "quantum-secure service platform" (i.e., the master station) as the root of trust and control center of the entire network authentication system. Identity authentication and session key negotiation for all wireless ad hoc network communication devices must be completed through the coordination and authorization of the master station, thereby achieving centralized control over the entire key lifecycle. Without a master station, the scheme is a decentralized authentication mode based on public key infrastructure. Authentication between devices does not require the participation of a master station that is online in real time; instead, it relies on a trusted "quantum certificate authorization system" running in an offline environment for identity pre-authorization. Devices complete identity authentication by directly exchanging and verifying each other's digital signature certificates.

[0024] The following examples will further illustrate this method: This embodiment provides a quantum-secure authentication method for wireless ad hoc networks. In this embodiment, the wireless ad hoc network communication device is preferably a microwave communication device. The specific steps include: Before the security authentication method runs, specific configurations are performed on each piece of hardware within the entire authentication architecture, including: like Figure 1 As shown, Figure 1This diagram illustrates the operational principle of the quantum-secure authentication method for wireless ad hoc networks in master station mode, and also serves as the network topology diagram in master station mode. Specifically, in master station mode: Quantum-secure service platform (main site): serves as the root of trust and management core. It has built-in high-speed... A quantum random number generator is responsible for generating two key keys: a "quantum protection key" and a "quantum authentication key." The platform centrally manages the identity information of all devices and processes key negotiation requests from the devices.

[0025] Quantum-secure authentication medium: Physically deployed on each microwave communication device, it serves as a secure carrier of device identity and keys. It can be a hardware "quantum-secure chip" or "quantum-secure module," providing physical-level security; or a software "quantum cryptographic module SDK," offering greater deployment flexibility. Its core function is to securely store a unique "quantum protection key," offline-filled by the master station.

[0026] Quantum Authentication SDK: As a software development kit, it is integrated into the business software of microwave communication devices. It encapsulates complex authentication processes, such as key negotiation requests with the master station and the implementation of symmetric challenge authentication processes, providing standardized API interfaces for upper-layer applications and greatly reducing integration difficulty.

[0027] like Figure 3 As shown, Figure 3 This diagram illustrates the operational principle of the quantum-secure authentication method for wireless ad hoc networks in device-independent mode, and also provides a network topology diagram for this mode. Specifically, in device-independent mode: Quantum Certificate Authorization System: Serves as the offline root of trust for the entire system.

[0028] Its core is a built-in quantum random number generator used to generate high-quality, unpredictable root key pairs. The main responsibility of the quantum certificate authorization system is to issue a unique digital signature certificate conforming to standards such as X.509 for each legitimate microwave communication device.

[0029] Microwave communication device built-in module: Each device integrates hardware and software modules to implement authentication functions.

[0030] Security chip / module: A secure hardware environment for generating and storing the device's own asymmetric key pair (public and private keys) and protecting digital signature certificates issued by a quantum certificate authorization system to prevent the private key from being stolen or tampered with.

[0031] Quantum random number chip / module: Provides dual quantum security by generating high-quality key pairs locally for the device and generating unpredictable challenge random numbers during the authentication process.

[0032] Based on the aforementioned hardware and overall system architecture, the specific implementation process of this security authentication method is as follows: Main site mode: First, the offline preparation phase: quantum protection key charging. This occurs before the microwave communication device is deployed to the site. Initialization must be completed in a secure environment. The master station uses its quantum random number generator to generate a unique quantum protection key for each microwave communication device. This quantum protection key is written (filled) offline into the quantum-secure authentication medium built into the microwave communication device via physical contact or a dedicated secure channel. This quantum protection key is the sole credential for establishing trust between the microwave communication device and the master station and is never used for plaintext transmission online.

[0033] Second, the online negotiation phase: quantum authentication key acquisition. The authentication process begins when a microwave communication device (A) seeking authentication attempts to access an already online microwave communication device (B) in the network. The online microwave communication device B (or A) initiates a key negotiation request to the master station, including the device IDs of both parties. After verifying the validity of the IDs, the master station generates a one-time "quantum authentication key" for this session. Subsequently, the master station encrypts this quantum authentication key using the quantum protection keys of both the microwave communication device A seeking authentication and the online microwave communication device B, generating two different ciphertexts. These two ciphertexts are sent to the requester (the online microwave communication device B), and then the online microwave communication device B forwards one of them to the microwave communication device A seeking authentication. This process ensures the secure distribution of the authentication key in an insecure wireless channel.

[0034] Third, the device authentication phase: quantum key symmetric challenge. After receiving their respective ciphertexts, devices A and B use the protection key stored in their local authentication media to decrypt them, thus obtaining identical authentication keys. Next, both parties use this quantum authentication key for symmetric challenge-response authentication. For example, A generates a random number, encrypts it with the quantum authentication key, and sends it to B; if B decrypts it and obtains the correct random number, A's identity is proven legitimate, and vice versa. This "one-time pad" mechanism ensures that a completely new key is used for each authentication, effectively resisting replay attacks.

[0035] Specifically, such as Figure 2 As shown, both parties complete security authentication using a symmetric challenge-response authentication method based on their respective quantum authentication keys, including: The microwave communication device to be authenticated generates a random number A, encrypts the random number A using a quantum authentication key, and generates a signature for the random number A, forming the first quantum key challenge authentication data; The microwave communication device to be authenticated sends the first quantum key challenge authentication data to the online microwave communication device; The online microwave communication device decrypts the random number A and verifies the signature. Based on the result of verifying the authentication data of the first quantum key challenge of the microwave communication device to be authenticated, an authentication mark of the microwave communication device to be authenticated is generated. A random number B is generated by an online microwave communication device. Random number A is encrypted using a quantum authentication key, and a signature of random number A is generated to form the second quantum key challenge authentication data. The online microwave communication device sends the second quantum key challenge authentication data and the authentication mark of the microwave communication device to be authenticated; The microwave communication device to be authenticated decrypts the random number B and verifies the signature. Based on the result of verifying the second quantum key challenge authentication data of the online microwave communication device, an online microwave communication device authentication mark is generated. The microwave communication device to be certified sends an online microwave communication device certification mark to the online microwave communication device; If an online microwave communication device confirms that its authentication mark is valid, the authentication is successful, and the microwave communication device to be authenticated will be connected to the wireless ad hoc network; otherwise, the authentication fails, and the microwave communication device to be authenticated will be refused access to the wireless ad hoc network.

[0036] Device standalone mode: First, the offline preparation phase: digital signature certificate issuance. Before leaving the factory or being deployed, each microwave communication device needs to connect to an offline quantum certificate authorization system. The device uses its built-in quantum random number generator and security chip to generate a public-private key pair, then packages the public key along with the device ID and other identity information into a certificate signing request and submits it to the quantum certificate authorization system. After verifying the legitimacy of the certificate signing request information, the quantum certificate authorization system uses its own root private key to sign the certificate signing request, ultimately generating a digital signature certificate containing the device's public key and identity information, and then distributes it to the device for secure storage.

[0037] Second, the online negotiation phase: certificate exchange and challenge-response. When device A needs to authenticate device B, the authentication process is initiated by the challenger (A). Device A first generates a random number using its local quantum random number generator and sends it to device B. After receiving the random number, device B signs it using the private key stored in its own security chip. Then, device B packages its digital signature certificate along with this signature result and returns it to device A.

[0038] Third, the identity verification stage: digital signature certificate verification and signature result verification. Upon receiving the response, Device A performs dual verification. First, it verifies the legitimacy of Device B's digital signature certificate, including checking if the certificate is valid, if the Quantum Certificate Authorization System (QCA) signature is correct (using the pre-configured QCA root certificate public key), and if the certificate is on the digital signature certificate revocation list. After successful verification, Device A extracts Device B's public key from the certificate. Finally, it uses this public key to verify the signature result returned by Device B. If the signature result verification is successful, it means that Device B does indeed possess the private key paired with the certificate's public key, thus proving its identity.

[0039] Specifically, such as Figure 4 As shown, the microwave communication device to be authenticated and the online microwave communication device complete security authentication using a certificate exchange and challenge-response authentication method based on digital certificates, including: The microwave communication device to be authenticated generates a random number and sends the random number to the online microwave communication device. The online microwave communication device uses its private key to sign the random number, obtains the signature result, and packages the signature result and the digital signature certificate of the online microwave communication device back to the microwave communication device to be authenticated. The microwave communication device to be authenticated verifies the legitimacy of the online microwave communication device using the root certificate public key of the quantum certificate authorization system based on the digital signature certificate of the online microwave communication device. After the digital signature certificate is verified, the microwave communication device to be authenticated extracts the public key of the online microwave communication device from the digital signature certificate and decrypts the signature result according to the public key of the online microwave communication device. If the signature result is successfully verified, the authentication is successful and the microwave communication device to be authenticated is connected to the wireless ad hoc network. Otherwise, the authentication fails and the microwave communication device to be authenticated is refused access to the wireless ad hoc network.

[0040] It should be noted that, Figure 2 and Figure 4 In this context, "original device" refers to an online microwave communication device, that is, an online microwave communication device that has joined a wireless network; "new device" refers to a microwave communication device awaiting certification.

[0041] like Figure 6As shown, this embodiment also provides a quantum-secure authentication system for wireless ad hoc networks, including: in master station mode, the security authentication system includes: a charging module, used to write randomly generated quantum protection keys offline into each wireless ad hoc network communication device in a secure environment; a key generation module, used to generate a one-time quantum authentication key based on a key negotiation request from a key negotiation requester; the key negotiation requester is one of the wireless ad hoc network communication devices to be authenticated and the online wireless ad hoc network communication devices; a ciphertext generation module, used to encrypt the quantum authentication key using the respective quantum protection keys of both parties to generate two different ciphertexts, and send the two generated ciphertexts to the key negotiation requester, one of which is forwarded to the other party by the key negotiation requester; the ciphertexts are used by both parties to decrypt them according to their respective quantum protection keys to obtain two quantum authentication keys, which are then used by both parties to complete security authentication using a symmetric challenge-response authentication method based on their respective quantum authentication keys.

[0042] In device-independent mode, all wireless ad hoc network communication devices are pre-connected to a quantum-secure authentication system. This system includes: a receiving module for receiving certificate signing requests from each wireless ad hoc network communication device; the certificate signing request includes the device ID of each wireless ad hoc network communication device and a public-private key pair generated by a quantum random number generator; and a certificate generation module for signing the certificate signing request using a pre-configured root certificate private key to generate a digital certificate, and distributing the generated digital certificate to each wireless ad hoc network communication device. This allows the wireless ad hoc network communication device to be authenticated and the already online wireless ad hoc network communication devices to complete security authentication using a certificate exchange and challenge-response authentication method based on the digital certificate. The digital certificate includes the public key and device ID corresponding to each wireless ad hoc network communication device.

[0043] The present invention also provides a quantum-safe authentication device for wireless ad hoc networks, comprising: a memory for storing a computer program; and a processor for executing the computer program to implement the steps of the quantum-safe authentication method for wireless ad hoc networks.

[0044] The present invention also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the wireless ad hoc network quantum security authentication method.

[0045] When the processor executes the computer program, it implements the steps of the aforementioned wireless ad hoc network quantum security authentication. For example, in master station mode, the security authentication method includes: in a secure environment, writing a randomly generated quantum protection key offline into each wireless ad hoc network communication device; generating a one-time quantum authentication key based on a key negotiation request from a key negotiation requester; the key negotiation requester is one of the wireless ad hoc network communication devices to be authenticated and the online wireless ad hoc network communication devices; encrypting the quantum authentication key using the respective quantum protection keys of both parties to generate two different ciphertexts, and sending the two generated ciphertexts to the key negotiation requester, one of which is forwarded to the other by the key negotiation requester; the ciphertexts are used by both parties to decrypt them according to their respective quantum protection keys to obtain two quantum authentication keys, which are then used by both parties to complete security authentication using a symmetric challenge-response authentication method based on their respective quantum authentication keys; In device-independent mode, all wireless ad hoc network communication devices are pre-connected to the quantum-secure authentication system. The security authentication method includes: receiving certificate signing requests from each wireless ad hoc network communication device; the certificate signing request includes the device ID of each wireless ad hoc network communication device and a public-private key pair generated by a quantum random number generator; signing the certificate signing request using a pre-configured root certificate private key to generate a digital certificate; distributing the generated digital certificate to each wireless ad hoc network communication device; so that the wireless ad hoc network communication device to be authenticated and the online wireless ad hoc network communication device can complete the security authentication using a certificate exchange and challenge-response authentication method based on the digital certificate; the digital certificate includes the public key and device ID corresponding to each wireless ad hoc network communication device.

[0046] For example, the computer program can be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules / units can be a series of computer program instruction segments capable of performing preset functions, wherein the instruction segments describe the execution process of the computer program in the wireless ad hoc network quantum security authentication device. For example, the computer program can be divided into a refill module, a key generation module, and a ciphertext generation module in master station mode; and a receiving module and a certificate generation module in device-independent mode. The specific functions of each module are as follows: In master station mode, the security authentication system includes: a refill module, used to write randomly generated quantum protection keys offline into each wireless ad hoc network communication device in a secure environment; a key generation module, used to generate a one-time quantum authentication key based on a key negotiation request from a key negotiation requester; the key negotiation requester is one of the wireless ad hoc network communication devices to be authenticated and the online wireless ad hoc network communication devices; a ciphertext generation module, used to encrypt the quantum authentication key using the respective quantum protection keys of both parties to generate two different ciphertexts, and send the two generated ciphertexts to the key negotiation requester, one of which is forwarded to the other party by the key negotiation requester; the ciphertexts are used by both parties to decrypt them according to their respective quantum protection keys to obtain two quantum authentication keys, which are then used by both parties to complete security authentication using a symmetric challenge-response authentication method based on their respective quantum authentication keys.

[0047] In device-independent mode, all wireless ad hoc network communication devices are pre-connected to a quantum-secure authentication system. This system includes: a receiving module for receiving certificate signing requests from each wireless ad hoc network communication device; the certificate signing request includes the device ID of each wireless ad hoc network communication device and a public-private key pair generated by a quantum random number generator; and a certificate generation module for signing the certificate signing request using a pre-configured root certificate private key to generate a digital certificate, and distributing the generated digital certificate to each wireless ad hoc network communication device. This allows the wireless ad hoc network communication device to be authenticated and the already online wireless ad hoc network communication devices to complete security authentication using a certificate exchange and challenge-response authentication method based on the digital certificate. The digital certificate includes the public key and device ID corresponding to each wireless ad hoc network communication device.

[0048] The wireless ad hoc network quantum security authentication device can be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. The wireless ad hoc network quantum security authentication device may include, but is not limited to, processors and memory. Those skilled in the art will understand that the above are examples of wireless ad hoc network quantum security authentication devices and do not constitute a limitation on such devices. The device may include more components than described above, or combine certain components, or use different components. For example, the wireless ad hoc network quantum security authentication device may also include input / output devices, network access devices, buses, etc.

[0049] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, or any conventional processor. This processor is the control center for the wireless ad hoc network quantum security authentication, connecting various parts of the entire wireless ad hoc network quantum security authentication device via various interfaces and lines.

[0050] The memory can be used to store the computer program and / or modules. The processor implements various functions of the wireless self-organizing network quantum security authentication device by running or executing the computer program and / or modules stored in the memory, and by calling the data stored in the memory.

[0051] The memory may primarily include a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for a function (such as sound playback, image playback, etc.). The data storage area may store data created based on the use of the mobile phone (such as audio data, phonebook, etc.). Furthermore, the memory may include high-speed random access memory and non-volatile memory, such as hard disks, RAM, plug-in hard disks, smart media cards (SMC), secure digital cards (SD cards), flash cards, at least one disk storage device, flash memory device, or other volatile solid-state storage devices.

[0052] The present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the aforementioned quantum-safe authentication method for wireless ad hoc networks.

[0053] If the modules / units integrated in the wireless self-organizing network quantum security authentication system are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.

[0054] Based on this understanding, the present invention can implement all or part of the processes in the above-mentioned wireless ad hoc network quantum security authentication method, or it can be accomplished by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the above-mentioned wireless ad hoc network quantum security authentication method. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or a preset intermediate form, etc.

[0055] The computer-readable storage medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc.

[0056] It should be noted that the content contained in the computer-readable storage medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable storage medium does not include electrical carrier signals and telecommunication signals.

[0057] In summary, this invention provides a quantum-secure authentication method and related device for wireless ad hoc networks, which has the following advantages compared to existing authentication methods: Main site mode: First, centralized management and high security: The main station manages the entire lifecycle of keys, including generation, distribution, updating, and destruction, with unified policies and high security. The "one-time password" dynamic authentication key mechanism greatly enhances its resistance to attacks.

[0058] Second, strong traceability: all authentication actions are recorded on the main site, which facilitates auditing and subsequent traceability.

[0059] Device stand-alone mode: First, high availability and robustness: The authentication process does not rely on any central node and can be completed independently between devices. Even if part of the network is interrupted or partitioned, the authentication between deployed devices will not be affected, and the system is extremely robust.

[0060] Secondly, deployment is relatively simple: after the initial certificate issuance is completed, there is no need to maintain a central platform that is always online in the network, which reduces the complexity of later operation and maintenance.

[0061] The above embodiments are merely one of the implementation methods for achieving the technical solution of the present invention. The scope of protection claimed by the present invention is not limited to this embodiment, but also includes any variations, substitutions and other implementation methods that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention.

[0062] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the present invention.

Claims

1. A wireless ad hoc network quantum secure authentication method applied to a quantum secure authentication system, characterized in that, The security authentication method is configured as a master station mode or a device independent mode; In the master station mode, the security authentication method comprises: In a secure environment, a quantum protection key randomly generated is written offline to each wireless ad hoc network communication device; Based on a key negotiation request from a key negotiation requester, a one-time quantum authentication key is generated; the key negotiation requester is one of the to-be-authenticated wireless ad hoc network communication device and the online wireless ad hoc network communication device; The quantum authentication key is encrypted by the quantum protection key of each party respectively to generate two different ciphertexts, and the two generated ciphertexts are sent to the key negotiation requester, one of which is forwarded to the other party by the key negotiation requester; the ciphertexts are used for decryption by each party according to the quantum protection key of each party to obtain two quantum authentication keys, so that the security authentication is completed by each party according to the quantum authentication key of each party by using the symmetric challenge-response authentication mode; In the device independent mode, all wireless ad hoc network communication devices are pre-connected to a quantum security authentication system, and the security authentication method comprises: Receiving a certificate signature request of each wireless ad hoc network communication device; the certificate signature request comprises a device ID of each wireless ad hoc network communication device and a pair of public and private keys generated by a quantum random number generator; A pre-configured root certificate private key is used to sign the certificate signature request to generate a digital certificate, and the generated digital certificate is distributed to each wireless ad hoc network communication device; so that the to-be-authenticated wireless ad hoc network communication device and the online wireless ad hoc network communication device complete the security authentication by using the certificate exchange and challenge-response authentication mode according to the digital certificate; the digital certificate comprises the public key and the device ID corresponding to each wireless ad hoc network communication device. 2.The wireless ad hoc network quantum secure authentication method of claim 1, wherein, In the master station mode, the quantum security authentication system uses a quantum security service platform; the quantum security service platform serves as a master station; a quantum random number generator of the quantum security service platform generates a unique quantum protection key for each wireless ad hoc network communication device; The quantum protection key is stored by a quantum security authentication medium of the wireless ad hoc network communication device; the quantum security authentication medium uses a quantum security chip, a quantum security module or a software development kit of a quantum software cipher module. 3.The wireless ad hoc network quantum secure authentication method of claim 1, wherein, In the master station mode, the security authentication is completed by each party according to the quantum authentication key by using the symmetric challenge-response authentication mode, which comprises: The to-be-authenticated wireless ad hoc network communication device generates a random number A, encrypts the random number A by using the quantum authentication key and generates a signature of the random number A to form first quantum key challenge authentication data; The to-be-authenticated wireless ad hoc network communication device sends the first quantum key challenge authentication data to the online wireless ad hoc network communication device; The online wireless ad hoc network communication device decrypts the random number A and verifies the signature, and generates an authentication mark of the to-be-authenticated wireless ad hoc network communication device according to the result of verifying the first quantum key challenge authentication data of the to-be-authenticated wireless ad hoc network communication device; The online wireless ad hoc network communication device generates a random number B, encrypts the random number A by using the quantum authentication key and generates a signature of the random number A to form second quantum key challenge authentication data; The online wireless ad hoc network communication device sends second quantum key challenge authentication data to the wireless ad hoc network communication device to be authenticated and an online wireless ad hoc network communication device authentication mark; The wireless ad hoc network communication device to be authenticated decrypts the random number B and verifies the signature, generates an online wireless ad hoc network communication device authentication mark according to the result of verifying the second quantum key challenge authentication data of the online wireless ad hoc network communication device, and sends the online wireless ad hoc network communication device authentication mark to the online wireless ad hoc network communication device; The wireless ad hoc network communication device to be authenticated sends the online wireless ad hoc network communication device authentication mark to the online wireless ad hoc network communication device; If the online wireless ad hoc network communication device confirms that the online wireless ad hoc network communication device authentication mark is valid, the authentication is successful, and the wireless ad hoc network communication device to be authenticated is connected to the wireless ad hoc network; otherwise, the authentication fails, and the wireless ad hoc network communication device to be authenticated is refused to access the wireless ad hoc network.

4. The method of claim 1, wherein, In the device-independent mode, the quantum security authentication system adopts a quantum certificate authority system; a pair of public and private keys is generated by using a quantum random number generator and a quantum security authentication medium built in the wireless ad hoc network communication device; and the quantum security authentication medium adopts a quantum security chip or a quantum security module.

5. The quantum secure authentication method for wireless ad hoc networks according to claim 4, characterized in that, The quantum certificate authority system is used to issue a unique digital signature certificate conforming to the X.509 standard for each legal wireless ad hoc network communication device.

6. The method of claim 1, wherein, In the device-independent mode, the wireless ad hoc network communication device to be authenticated and the online wireless ad hoc network communication device complete the security authentication by adopting a certificate exchange and challenge-response authentication mode according to the digital certificate, including: The wireless ad hoc network communication device to be authenticated randomly generates a random number and sends the random number to the online wireless ad hoc network communication device; The online wireless ad hoc network communication device signs the random number by using its own private key, obtains a signature result, and returns the signature result and the digital signature certificate of the online wireless ad hoc network communication device to the wireless ad hoc network communication device to be authenticated; The wireless ad hoc network communication device to be authenticated verifies the legitimacy of the online wireless ad hoc network communication device by using a quantum certificate authority system root certificate public key according to the digital signature certificate of the online wireless ad hoc network communication device; After the digital signature certificate verification passes, the wireless ad hoc network communication device to be authenticated extracts the public key of the online wireless ad hoc network communication device from the digital signature certificate and decrypts the signature result according to the public key of the online wireless ad hoc network communication device; if the signature result verification is successful, the authentication is successful, and the wireless ad hoc network communication device to be authenticated is connected to the wireless ad hoc network; otherwise, the authentication fails, and the wireless ad hoc network communication device to be authenticated is refused to access the wireless ad hoc network.

7. The wireless ad hoc network quantum secure authentication method of claim 6, wherein, In the verification of the legitimacy of the online wireless ad hoc network communication device by using the quantum certificate authority system root certificate public key, the legitimacy of the online wireless ad hoc network communication device includes checking whether the digital signature certificate is within a valid period, whether the quantum certificate authority system signature is correct, and whether the digital signature certificate is in a digital signature certificate revocation list.

8. A wireless ad hoc network quantum secure authentication system, characterized by, The security authentication system is configured in a master station mode or a device-independent mode; In the master station mode, the security authentication system includes: A filling module is configured to write the randomly generated quantum protection key offline into each wireless ad hoc network communication device in a secure environment; A key generation module is configured to generate a one-off quantum authentication key based on a key negotiation request from a key negotiation requester, which is one of the wireless ad hoc network communication device to be authenticated and the online wireless ad hoc network communication device; A ciphertext generation module is configured to encrypt the quantum authentication key with the respective quantum protection key of each party to generate two different ciphertexts, and send the two generated ciphertexts to the key negotiation requester, one of which is forwarded to the other party by the key negotiation requester; the ciphertexts are used for decryption by each party with the respective quantum protection key to obtain two quantum authentication keys, which are used by each party to complete the secure authentication in a symmetric challenge-response authentication mode with the respective quantum authentication key; In the device-independent mode, all the wireless ad hoc network communication devices are pre-connected to the quantum secure authentication system, which comprises: A receiving module is configured to receive a certificate signature request of each wireless ad hoc network communication device; the certificate signature request comprises the device ID of each wireless ad hoc network communication device and a pair of public and private keys generated by a quantum random number generator; A certificate generation module is configured to sign the certificate signature request with a pre-configured root certificate private key to generate a digital certificate, and distribute the generated digital certificate to each wireless ad hoc network communication device; the digital certificate is used by the wireless ad hoc network communication device to be authenticated and the online wireless ad hoc network communication device to complete the secure authentication in a certificate exchange and challenge-response authentication mode; the digital certificate comprises the public key and the device ID corresponding to each wireless ad hoc network communication device.

9. A wireless ad hoc network quantum secure authentication device, characterized by, It comprises: A memory is configured to store a computer program; A processor is configured to execute the computer program to implement the steps of the wireless ad hoc network quantum secure authentication method according to any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 9. The computer program is executed by the processor to implement the steps of the wireless ad hoc network quantum secure authentication method according to any one of claims 1-7.

Images