Quantum secure infrastructure system and user terminal access method based on the system

Abstract

The application discloses a quantum security infrastructure system and a user terminal access method based on the system, belongs to the field of quantum security communication and cryptography, and comprises the following steps: a cryptographic management service platform (CMSP) responds to an access request of a user terminal, determines an identity and access management system (IAM) and a key management system (KMS) that need to be accessed by the user terminal; if the IAM and the KMS belong to the same region, the CMSP sends IAM information of the IAM to the user terminal; the user terminal accesses the IAM based on the IAM information; if the IAM and the KMS do not belong to the same region, the IAM performs a key relay process through the CMSP, generates a service authentication token and access token ciphertext, and sends the service authentication token and the access token ciphertext to the user terminal; and the user terminal accesses the IAM based on the service authentication token and the access token ciphertext. The application improves the resistance to quantum attacks and the security of the system.

Description

Technical Field

[0001] This application belongs to the field of quantum secure communication and cryptography, and specifically relates to a quantum secure infrastructure system, a user terminal access method based on a quantum secure infrastructure system, a user terminal access device, an electronic device, and a readable storage medium. Background Technology

[0002] With the rapid development of IP-based 4G and 5G mobile communication technologies, modern telecom operators are facing unprecedented information security challenges. Traditional cryptographic methods, such as public key infrastructure (PKI)-based encryption systems, while providing reliable security for data transmission over the past few decades, are now threatened by the rapid advancements in quantum computing technology. The powerful computing capabilities of quantum computers may allow them to break existing asymmetric encryption algorithms, such as RSA and ECC, in the future, putting traditional PKI systems that rely on these algorithms at risk of becoming ineffective.

[0003] Quantum Key Distribution (QKD), a novel key exchange technology based on quantum mechanics, offers a crucial solution to this problem due to its core advantage of "unconditional security." QKD leverages the non-cloning nature of quantum states and the measurement perturbation properties to ensure the security of the key distribution process, making it difficult to crack even against attacks from quantum computers. This technology not only provides long-term security guarantees in theory but also lays a solid foundation for building next-generation cryptographic infrastructure. However, relying solely on QKD cannot fully meet the diverse needs of complex network environments; therefore, exploring a new generation of cryptographic infrastructure capable of resisting quantum attacks has become an urgent priority. Summary of the Invention

[0004] In view of the above problems, embodiments of this application are proposed to provide a quantum-safe infrastructure system, a user terminal access method based on a quantum-safe infrastructure system, a user terminal access device, an electronic device, and a readable storage medium that overcome or at least partially solve the above problems.

[0005] To solve the above-mentioned technical problems, this application is implemented as follows:

[0006] In a first aspect, embodiments of this application provide a quantum-safe infrastructure system, including:

[0007] The Password Management Service Platform (CMSP) is used to respond to access requests from user terminals and determine the Identity and Access Management System (IAM) and the Key Management System (KMS) that the user terminal needs to access.

[0008] If the IAM and the KMS belong to the same region, the CMSP is also used to send the IAM information of the IAM to the user terminal;

[0009] The user terminal is used to access the IAM based on the IAM information;

[0010] If the IAM and the KMS do not belong to the same region, the IAM is also used to perform a key relay process through the CMSP, generate a service authentication token and an access token ciphertext, and send the service authentication token and the access token ciphertext to the user terminal.

[0011] The user terminal is also used to access the IAM based on the service authentication token and the access token ciphertext.

[0012] In one or more embodiments, the CMSP is further used for:

[0013] The CMSP determines the network path between the user terminal and the CMSP based on the IP address of the user terminal;

[0014] Based on the address and the network path, determine the IAM and KMS that the user terminal needs to access.

[0015] In one or more embodiments, the user terminal is further configured to generate a login request based on the IAM information and send the login request to the IAM;

[0016] The IAM is also used to respond to the login request, generate a login session and a login session identifier, and use the login session and the login session identifier to access the user terminal.

[0017] In one or more embodiments, the IAM information includes an IAM encryption public key; the user terminal is further configured to:

[0018] The user terminal uses the IAM encryption public key to encrypt the user terminal identifier, thereby obtaining the ciphertext of the user terminal identifier;

[0019] A login request is generated using the encrypted user terminal identifier.

[0020] In one or more embodiments, the IAM is further used for:

[0021] The IAM obtains the encrypted user terminal identifier from the login request;

[0022] The ciphertext of the user terminal identifier is decrypted using the IAM encryption private key to obtain the user terminal identifier;

[0023] The legitimacy of the user terminal is verified by the CMSP using the user terminal identifier;

[0024] If the verification is successful, a login session and a login session identifier will be generated.

[0025] In one or more embodiments, the IAM is further configured to generate a key relay request and send the key relay request to the CMSP;

[0026] The CMSP is also used to respond to the key relay request and schedule the user terminal key from the source KMS to the destination KMS through the QKD link; the source KMS and the IAM belong to the same area, and the destination KMS is the KMS that the user terminal needs to access;

[0027] The target KMS is also used to store the user terminal key to the corresponding key pool;

[0028] The IAM is also used to send the user terminal identifier to the destination KMS;

[0029] The destination KMS is further configured to generate an authentication vector using the key identifier of the user terminal key, sign the authentication vector using the signature private key of the destination KMS, and encrypt the authentication vector using the encryption public key of the IAM to obtain the authentication vector ciphertext, and send the authentication vector ciphertext to the IAM.

[0030] The IAM is also used to generate a temporary identity key based on the authentication vector ciphertext, and to generate a service authentication token based on the temporary identity key;

[0031] The IAM is further configured to generate an access token using the login validity period and access permissions corresponding to the user terminal, and encrypt the access token based on the authentication vector ciphertext to obtain the access token ciphertext.

[0032] In one or more embodiments, the IAM is further used for:

[0033] The IAM uses its private encryption key to decrypt the ciphertext of the authentication vector to obtain the authentication vector.

[0034] The authentication vector is verified using the signature public key of the target KMS;

[0035] If the verification is successful, the authentication vector is used to perform a hash operation to generate a temporary identity key;

[0036] The authentication vector is hashed using the temporary identity key to generate a service authentication token.

[0037] In one or more embodiments, the user terminal is further configured to generate a user authentication token ciphertext based on the service authentication token and the access token ciphertext, and send the user authentication token ciphertext to the IAM;

[0038] The IAM is also used to authenticate the user terminal based on the encrypted user authentication token. If the authentication is successful, a login session is generated, and the access token corresponding to the encrypted access token is activated. The login session and the access token are used to access the user terminal.

[0039] In one or more embodiments, the user terminal is further configured to:

[0040] The user terminal uses the service authentication token to obtain a key identifier, and uses the key identifier to obtain a user terminal key;

[0041] The user terminal key is used to authenticate the identity of the KMS;

[0042] If the identity verification is successful, the encrypted access token is decrypted to obtain the access token.

[0043] The access token is verified using an authentication vector;

[0044] If the verification is successful, a temporary identity key is generated using the authentication vector, and a service authentication token is generated using the temporary identity key.

[0045] Verify the service authentication token;

[0046] If the verification is successful, a user authentication token is generated using the temporary identity key;

[0047] The authentication vector is used to encrypt the user authentication token to obtain the ciphertext of the user authentication token.

[0048] In one or more embodiments, the IAM is further used to generate a signature key pair and an encryption key pair for the IAM;

[0049] The KMS is also used to generate the KMS signature key and encryption key pair;

[0050] The IAM is also used to register with the CMSP, register the IAM's signature public key and encryption public key, and obtain the CMSP's signature public key and the signature public keys and encryption public keys of other IAMs;

[0051] The KMS is also used to register with the CMSP, register the signature public key and encryption public key of the KMS, and obtain the signature public key of the CMSP and the signature public keys and encryption public keys of other KMSs.

[0052] The user terminal is also used to perform key filling from the KMS;

[0053] The KMS is also used to register the user terminal identifier of the user terminal with the CMSP;

[0054] The CMSP is also used to establish a mapping relationship between the user terminal identifier and the KMS.

[0055] In one or more embodiments, the user terminal is further configured to generate a key injection request and send the key injection request to the KMS;

[0056] The KMS is also used to respond to the key injection request, generate an injection key, store the injection key, and send the injection key to the user terminal.

[0057] Secondly, embodiments of this application provide a user terminal access method based on a quantum-safe infrastructure system, including:

[0058] The Password Management Service Platform (CMSP) responds to the user terminal's access request and determines the Identity and Access Management System (IAM) and the Key Management System (KMS) that the user terminal needs to access.

[0059] If the IAM and the KMS belong to the same region, the CMSP will send the IAM information of the IAM to the user terminal;

[0060] The user terminal accesses the IAM based on the IAM information;

[0061] If the IAM and the KMS do not belong to the same region, the IAM performs a key relay process through the CMSP to generate a service authentication token and an access token ciphertext, and sends the service authentication token and the access token ciphertext to the user terminal.

[0062] The user terminal accesses the IAM based on the service authentication token and the encrypted access token.

[0063] In one or more embodiments, the CMSP determines the Identity and Access Management System (IAM) and the Key Management System (KMS) that the user terminal needs to access, including:

[0064] The CMSP determines the network path between the user terminal and the CMSP based on the IP address of the user terminal;

[0065] Based on the address and the network path, determine the IAM and KMS that the user terminal needs to access.

[0066] In one or more embodiments, the user terminal accesses the IAM based on the IAM information, including:

[0067] The user terminal generates a login request based on the IAM information and sends the login request to the IAM.

[0068] The IAM responds to the login request, generates a login session and a login session identifier, and uses the login session and the login session identifier to access the user terminal.

[0069] In one or more embodiments, the IAM information includes an IAM encryption public key; the user terminal generates a login request based on the IAM information, including:

[0070] The user terminal uses the IAM encryption public key to encrypt the user terminal identifier, thereby obtaining the ciphertext of the user terminal identifier;

[0071] A login request is generated using the encrypted user terminal identifier.

[0072] In one or more embodiments, the IAM responds to the login request by generating a login session and a login session identifier, including:

[0073] The IAM obtains the encrypted user terminal identifier from the login request;

[0074] The ciphertext of the user terminal identifier is decrypted using the IAM encryption private key to obtain the user terminal identifier;

[0075] The legitimacy of the user terminal is verified by the CMSP using the user terminal identifier;

[0076] If the verification is successful, a login session and a login session identifier will be generated.

[0077] In one or more embodiments, the IAM performs a key relay process through the CMSP to generate service authentication tokens and access token ciphertexts, including:

[0078] The IAM generates a key relay request and sends the key relay request to the CMSP;

[0079] The CMSP responds to the key relay request by scheduling the user terminal key from the source KMS to the destination KMS via the QKD link; the source KMS and the IAM belong to the same area, and the destination KMS is the KMS that the user terminal needs to access;

[0080] The destination KMS stores the user terminal key in the corresponding key pool;

[0081] The IAM sends the user terminal identifier to the destination KMS;

[0082] The destination KMS generates an authentication vector using the key identifier of the user terminal key, signs the authentication vector using the signature private key of the destination KMS, and encrypts the authentication vector using the encryption public key of the IAM to obtain the authentication vector ciphertext, and sends the authentication vector ciphertext to the IAM.

[0083] The IAM generates a temporary identity key based on the authentication vector ciphertext, and generates a service authentication token based on the temporary identity key;

[0084] The IAM generates an access token using the login validity period and access permissions corresponding to the user terminal, and encrypts the access token based on the authentication vector ciphertext to obtain the access token ciphertext.

[0085] In one or more embodiments, the IAM generates a temporary identity key based on the authentication vector ciphertext, and generates a service authentication token based on the temporary identity key, including:

[0086] The IAM uses its private encryption key to decrypt the ciphertext of the authentication vector to obtain the authentication vector.

[0087] The authentication vector is verified using the signature public key of the target KMS;

[0088] If the verification is successful, the authentication vector is used to perform a hash operation to generate a temporary identity key;

[0089] The authentication vector is hashed using the temporary identity key to generate a service authentication token.

[0090] In one or more embodiments, the user terminal accesses the IAM based on the service authentication token and the encrypted access token, including:

[0091] The user terminal generates a user authentication token ciphertext based on the service authentication token and the access token ciphertext, and sends the user authentication token ciphertext to the IAM;

[0092] The IAM verifies the user terminal based on the encrypted user authentication token. If the verification is successful, a login session is generated, and the access token corresponding to the encrypted access token is activated. The user terminal is then accessed using the login session and the access token.

[0093] In one or more embodiments, the user terminal generates a user authentication token ciphertext based on the service authentication token and the access token ciphertext, including:

[0094] The user terminal uses the service authentication token to obtain a key identifier, and uses the key identifier to obtain a user terminal key;

[0095] The user terminal key is used to authenticate the identity of the KMS;

[0096] If the identity verification is successful, the encrypted access token is decrypted to obtain the access token.

[0097] The access token is verified using an authentication vector;

[0098] If the verification is successful, a temporary identity key is generated using the authentication vector, and a service authentication token is generated using the temporary identity key.

[0099] Verify the service authentication token;

[0100] If the verification is successful, a user authentication token is generated using the temporary identity key;

[0101] The authentication vector is used to encrypt the user authentication token to obtain the ciphertext of the user authentication token.

[0102] In one or more embodiments, before the password management service platform (CMSP) responds to the user terminal's access request, it further includes:

[0103] The IAM generates a signature key pair and an encryption key pair for the IAM, and the KMS generates a signature key and an encryption key pair for the KMS;

[0104] The IAM registers with the CMSP, registering its signature public key and encryption public key, and obtaining the CMSP's signature public key and the signature public keys and encryption public keys of other IAMs. Similarly, the KMS registers with the CMSP, registering its signature public key and encryption public key, and obtaining the CMSP's signature public key and the signature public keys and encryption public keys of other KMSs.

[0105] The user terminal receives key injection from the KMS;

[0106] The KMS registers the user terminal identifier of the user terminal with the CMSP;

[0107] The CMSP establishes a mapping relationship between the user terminal identifier and the KMS.

[0108] In one or more embodiments, the user terminal performs key injection from the KMS, including:

[0109] The user terminal generates a key injection request and sends the key injection request to the KMS;

[0110] The KMS responds to the key injection request by generating an injection key, storing the injection key, and sending the injection key to the user terminal.

[0111] Thirdly, embodiments of this application provide a user terminal access method based on a quantum-safe infrastructure system, including:

[0112] Obtain the user terminal's access request;

[0113] Determine the Identity and Access Management System (IAM) that the user terminal needs to access, and the Key Management System (KMS) that it needs to access;

[0114] If the IAM and the KMS belong to the same area, then the IAM information of the IAM is sent to the user terminal so that the user terminal can access the IAM based on the IAM information;

[0115] If the IAM and the KMS do not belong to the same region, then in response to the IAM's key relay request, the user terminal key is scheduled from the source KMS to the destination KMS, so that the IAM can perform a key relay process using the user terminal key, generate a service authentication token and an access token ciphertext, and send the service authentication token and the access token ciphertext to the user terminal, so that the user terminal can access the IAM based on the service authentication token and the access token ciphertext.

[0116] Fourthly, embodiments of this application provide a user terminal access method based on a quantum-safe infrastructure system, including:

[0117] The key relay process is executed through CMSP to generate service authentication tokens and access token ciphertexts;

[0118] The service authentication token and the access token are sent to the user terminal, so that the user terminal generates a user authentication token ciphertext based on the service authentication token and the access token ciphertext, and sends the user authentication token ciphertext to the IAM;

[0119] The user terminal is authenticated based on the encrypted user authentication token.

[0120] If the verification is successful, the login session is generated, and the access token corresponding to the encrypted access token is activated. The user terminal is then accessed using the login session and the access token.

[0121] In one or more embodiments, the step of performing a key relay process via CMSP to generate service authentication tokens and access token ciphertexts includes:

[0122] A key relay request is generated and sent to the CMSP, so that the CMSP responds to the key relay request and schedules the user terminal key from the source KMS to the destination KMS through the QKD link; the source KMS and the IAM belong to the same area, and the destination KMS is the KMS that the user terminal needs to access, so that the destination KMS stores the user terminal key in the corresponding key pool.

[0123] The user terminal identifier is sent to the destination KMS, so that the destination KMS generates an authentication vector using the key identifier of the user terminal key, signs the authentication vector using the signature private key of the destination KMS, and encrypts the authentication vector using the encryption public key of the IAM to obtain the authentication vector ciphertext, and sends the authentication vector ciphertext to the IAM.

[0124] A temporary identity key is generated based on the authentication vector ciphertext, and a service authentication token is generated based on the temporary identity key;

[0125] The IAM generates an access token using the login validity period and access permissions corresponding to the user terminal, and encrypts the access token based on the authentication vector ciphertext to obtain the access token ciphertext.

[0126] Fifthly, embodiments of this application provide a user terminal access device, including:

[0127] The acquisition module is used to acquire access requests from user terminals;

[0128] The determination module is used to determine the Identity and Access Management System (IAM) that the user terminal needs to access, and the Key Management System (KMS) that it needs to access.

[0129] The first sending module is configured to send the IAM information of the IAM to the user terminal if the IAM and the KMS belong to the same area, so that the user terminal can access the IAM based on the IAM information;

[0130] The scheduling module is configured to, if the IAM and the KMS do not belong to the same region, respond to the key relay request of the IAM, schedule the user terminal key from the source KMS to the destination KMS, so that the IAM can perform the key relay process through the user terminal key, generate service authentication token and access token ciphertext, and send the service authentication token and access token ciphertext to the user terminal, so that the user terminal can access the IAM based on the service authentication token and access token ciphertext.

[0131] Sixthly, embodiments of this application provide a user terminal access device, including:

[0132] The generation module is used to execute the key relay process through CMSP to generate service authentication tokens and access token ciphertexts;

[0133] The second sending module is used to send the service authentication token and the access token to the user terminal, so that the user terminal generates a user authentication token ciphertext based on the service authentication token and the access token ciphertext, and sends the user authentication token ciphertext to the IAM;

[0134] The verification module is used to authenticate the user terminal based on the encrypted user authentication token.

[0135] The access module is used to generate the login session if the verification is successful, activate the access token corresponding to the encrypted access token, and access the user terminal using the login session and the access token.

[0136] In one or more embodiments, the generation module is specifically used for:

[0137] A key relay request is generated and sent to the CMSP, so that the CMSP responds to the key relay request and schedules the user terminal key from the source KMS to the destination KMS through the QKD link; the source KMS and the IAM belong to the same area, and the destination KMS is the KMS that the user terminal needs to access, so that the destination KMS stores the user terminal key in the corresponding key pool.

[0138] The user terminal identifier is sent to the destination KMS, so that the destination KMS generates an authentication vector using the key identifier of the user terminal key, signs the authentication vector using the signature private key of the destination KMS, and encrypts the authentication vector using the encryption public key of the IAM to obtain the authentication vector ciphertext, and sends the authentication vector ciphertext to the IAM.

[0139] A temporary identity key is generated based on the authentication vector ciphertext, and a service authentication token is generated based on the temporary identity key;

[0140] The IAM generates an access token using the login validity period and access permissions corresponding to the user terminal, and encrypts the access token based on the authentication vector ciphertext to obtain the access token ciphertext.

[0141] In a seventh aspect, embodiments of this application provide an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method described in the third or fourth aspect.

[0142] Eighthly, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the third or fourth aspect.

[0143] The embodiments of this application have the following advantages:

[0144] In this embodiment, when a user terminal logs in for the first time, the user terminal identifier is encrypted and transmitted to avoid exposing the user's identity. When the user terminal roams (accessing a non-home resource pool), the root keys of different areas are securely protected through QKD key relay. The generation functions and responsibilities of different types of keys are separated and derived layer by layer. The key pool (KP) is responsible for the generation and storage of root keys, the key management system (KMS) is responsible for the generation of secondary root keys (CK / IK), and the identity and access management system is responsible for the generation of identity keys. Moreover, commercial cryptographic technology (SM series algorithms) is used to generate and use multiple types of tokens to achieve full-process identity authentication and function authorization. This combines QKD with symmetric cryptography (block ciphers, hash ciphers), asymmetric cryptography (SM2 signature algorithm), and post-quantum cryptography (PQC), and deeply integrates it with the network of telecommunications operators to form a brand-new quantum security infrastructure system, improving the resistance to quantum attacks and the security of the system. Attached Figure Description

[0145] Figure 1 This application describes a quantum-safe infrastructure system;

[0146] Figure 2 This is a flowchart illustrating the steps of a user terminal access method based on a quantum-safe infrastructure system according to this application.

[0147] Figure 3 This is a flowchart illustrating the steps of a second embodiment of a user terminal access method based on a quantum-safe infrastructure system according to this application.

[0148] Figure 4 This is a flowchart illustrating the steps of a third embodiment of a user terminal access method based on a quantum-safe infrastructure system according to this application;

[0149] Figure 5 This is a flowchart illustrating the steps of a fourth embodiment of a user terminal access method based on a quantum-safe infrastructure system according to this application.

[0150] Figure 6 This is a structural block diagram of a user terminal access device according to one embodiment of this application;

[0151] Figure 7 This is a structural block diagram of a second embodiment of a user terminal access device according to this application. Detailed Implementation

[0152] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0153] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0154] The embodiments of this application will be described in detail below with reference to the accompanying drawings and specific examples and application scenarios.

[0155] One of the core concepts of this application's embodiments is that when a user terminal logs in for the first time, the user terminal identifier can be encrypted and transmitted to avoid exposing the user's identity. When the user terminal roams (accessing a non-home resource pool), the root keys of different areas are securely protected through QKD key relay. The generation functions and responsibilities of different types of keys are separated and derived layer by layer. The key pool (KP) is responsible for the generation and storage of the root keys, the key management system (KMS) is responsible for the generation of secondary root keys (CK / IK), and the identity and access management system is responsible for the generation of identity keys. Moreover, commercial cryptographic technology (SM series algorithms) is used to generate and use multiple types of tokens to achieve end-to-end identity authentication and function authorization. This combines QKD with symmetric cryptography (block ciphers, hash ciphers), asymmetric cryptography (SM2 signature algorithm), and post-quantum cryptography (PQC), and deeply integrates it with the telecommunications operator's network to form a completely new quantum security infrastructure system, improving the resistance to quantum attacks and the system's security.

[0156] Reference Figure 1 This application illustrates a quantum-safe infrastructure system that may include three layers:

[0157] The quantum communication layer enables quantum key distribution and mainly consists of a quantum key manager (QKM), a quantum key distributor (QKD), and a quantum key distribution network controller (QKDNC). It executes the QKD protocol through QKD links and combines key relays to generate QKD keys.

[0158] The cryptographic service layer obtains session keys from the quantum communication layer and provides them to the business terminals through QKD distribution. It includes a key management system (KMS), a key pool (KP), a cryptography management service platform (CMSP), and an identity and access management system (IAM).

[0159] The user terminal is equipped with a secure SIM card, smart password key, or software password module as a security medium.

[0160] The CMSP system is centrally deployed, while other parts are deployed in different regions. Each region independently deploys a resource pool consisting of QKM, KMS, IAM, and KP. Key distribution channels are established between the resource pools in each region through the QKD link.

[0161] The signature key pair can include two keys (public-private key pair, including a signature public key and a signature private key) for the SM2 signature algorithm and the PQC signature algorithm. Digital signatures can be double-signed using the SM2 signature algorithm and the PQC signature algorithm.

[0162] The encryption key pair can include two keys (public-private key pair, including encryption public key and encryption private key) of SM2 encryption algorithm and PQC encryption algorithm. The key encapsulation can be double-encapsulated using SM2 encryption algorithm and PQC encryption algorithm.

[0163] The user terminal and each node in the resource pool can establish an IPSEC encrypted channel based on the key generated during user terminal authentication to protect data transmission between the user terminal and the resource pool.

[0164] Furthermore, the specific functions of each part of the system are as follows:

[0165] The Password Management Service Platform (CMSP) is used to respond to access requests from user terminals and determine the Identity and Access Management System (IAM) and the Key Management System (KMS) that the user terminal needs to access.

[0166] If the IAM and the KMS belong to the same region, the CMSP is also used to send the IAM information of the IAM to the user terminal;

[0167] The user terminal is used to access the IAM based on the IAM information;

[0168] If the IAM and the KMS do not belong to the same region, the IAM is also used to perform a key relay process through the CMSP, generate a service authentication token and an access token ciphertext, and send the service authentication token and the access token ciphertext to the user terminal.

[0169] The user terminal is also used to access the IAM based on the service authentication token and the access token ciphertext.

[0170] In this embodiment of the application, the CMSP is further used for:

[0171] The CMSP determines the network path between the user terminal and the CMSP based on the IP address of the user terminal;

[0172] Based on the address and the network path, determine the IAM and KMS that the user terminal needs to access.

[0173] In this embodiment of the application, the user terminal is further configured to generate a login request based on the IAM information and send the login request to the IAM;

[0174] The IAM is also used to respond to the login request, generate a login session and a login session identifier, and use the login session and the login session identifier to access the user terminal.

[0175] In this embodiment of the application, the IAM information includes the IAM encryption public key; the user terminal is further configured to:

[0176] The user terminal uses the IAM encryption public key to encrypt the user terminal identifier, thereby obtaining the ciphertext of the user terminal identifier;

[0177] A login request is generated using the encrypted user terminal identifier.

[0178] In this embodiment of the application, the IAM is further used for:

[0179] The IAM obtains the encrypted user terminal identifier from the login request;

[0180] The ciphertext of the user terminal identifier is decrypted using the IAM encryption private key to obtain the user terminal identifier;

[0181] The legitimacy of the user terminal is verified by the CMSP using the user terminal identifier;

[0182] If the verification is successful, a login session and a login session identifier will be generated.

[0183] In this embodiment of the application, the IAM is further configured to generate a key relay request and send the key relay request to the CMSP;

[0184] The CMSP is also used to respond to the key relay request and schedule the user terminal key from the source KMS to the destination KMS through the QKD link; the source KMS and the IAM belong to the same area, and the destination KMS is the KMS that the user terminal needs to access;

[0185] The target KMS is also used to store the user terminal key to the corresponding key pool;

[0186] The IAM is also used to send the user terminal identifier to the destination KMS;

[0187] The destination KMS is further configured to generate an authentication vector using the key identifier of the user terminal key, sign the authentication vector using the signature private key of the destination KMS, and encrypt the authentication vector using the encryption public key of the IAM to obtain the authentication vector ciphertext, and send the authentication vector ciphertext to the IAM.

[0188] The IAM is also used to generate a temporary identity key based on the authentication vector ciphertext, and to generate a service authentication token based on the temporary identity key;

[0189] The IAM is further configured to generate an access token using the login validity period and access permissions corresponding to the user terminal, and encrypt the access token based on the authentication vector ciphertext to obtain the access token ciphertext.

[0190] In this embodiment of the application, the IAM is further used for:

[0191] The IAM uses its private encryption key to decrypt the ciphertext of the authentication vector to obtain the authentication vector.

[0192] The authentication vector is verified using the signature public key of the target KMS;

[0193] If the verification is successful, the authentication vector is used to perform a hash operation to generate a temporary identity key;

[0194] The authentication vector is hashed using the temporary identity key to generate a service authentication token.

[0195] In this embodiment of the application, the user terminal is further configured to generate a user authentication token ciphertext based on the service authentication token and the access token ciphertext, and send the user authentication token ciphertext to the IAM;

[0196] The IAM is also used to authenticate the user terminal based on the encrypted user authentication token. If the authentication is successful, a login session is generated, and the access token corresponding to the encrypted access token is activated. The login session and the access token are used to access the user terminal.

[0197] In this embodiment of the application, the user terminal is further used for:

[0198] The user terminal uses the service authentication token to obtain a key identifier, and uses the key identifier to obtain a user terminal key;

[0199] The user terminal key is used to authenticate the KMS.

[0200] If the identity verification is successful, the encrypted access token is decrypted to obtain the access token.

[0201] The access token is verified using an authentication vector;

[0202] If the verification is successful, a temporary identity key is generated using the authentication vector, and a service authentication token is generated using the temporary identity key.

[0203] Verify the service authentication token;

[0204] If the verification is successful, a user authentication token is generated using the temporary identity key;

[0205] The authentication vector is used to encrypt the user authentication token to obtain the ciphertext of the user authentication token.

[0206] In this embodiment of the application, the IAM is further used to generate a signature key pair and an encryption key pair for the IAM;

[0207] The KMS is also used to generate the KMS signature key and encryption key pair;

[0208] The IAM is also used to register with the CMSP, register the IAM's signature public key and encryption public key, and obtain the CMSP's signature public key and other IAMs' signature public keys and encryption public keys.

[0209] The KMS is also used to register with the CMSP, register the signature public key and encryption public key of the KMS, and obtain the signature public key of the CMSP and the signature public keys and encryption public keys of other KMSs.

[0210] The user terminal is also used to perform key filling from the KMS;

[0211] The KMS is also used to register the user terminal identifier of the user terminal with the CMSP;

[0212] The CMSP is also used to establish a mapping relationship between the user terminal identifier and the KMS.

[0213] In this embodiment of the application, the user terminal is further configured to generate a key injection request and send the key injection request to the KMS;

[0214] The KMS is also used to respond to the key injection request, generate an injection key, store the injection key, and send the injection key to the user terminal.

[0215] In this embodiment, when a user terminal logs in for the first time, the user terminal identifier is encrypted and transmitted to avoid exposing the user's identity. When the user terminal roams (accessing a non-home resource pool), the root keys of different areas are securely protected through QKD key relay. The generation functions and responsibilities of different types of keys are separated and derived layer by layer. The key pool (KP) is responsible for the generation and storage of root keys, the key management system (KMS) is responsible for the generation of secondary root keys (CK / IK), and the identity and access management system is responsible for the generation of identity keys. Moreover, commercial cryptographic technology (SM series algorithms) is used to generate and use multiple types of tokens to achieve full-process identity authentication and function authorization. This combines QKD with symmetric cryptography (block ciphers, hash ciphers), asymmetric cryptography (SM2 signature algorithm), and post-quantum cryptography (PQC), and deeply integrates it with the network of telecommunications operators to form a brand-new quantum security infrastructure system, improving the resistance to quantum attacks and the security of the system.

[0216] Reference Figure 2 The diagram illustrates a flowchart of a user terminal access method based on a quantum-safe infrastructure system according to this application, which may include the following steps:

[0217] Step 201: The Password Management Service Platform (CMSP) responds to the user terminal's access request and determines the Identity and Access Management System (IAM) and the Key Management System (KMS) that the user terminal needs to access.

[0218] Specifically, when a user terminal logs in, it can generate an access request and then send the access request to the CMSP. After receiving the access request, the CMSP can obtain the user terminal's IP address from the access request, then determine the network path between the user terminal and the CMSP based on the IP address, and then determine the nearest IAM and KMS that the user terminal needs to access based on the IP address and network path.

[0219] In determining the network path, a route tracing command can be used, or other methods can be employed. In practical applications, the specific method for determining the network path can be set according to actual needs, and this application embodiment does not impose any restrictions on this.

[0220] Step 202: If the IAM and the KMS belong to the same region, the CMSP sends the IAM information of the IAM to the user terminal.

[0221] If the IAM and KMS to be accessed belong to the same area, then the CMSP can obtain the IAM information of the IAM and send the IAM information to the user terminal.

[0222] The IAM information may include an IAM identifier and an IAM encryption public key. The IAM identifier may include the IAM domain name, IP address, etc. In practical applications, the specific content of the IAM information and the IAM identifier can be set according to actual needs, and this application embodiment does not limit this.

[0223] Step 203: The user terminal accesses the IAM based on the IAM information.

[0224] After obtaining the IAM information, the user terminal can access the IAM using the IAM identifier and the IAM encryption public key.

[0225] Specifically, the user terminal can generate a login request using IAM information and send the login request to IAM. IAM responds to the login request, generates a login session and a login session identifier, and uses the login session and login session identifier to access the user terminal.

[0226] Specifically, for login requests, the user terminal can use the IAM encryption public key to encrypt the user terminal identifier (denoted as "user terminal identifier") to obtain the ciphertext of the user terminal identifier, and then use the ciphertext of the user terminal identifier to generate a login request.

[0227] Furthermore, regarding the login session and login session identifier, IAM can obtain the encrypted user terminal identifier from the login request, then decrypt the encrypted user terminal identifier using the IAM encryption private key to obtain the user terminal identifier. This user terminal identifier is then used to verify the legitimacy of the user terminal with the CMSP. If the verification is successful, a login session and login session identifier are generated. The user terminal can then access the IAM through the login session (Session) and login session identifier (SID).

[0228] Step 204: If the IAM and the KMS do not belong to the same region, the IAM performs a key relay process through the CMSP to generate a service authentication token and an access token ciphertext, and sends the service authentication token and the access token ciphertext to the user terminal.

[0229] If the IAM and KMS to be accessed are not in the same region, the IAM can perform a key relay process through CMSP to generate ciphertext of service authentication token and access token (denoted as "access token ciphertext").

[0230] Specifically, IAM can generate a key relay request and send it to the CMSP.

[0231] Upon receiving a key relay request, the CMSP responds by dispatching the user terminal key from the source KMS to the destination KMS via a QKD link. Once the destination KMS obtains the user terminal key, it stores it in the corresponding key pool. The source KMS and IAM belong to the same region, and the destination KMS is the KMS the user terminal needs to access.

[0232] Then, IAM sends the user terminal identifier to the destination KMS. After obtaining the user terminal identifier, the destination KMS can generate an authentication vector (RAND, CK, IK, KEYID, TOKEN1) using the key identifier of the user terminal key. Then, it signs the authentication vector using the signature private key of the destination KMS and encrypts the authentication vector using the encryption public key of IAM to obtain the ciphertext authentication vector, and sends the ciphertext authentication vector to IAM.

[0233] RAND is a truly random number generated by a quantum random number generator or a hardware cryptographic device.

[0234] CK and IK are derived from a key randomly selected from the key pool or from the relay user terminal key KI. The key identifier is KEYID. The derivation method can use KI to perform SM3 cryptographic hash operations.

[0235] CK = SM3_HMAC(KI,RAND|KEYID|TOKEN1|TOKEN1 length), used for encrypting data packets in the IPSEC secure channel between user terminals and nodes in the resource pool;

[0236] IK = SM3_HMAC(KI, CK|RAND|KEYID|TOKEN1|TOKEN1 length), is used for data packet integrity protection of the IPSEC security channel between user terminals and nodes of the resource pool.

[0237] TOKEN1 is a service token containing the result of SM4 block symmetric encryption using KI. TOKEN1 = SM4_ENC(KI, RAND|KEYID|UID).

[0238] After obtaining the authentication vector ciphertext, IAM can generate a temporary identity key (IDK) using the ciphertext, and then generate a service authentication token (TOKEN2) using the IDK. It then generates an access token (TOKENR) using the login validity period and access permissions corresponding to the user terminal. Finally, it performs SM4 symmetric block encryption on the access token using the CK from the authentication vector, thus obtaining the access token ciphertext. The service authentication token and the access token ciphertext are then sent to the user terminal.

[0239] The access token can be in JWT format, and the signature of the JWT can use the IK in the authentication vector as the key to calculate the SM3_HMAC cryptographic hash value.

[0240] In this way, by using a randomly selected pre-shared key as the root key, pre-filling and key pools can provide a large number of one-time keys as a source of pre-shared keys, thereby achieving one-time pad root key security according to the security policy.

[0241] Furthermore, regarding the service authentication token, IAM can decrypt the authentication vector ciphertext using its own private key to obtain the authentication vector, and then verify the authentication vector using the destination KMS's signature public key. If the verification succeeds, a temporary identity key IDK is derived by performing an SM3 hash operation using CK and IK from the authentication vector.

[0242] IDK = SM3_HMAC(CK|IK,RAND|KEYID|UID|UID length|IAM_ID|IAM_ID length|TOKEN1|TOKEN1 length)

[0243] Among them, IDK is used to authenticate the current login session of the user terminal (for example, in a service-oriented architecture, the JWT carried by the user terminal when accessing various services is signed with HMAC using a temporary identity key).

[0244] After generating the IDK, IAM can use the IDK as the key to perform SM3 cryptographic hash operations on the TOKEN1, RAND, and KEYID in the authentication vector to generate a service authentication token.

[0245] Step 205: The user terminal accesses IAM based on the service authentication token and the encrypted access token.

[0246] After obtaining the service authentication token and access token ciphertext, the user terminal can generate the ciphertext of the user authentication token TOKEN3 (denoted as "user authentication token") based on the two.

[0247] Specifically, the user terminal can extract TOKEN1, SID, and RAND from the service authentication token TOKEN2, use UID|SID|RAND as the key to perform SM4 symmetric decryption to obtain the key identifier KEYID, and use the key identifier to obtain the user terminal key KI.

[0248] The user terminal key is used to perform SM4 block symmetric decryption on TOKEN1 to obtain RAND, KEYID, and UID. Then, the values ​​of RAND, KEYID, and UID are compared to verify the KMS identity.

[0249] If identity authentication is successful, CK and IK can be calculated using KI, TOKEN1, KEYID, and RAND (in the same way as above). CK is used to symmetrically decrypt the access token ciphertext to obtain the access token TOKENR, and then IK is used to verify the access token TOKENR.

[0250] If the verification is successful, the temporary identity key IDK is calculated using CK, IK, TOKEN1, KEYID, RAND, and IAM_ID (in the same way as above), and the service authentication token TOKEN2 is calculated using IDK, RAND, KEYID, TOKEN1, SID, and IAM_ID (in the same way as above). Then, the value of TOKEN2 is compared with the value of IAM to identify the identity of IAM.

[0251] If the verification is successful, the user authentication token TOKEN3 will be calculated using IDK as the key:

[0252] TOKEN3 = SM3_HMAC(IDK,TOKEN2|IAM_ID|TOKEN2 length|IAM_ID length)|SID|UID|IAM_ID

[0253] Then, CK is used to perform block symmetric encryption on TOKEN3 to obtain the ciphertext of the user authentication token, and the ciphertext of the user authentication token is sent to IAM.

[0254] After obtaining the encrypted authentication token, IAM can decrypt the user authentication token using CK in the authentication vector to obtain the user authentication token TOKEN3. Based on the encrypted user authentication token, IAM can authenticate the user terminal. If the authentication is successful, a login session is generated, and the access token corresponding to the encrypted access token is activated. The login session and access token are used to access the user terminal.

[0255] Furthermore, after the user terminal has connected, IAM can notify KMS and the user terminal to delete the KI corresponding to the KEYID and fill the storage space with zeros to erase it, based on a preset security policy (e.g., one-time password), in order to improve security.

[0256] In this embodiment, the Password Management Service Platform (CMSP) responds to the user terminal's access request, determining the Identity and Access Management System (IAM) and the Key Management System (KMS) that the user terminal needs to access. If the IAM and the KMS belong to the same region, the CMSP sends the IAM information to the user terminal; the user terminal accesses the IAM based on the IAM information. If the IAM and the KMS do not belong to the same region, the IAM executes a key relay process through the CMSP, generates a service authentication token and an access token ciphertext, and sends the service authentication token and the access token ciphertext to the user terminal; the user terminal accesses the IAM based on the service authentication token and the access token ciphertext.

[0257] In this way, when a user terminal logs in for the first time, the user terminal identifier can be encrypted and transmitted to avoid exposing the user's identity. When the user terminal roams (accessing a non-home resource pool), the root keys in different areas are securely protected through QKD key relay. The generation functions and responsibilities of different types of keys are separated and derived layer by layer. The key pool (KP) is responsible for the generation and storage of root keys, the key management system (KMS) is responsible for the generation of secondary root keys (CK / IK), and the identity and access management system is responsible for the generation of identity keys. Moreover, commercial cryptographic technology (SM series algorithms) is used to generate and use multiple types of tokens to achieve end-to-end identity authentication and function authorization. This combines QKD with symmetric cryptography (block ciphers, hash ciphers), asymmetric cryptography (SM2 signature algorithm), and post-quantum cryptography (PQC), and deeply integrates it with the telecommunications operator's network to form a brand-new quantum security infrastructure system, improving the resistance to quantum attacks and the system's security.

[0258] Reference Figure 3 The diagram illustrates a second embodiment of the user terminal access method based on a quantum-safe infrastructure system according to the present invention, which may specifically include the following steps:

[0259] Step 301: IAM generates IAM's signature key pair and encryption key pair, and KMS generates KMS's signature key and encryption key pair;

[0260] Step 302: IAM registers with CMSP, registering its signature public key and encryption public key, and obtains CMSP's signature public key and other IAM's signature public keys and encryption public keys. KMS registers with CMSP, registering its signature public key and encryption public key, and obtains CMSP's signature public key and other KMS's signature public keys and encryption public keys.

[0261] Step 303: The user terminal performs key filling from KMS;

[0262] Step 304: KMS registers the user terminal identifier of the user terminal with CMSP;

[0263] Step 305: CMSP establishes the mapping relationship between user terminal identifiers and KMS.

[0264] Specifically, before the system runs, each KMS and IAM within the system can generate signature key pairs and encryption key pairs respectively.

[0265] For any IAM, you can register with CMSP to register the IAM's signing public key and encryption public key, and obtain CMSP's signing public key and the signing public keys and encryption public keys of other IAMs.

[0266] For any KMS, you can register with CMSP to register the KMS's signature public key and encryption public key, and obtain CMSP's signature public key and the signature public keys and encryption public keys of other KMSs.

[0267] Furthermore, the user terminal generates a key recharge request and sends it to the KMS. Upon receiving the request, the KMS generates a recharge key, stores it locally, and then sends it to the user terminal. The user terminal stores the recharge key locally upon receiving it. Simultaneously, the KMS registers the user terminal's identifier (denoted as the "user terminal identifier") with the CMSP.

[0268] After obtaining the user terminal identifier, the CMSP can establish a mapping relationship between the user terminal identifier and the KMS.

[0269] Step 306: The Password Management Service Platform (CMSP) responds to the user terminal's access request and determines the Identity and Access Management System (IAM) and the Key Management System (KMS) that the user terminal needs to access.

[0270] Step 307: If IAM and KMS belong to the same area, then CMSP will send the IAM information of IAM to the user terminal.

[0271] Step 308: The user terminal accesses IAM based on IAM information;

[0272] Step 309: If IAM and KMS do not belong to the same area, IAM performs a key relay procedure through CMSP to generate service authentication token and access token ciphertext, and sends the service authentication token and access token ciphertext to the user terminal.

[0273] Step 3010: The user terminal accesses IAM based on the service authentication token and the encrypted access token.

[0274] Steps 306 to 3010 are essentially the same as steps 201 to 205, and will not be repeated here to avoid repetition.

[0275] In this embodiment, when a user terminal logs in for the first time, the user terminal identifier is encrypted and transmitted to avoid exposing the user's identity. When the user terminal roams (accessing a non-home resource pool), the root keys of different areas are securely protected through QKD key relay. The generation functions and responsibilities of different types of keys are separated and derived layer by layer. The key pool (KP) is responsible for the generation and storage of root keys, the key management system (KMS) is responsible for the generation of secondary root keys (CK / IK), and the identity and access management system is responsible for the generation of identity keys. Moreover, commercial cryptographic technology (SM series algorithms) is used to generate and use multiple types of tokens to achieve full-process identity authentication and function authorization. This combines QKD with symmetric cryptography (block ciphers, hash ciphers), asymmetric cryptography (SM2 signature algorithm), and post-quantum cryptography (PQC), and deeply integrates it with the network of telecommunications operators to form a brand-new quantum security infrastructure system, improving the resistance to quantum attacks and the security of the system.

[0276] Reference Figure 4 The diagram illustrates a flowchart of a third embodiment of a user terminal access method based on a quantum-safe infrastructure system according to the present invention. This method can be applied to CMSP and specifically includes the following steps:

[0277] Step 401: Obtain the access request from the user terminal;

[0278] Step 402: Determine the Identity and Access Management System (IAM) that the user terminal needs to access, and the Key Management System (KMS) that it needs to access.

[0279] Step 403: If IAM and KMS belong to the same area, then IAM information of IAM is sent to the user terminal so that the user terminal can access IAM based on IAM information;

[0280] Step 404: If IAM and KMS do not belong to the same area, respond to the key relay request of IAM, and schedule the user terminal key from the source KMS to the destination KMS so that IAM can perform the key relay process through the user terminal key, generate service authentication token and access token ciphertext, and send the service authentication token and access token ciphertext to the user terminal so that the user terminal can access IAM based on the service authentication token and access token ciphertext.

[0281] Specifically, after receiving an access request, the CMSP can obtain the IP address of the user terminal from the access request, then determine the network path between the user terminal and the CMSP based on the IP address, and then determine the IAM and KMS that the user terminal needs to access based on the IP address and the network path.

[0282] In determining the network path, a route tracing command can be used, or other methods can be employed. In practical applications, the specific method for determining the network path can be set according to actual needs, and this application embodiment does not impose any restrictions on this.

[0283] If the IAM and KMS to be accessed belong to the same area, the CMSP can obtain the IAM information and send it to the user terminal. After obtaining the IAM information, the user terminal can access the IAM using the IAM identifier and the IAM encryption public key.

[0284] The IAM information may include an IAM identifier and an IAM encryption public key. The IAM identifier may include the IAM domain name, IP address, etc. In practical applications, the specific content of the IAM information and the IAM identifier can be set according to actual needs, and this application embodiment does not limit this.

[0285] Furthermore, the steps for the user terminal to access IAM based on IAM information are essentially the same as step 203, and will not be repeated here to avoid duplication.

[0286] If the IAM and KMS to be accessed are not in the same area, the IAM can generate a key relay request and send the key relay request to the CMSP.

[0287] Upon receiving a key relay request, the CMSP responds by dispatching the user terminal key from the source KMS to the destination KMS via a QKD link. The destination KMS, upon receiving the user terminal key, stores it in the corresponding key pool. This allows the IAM to execute the key relay process using the user terminal key, generating encrypted service authentication tokens and access tokens, and sending these encrypted tokens to the user terminal. The user terminal then accesses the IAM based on these encrypted tokens.

[0288] The steps for the user terminal to access IAM based on the service authentication token and the encrypted access token are essentially the same as steps 205, and will not be repeated here to avoid duplication.

[0289] Furthermore, before the system runs, for any IAM, it can be registered with CMSP to register the IAM's signature public key and encryption public key, as well as obtain CMSP's signature public key and the signature public keys and encryption public keys of other IAMs.

[0290] For any KMS, you can register with CMSP to register the KMS's signature public key and encryption public key, and obtain CMSP's signature public key and the signature public keys and encryption public keys of other KMSs.

[0291] The user terminal can generate a key injection request and send it to the KMS. After receiving the key injection request, the KMS generates an injection key, stores it locally, and sends it to the user terminal. The user terminal stores the injection key locally after receiving it. At the same time, the KMS registers the user terminal's identifier (denoted as "user terminal identifier") with the CMSP.

[0292] After obtaining the user terminal identifier, the CMSP can establish a mapping relationship between the user terminal identifier and the KMS.

[0293] In this embodiment, when a user terminal logs in for the first time, the user terminal identifier is encrypted and transmitted to avoid exposing the user's identity. When the user terminal roams (accessing a non-home resource pool), the root keys of different areas are securely protected through QKD key relay. The generation functions and responsibilities of different types of keys are separated and derived layer by layer. The key pool (KP) is responsible for the generation and storage of root keys, the key management system (KMS) is responsible for the generation of secondary root keys (CK / IK), and the identity and access management system is responsible for the generation of identity keys. Moreover, commercial cryptographic technology (SM series algorithms) is used to generate and use multiple types of tokens to achieve full-process identity authentication and function authorization. This combines QKD with symmetric cryptography (block ciphers, hash ciphers), asymmetric cryptography (SM2 signature algorithm), and post-quantum cryptography (PQC), and deeply integrates it with the network of telecommunications operators to form a brand-new quantum security infrastructure system, improving the resistance to quantum attacks and the security of the system.

[0294] Reference Figure 5 The diagram illustrates a flowchart of a fourth embodiment of a user terminal access method based on a quantum-safe infrastructure system according to the present invention. This method can be applied to IAMs (Information and Access Management Systems) that user terminals need to access, and specifically includes the following steps:

[0295] Step 501: Execute the key relay process through CMSP to generate service authentication token and access token ciphertext;

[0296] Step 502: Send the service authentication token and access token ciphertext to the user terminal, so that the user terminal generates user authentication token ciphertext based on the service authentication token and access token ciphertext, and sends the user authentication token ciphertext to IAM;

[0297] Step 503: Verify the user terminal's identity based on the encrypted user authentication token;

[0298] Step 504: If the verification is successful, a login session is generated, and the access token corresponding to the access token ciphertext is activated. The login session and access token are used to access the user terminal.

[0299] Specifically, if the IAM and KMS to be accessed do not belong to the same region, the accessing IAM can perform a key relay process through CMSP to generate service authentication tokens and access token ciphertexts.

[0300] Specifically, IAM can generate a key relay request and send it to the CMSP.

[0301] Upon receiving a key relay request, the CMSP responds by dispatching the user terminal key from the source KMS to the destination KMS via a QKD link. Once the destination KMS obtains the user terminal key, it stores it in the corresponding key pool. The source KMS and IAM belong to the same region, and the destination KMS is the KMS the user terminal needs to access.

[0302] Then, IAM sends the user terminal identifier to the destination KMS. After obtaining the user terminal identifier, the destination KMS can generate an authentication vector (RAND, CK, IK, KEYID, TOKEN1) using the key identifier of the user terminal key. Then, it signs the authentication vector using the signature private key of the destination KMS and encrypts the authentication vector using the encryption public key of IAM to obtain the ciphertext authentication vector, and sends the ciphertext authentication vector to IAM.

[0303] RAND is a truly random number generated by a quantum random number generator or a hardware cryptographic device.

[0304] CK and IK are derived from a key randomly selected from the key pool or from the relay user terminal key KI. The key identifier is KEYID. The derivation method can use KI to perform SM3 cryptographic hash operations.

[0305] CK = SM3_HMAC(KI,RAND|KEYID|TOKEN1|TOKEN1 length), used for encrypting data packets in the IPSEC secure channel between user terminals and nodes in the resource pool;

[0306] IK = SM3_HMAC(KI, CK|RAND|KEYID|TOKEN1|TOKEN1 length), is used for data packet integrity protection of the IPSEC security channel between user terminals and nodes of the resource pool.

[0307] TOKEN1 is a service token containing the result of SM4 block symmetric encryption using KI. TOKEN1 = SM4_ENC(KI, RAND|KEYID|UID).

[0308] After obtaining the authentication vector ciphertext, IAM can generate a temporary identity key (IDK) using the ciphertext, and then generate a service authentication token (TOKEN2) using the IDK. It then generates an access token (TOKENR) using the login validity period and access permissions corresponding to the user terminal. Finally, it performs SM4 symmetric block encryption on the access token using the CK from the authentication vector, thus obtaining the access token ciphertext. The service authentication token and the access token ciphertext are then sent to the user terminal.

[0309] The access token can be in JWT format, and the signature of the JWT can use the IK in the authentication vector as the key to calculate the SM3_HMAC cryptographic hash value.

[0310] In this way, by using a randomly selected pre-shared key as the root key, pre-filling and key pools can provide a large number of one-time keys as a source of pre-shared keys, thereby achieving one-time pad root key security according to the security policy.

[0311] Furthermore, regarding the service authentication token, IAM can decrypt the authentication vector ciphertext using its own private key to obtain the authentication vector, and then verify the authentication vector using the destination KMS's signature public key. If the verification succeeds, a temporary identity key IDK is derived by performing an SM3 hash operation using CK and IK from the authentication vector.

[0312] IDK = SM3_HMAC(CK|IK,RAND|KEYID|UID|UID length|IAM_ID|IAM_ID length|TOKEN1|TOKEN1 length)

[0313] Among them, IDK is used to authenticate the current login session of the user terminal (for example, in a service-oriented architecture, the JWT carried by the user terminal when accessing various services is signed with HMAC using a temporary identity key).

[0314] After generating the IDK, IAM can use the IDK as the key to perform SM3 cryptographic hash operations on the TOKEN1, RAND, and KEYID in the authentication vector to generate a service authentication token.

[0315] After obtaining the service authentication token and access token ciphertext, the user terminal can generate a user authentication token ciphertext based on the two and send the user authentication token ciphertext to IAM.

[0316] After obtaining the encrypted authentication token, IAM can decrypt the user authentication token using CK in the authentication vector to obtain the user authentication token TOKEN3. Based on the encrypted user authentication token, IAM can authenticate the user terminal. If the authentication is successful, a login session is generated, and the access token corresponding to the encrypted access token is activated. The login session and access token are used to access the user terminal.

[0317] Furthermore, after the user terminal has connected, IAM can notify KMS and the user terminal to delete the KI corresponding to the KEYID and fill the storage space with zeros to erase it, based on a preset security policy (e.g., one-time password), in order to improve security.

[0318] Furthermore, before the system runs, each KMS and IAM within the system can generate signature key pairs and encryption key pairs respectively.

[0319] For any IAM, you can register with CMSP to register the IAM's signing public key and encryption public key, and obtain CMSP's signing public key and the signing public keys and encryption public keys of other IAMs.

[0320] In this embodiment, when a user terminal logs in for the first time, the user terminal identifier is encrypted and transmitted to avoid exposing the user's identity. When the user terminal roams (accessing a non-home resource pool), the root keys of different areas are securely protected through QKD key relay. The generation functions and responsibilities of different types of keys are separated and derived layer by layer. The key pool (KP) is responsible for the generation and storage of root keys, the key management system (KMS) is responsible for the generation of secondary root keys (CK / IK), and the identity and access management system is responsible for the generation of identity keys. Moreover, commercial cryptographic technology (SM series algorithms) is used to generate and use multiple types of tokens to achieve full-process identity authentication and function authorization. This combines QKD with symmetric cryptography (block ciphers, hash ciphers), asymmetric cryptography (SM2 signature algorithm), and post-quantum cryptography (PQC), and deeply integrates it with the network of telecommunications operators to form a brand-new quantum security infrastructure system, improving the resistance to quantum attacks and the security of the system.

[0321] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0322] Reference Figure 6 The diagram shows a structural block diagram of a user terminal access device according to a first embodiment of the present invention, which may specifically include the following modules:

[0323] The acquisition module 601 is used to acquire access requests from user terminals;

[0324] The determining module 602 is used to determine the identity and access management system (IAM) that the user terminal needs to access, and the key management system (KMS) that it needs to access.

[0325] The first sending module 603 is used to send the IAM information of the IAM to the user terminal if the IAM and the KMS belong to the same area, so that the user terminal can access the IAM based on the IAM information;

[0326] The scheduling module 604 is configured to, if the IAM and the KMS do not belong to the same area, respond to the key relay request of the IAM, schedule the user terminal key from the source KMS to the destination KMS, so that the IAM can perform the key relay process through the user terminal key, generate service authentication token and access token ciphertext, and send the service authentication token and access token ciphertext to the user terminal, so that the user terminal can access the IAM based on the service authentication token and access token ciphertext.

[0327] Reference Figure 7 The diagram shows a structural block diagram of a second embodiment of the user terminal access device of the present invention, which may specifically include the following modules:

[0328] The generation module 701 is used to execute the key relay process through CMSP to generate service authentication tokens and access token ciphertexts;

[0329] The second sending module 702 is used to send the service authentication token and the access token to the user terminal, so that the user terminal generates a user authentication token ciphertext based on the service authentication token and the access token ciphertext, and sends the user authentication token ciphertext to the IAM;

[0330] Verification module 703 is used to authenticate the user terminal based on the encrypted user authentication token;

[0331] The access module 704 is used to generate the login session if the verification is successful, activate the access token corresponding to the encrypted access token, and access the user terminal using the login session and the access token.

[0332] In this embodiment of the application, the generation module is specifically used for:

[0333] A key relay request is generated and sent to the CMSP, so that the CMSP responds to the key relay request and schedules the user terminal key from the source KMS to the destination KMS through the QKD link; the source KMS and the IAM belong to the same area, and the destination KMS is the KMS that the user terminal needs to access, so that the destination KMS stores the user terminal key in the corresponding key pool.

[0334] The user terminal identifier is sent to the destination KMS, so that the destination KMS generates an authentication vector using the key identifier of the user terminal key, signs the authentication vector using the signature private key of the destination KMS, and encrypts the authentication vector using the encryption public key of the IAM to obtain the authentication vector ciphertext, and sends the authentication vector ciphertext to the IAM.

[0335] A temporary identity key is generated based on the authentication vector ciphertext, and a service authentication token is generated based on the temporary identity key;

[0336] The IAM generates an access token using the login validity period and access permissions corresponding to the user terminal, and encrypts the access token based on the authentication vector ciphertext to obtain the access token ciphertext.

[0337] The virtual device in this application embodiment can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. For example, a mobile electronic device can be a mobile phone, tablet computer, laptop computer, PDA, in-vehicle electronic device, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc. A non-mobile electronic device can be a server, network attached storage (NAS), personal computer (PC), television (TV), ATM, or self-service machine, etc. This application embodiment does not impose specific limitations.

[0338] This invention also provides an electronic device, comprising:

[0339] It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, it implements the various processes of the above-described user terminal access method embodiment based on a quantum-safe infrastructure system and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0340] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described user terminal access method embodiments based on a quantum-safe infrastructure system and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0341] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0342] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0343] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, embodiments of this application can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of this application can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0344] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0345] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0346] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0347] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0348] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0349] The embodiments provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A quantum-safe infrastructure system, characterized in that, include: The Password Management Service Platform (CMSP) is used to respond to access requests from user terminals and determine the Identity and Access Management System (IAM) and the Key Management System (KMS) that the user terminal needs to access. If the IAM and the KMS belong to the same region, the CMSP is also used to send the IAM information of the IAM to the user terminal; The user terminal is used to access the IAM based on the IAM information; If the IAM and the KMS do not belong to the same region, the IAM is also used to schedule the user terminal key to the destination KMS through the CMSP. The destination KMS generates an authentication vector ciphertext and sends the authentication vector ciphertext to the IAM. The IAM generates a service authentication token and an access token ciphertext based on the authentication vector ciphertext and sends the service authentication token and the access token ciphertext to the user terminal. The target KMS is the KMS that the user terminal needs to access; The user terminal is also used to access the IAM based on the service authentication token and the access token ciphertext.

2. A user terminal access method based on a quantum-safe infrastructure system, characterized in that, include: The Password Management Service Platform (CMSP) responds to the user terminal's access request and determines the Identity and Access Management System (IAM) and the Key Management System (KMS) that the user terminal needs to access. If the IAM and the KMS belong to the same region, the CMSP will send the IAM information of the IAM to the user terminal; The user terminal accesses the IAM based on the IAM information; If the IAM and the KMS do not belong to the same region, the IAM dispatches the user terminal key to the destination KMS through the CMSP. The destination KMS generates an authentication vector ciphertext and sends the authentication vector ciphertext to the IAM. The IAM generates a service authentication token and an access token ciphertext based on the authentication vector ciphertext and sends the service authentication token and the access token ciphertext to the user terminal. The target KMS is the KMS that the user terminal needs to access; The user terminal accesses the IAM based on the service authentication token and the encrypted access token.

3. The user terminal access method based on a quantum-safe infrastructure system according to claim 2, characterized in that, CMSP determines the Identity and Access Management System (IAM) and Key Management System (KMS) that the user terminal needs to access, including: The CMSP determines the network path between the user terminal and the CMSP based on the IP address of the user terminal; Based on the address and the network path, determine the IAM and KMS that the user terminal needs to access.

4. The user terminal access method based on a quantum-safe infrastructure system according to claim 2, characterized in that, The user terminal accesses the IAM based on the IAM information, including: The user terminal generates a login request based on the IAM information and sends the login request to the IAM. The IAM responds to the login request, generates a login session and a login session identifier, and uses the login session and the login session identifier to access the user terminal.

5. The user terminal access method based on a quantum-safe infrastructure system according to claim 4, characterized in that, The IAM information includes the IAM encryption public key; The user terminal generates a login request based on the IAM information, including: The user terminal uses the IAM encryption public key to encrypt the user terminal identifier, thereby obtaining the ciphertext of the user terminal identifier; A login request is generated using the encrypted user terminal identifier.

6. The user terminal access method based on a quantum-safe infrastructure system according to claim 4, characterized in that, In response to the login request, the IAM generates a login session and a login session identifier, including: The IAM obtains the encrypted user terminal identifier from the login request; The ciphertext of the user terminal identifier is decrypted using the IAM encryption private key to obtain the user terminal identifier; The legitimacy of the user terminal is verified by the CMSP using the user terminal identifier; If the verification is successful, a login session and a login session identifier will be generated.

7. The user terminal access method based on a quantum-safe infrastructure system according to claim 2, characterized in that, The IAM schedules the user terminal key to the destination KMS through the CMSP. The destination KMS generates an authentication vector ciphertext and sends it to the IAM. The IAM generates service authentication tokens and access token ciphertexts based on the authentication vector ciphertext, including: The IAM generates a key relay request and sends the key relay request to the CMSP; The CMSP responds to the key relay request by scheduling the user terminal key from the source KMS to the destination KMS via the QKD link; the source KMS and the IAM belong to the same area, and the destination KMS is the KMS that the user terminal needs to access; The destination KMS stores the user terminal key in the corresponding key pool; The IAM sends the user terminal identifier to the destination KMS; The destination KMS generates an authentication vector using the key identifier of the user terminal key, signs the authentication vector using the signature private key of the destination KMS, and encrypts the authentication vector using the encryption public key of the IAM to obtain the authentication vector ciphertext, and sends the authentication vector ciphertext to the IAM. The IAM generates a temporary identity key based on the authentication vector ciphertext, and generates a service authentication token based on the temporary identity key; The IAM generates an access token using the login validity period and access permissions corresponding to the user terminal, and encrypts the access token based on the authentication vector ciphertext to obtain the access token ciphertext.

8. The user terminal access method based on a quantum-safe infrastructure system according to claim 7, characterized in that, The IAM generates a temporary identity key based on the authentication vector ciphertext, and generates a service authentication token based on the temporary identity key, including: The IAM uses its private encryption key to decrypt the ciphertext of the authentication vector to obtain the authentication vector. The authentication vector is verified using the signature public key of the target KMS; If the verification is successful, the authentication vector is used to perform a hash operation to generate a temporary identity key; The authentication vector is hashed using the temporary identity key to generate a service authentication token.

9. The user terminal access method based on a quantum-safe infrastructure system according to claim 2, characterized in that, The user terminal accesses the IAM based on the service authentication token and the encrypted access token, including: The user terminal generates a user authentication token ciphertext based on the service authentication token and the access token ciphertext, and sends the user authentication token ciphertext to the IAM; The IAM verifies the user terminal based on the encrypted user authentication token. If the verification is successful, a login session is generated, and the access token corresponding to the encrypted access token is activated. The user terminal is then accessed using the login session and the access token.

10. The user terminal access method based on a quantum-safe infrastructure system according to claim 9, characterized in that, The user terminal generates a user authentication token ciphertext based on the service authentication token and the access token ciphertext, including: The user terminal uses the service authentication token to obtain a key identifier, and uses the key identifier to obtain a user terminal key; The user terminal key is used to authenticate the KMS. If the identity verification is successful, the encrypted access token is decrypted to obtain the access token. The access token is verified using an authentication vector; If the verification is successful, a temporary identity key is generated using the authentication vector, and a service authentication token is generated using the temporary identity key. Verify the service authentication token; If the verification is successful, a user authentication token is generated using the temporary identity key; The authentication vector is used to encrypt the user authentication token to obtain the ciphertext of the user authentication token.

11. The user terminal access method based on a quantum-safe infrastructure system according to claim 2, characterized in that, Before the Password Management Service Platform (CMSP) responds to the user terminal's access request, it also includes: The IAM generates a signature key pair and an encryption key pair for the IAM, and the KMS generates a signature key and an encryption key pair for the KMS; The IAM registers with the CMSP, registering its signature public key and encryption public key, and obtaining the CMSP's signature public key and the signature public keys and encryption public keys of other IAMs. Similarly, the KMS registers with the CMSP, registering its signature public key and encryption public key, and obtaining the CMSP's signature public key and the signature public keys and encryption public keys of other KMSs. The user terminal receives key injection from the KMS; The KMS registers the user terminal identifier of the user terminal with the CMSP; The CMSP establishes a mapping relationship between the user terminal identifier and the KMS.

12. The user terminal access method based on a quantum-safe infrastructure system according to claim 11, characterized in that, The user terminal performs key injection from the KMS, including: The user terminal generates a key injection request and sends the key injection request to the KMS; The KMS responds to the key injection request, generates an injection key, stores the injection key, and sends the injection key to the user terminal.

13. A user terminal access method based on a quantum-safe infrastructure system, characterized in that, include: Obtain the user terminal's access request; Determine the Identity and Access Management System (IAM) that the user terminal needs to access, and the Key Management System (KMS) that it needs to access; If the IAM and the KMS belong to the same area, then the IAM information of the IAM is sent to the user terminal so that the user terminal can access the IAM based on the IAM information; If the IAM and the KMS do not belong to the same region, then in response to the IAM's key relay request, the user terminal key is scheduled from the source KMS to the destination KMS, so that the IAM can schedule the user terminal key to the destination KMS through the user terminal key. The destination KMS generates an authentication vector ciphertext and sends the authentication vector ciphertext to the IAM. The IAM generates a service authentication token and an access token ciphertext based on the authentication vector ciphertext, and sends the service authentication token and the access token ciphertext to the user terminal, so that the user terminal can access the IAM based on the service authentication token and the access token ciphertext. The target KMS is the KMS that the user terminal needs to access.

14. A user terminal access method based on a quantum-safe infrastructure system, characterized in that, include: The user terminal key is dispatched to the destination KMS via CMSP. The destination KMS generates an authentication vector ciphertext and sends the authentication vector ciphertext to IAM. The IAM generates a service authentication token and an access token ciphertext based on the authentication vector ciphertext. The target KMS is the KMS that the user terminal needs to access; The service authentication token and the access token are sent to the user terminal, so that the user terminal generates a user authentication token ciphertext based on the service authentication token and the access token ciphertext, and sends the user authentication token ciphertext to IAM; The user terminal is authenticated based on the encrypted user authentication token. If the verification is successful, a login session is generated, and the access token corresponding to the encrypted access token is activated. The user terminal is then accessed using the login session and the access token.

15. The user terminal access method based on a quantum-safe infrastructure system according to claim 14, characterized in that, The step of executing the key relay process via CMSP to generate service authentication tokens and access token ciphertexts includes: A key relay request is generated and sent to the CMSP, so that the CMSP responds to the key relay request and schedules the user terminal key from the source KMS to the destination KMS through the QKD link; the source KMS and the IAM belong to the same area, and the destination KMS is the KMS that the user terminal needs to access, so that the destination KMS stores the user terminal key in the corresponding key pool. The user terminal identifier is sent to the destination KMS, so that the destination KMS generates an authentication vector using the key identifier of the user terminal key, signs the authentication vector using the signature private key of the destination KMS, and encrypts the authentication vector using the encryption public key of the IAM to obtain the authentication vector ciphertext, and sends the authentication vector ciphertext to the IAM. A temporary identity key is generated based on the authentication vector ciphertext, and a service authentication token is generated based on the temporary identity key; The IAM generates an access token using the login validity period and access permissions corresponding to the user terminal, and encrypts the access token based on the authentication vector ciphertext to obtain the access token ciphertext.

16. A user terminal access device, characterized in that, include: The acquisition module is used to acquire access requests from user terminals; The determination module is used to determine the Identity and Access Management System (IAM) that the user terminal needs to access, and the Key Management System (KMS) that it needs to access. The first sending module is configured to send the IAM information of the IAM to the user terminal if the IAM and the KMS belong to the same area, so that the user terminal can access the IAM based on the IAM information; The scheduling module is configured to, if the IAM and the KMS do not belong to the same area, respond to the key relay request of the IAM and schedule the user terminal key from the source KMS to the destination KMS, so that the IAM can schedule the user terminal key to the destination KMS through the user terminal key. The destination KMS generates an authentication vector ciphertext and sends the authentication vector ciphertext to the IAM. The IAM generates a service authentication token and an access token ciphertext based on the authentication vector ciphertext and sends the service authentication token and the access token ciphertext to the user terminal, so that the user terminal can access the IAM based on the service authentication token and the access token ciphertext. The target KMS is the KMS that the user terminal needs to access.

17. A user terminal access device, characterized in that, include: The generation module is used to schedule the user terminal key to the destination KMS through CMSP. The destination KMS generates an authentication vector ciphertext and sends the authentication vector ciphertext to IAM. The IAM generates a service authentication token and an access token ciphertext based on the authentication vector ciphertext. The target KMS is the KMS that the user terminal needs to access; The second sending module is used to send the service authentication token and the access token to the user terminal, so that the user terminal generates a user authentication token ciphertext based on the service authentication token and the access token ciphertext, and sends the user authentication token ciphertext to IAM; The verification module is used to authenticate the user terminal based on the encrypted user authentication token. The access module is used to generate a login session if the verification is successful, and to activate the access token corresponding to the encrypted access token, and to access the user terminal using the login session and the access token.

18. The user terminal access device according to claim 17, characterized in that, The generation module is specifically used for: A key relay request is generated and sent to the CMSP, so that the CMSP responds to the key relay request and schedules the user terminal key from the source KMS to the destination KMS through the QKD link; the source KMS and the IAM belong to the same area, and the destination KMS is the KMS that the user terminal needs to access, so that the destination KMS stores the user terminal key in the corresponding key pool. The user terminal identifier is sent to the destination KMS, so that the destination KMS generates an authentication vector using the key identifier of the user terminal key, signs the authentication vector using the signature private key of the destination KMS, and encrypts the authentication vector using the encryption public key of the IAM to obtain the authentication vector ciphertext, and sends the authentication vector ciphertext to the IAM. A temporary identity key is generated based on the authentication vector ciphertext, and a service authentication token is generated based on the temporary identity key; The IAM generates an access token using the login validity period and access permissions corresponding to the user terminal, and encrypts the access token based on the authentication vector ciphertext to obtain the access token ciphertext.

19. An electronic device, characterized in that, The system includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the user terminal access method based on a quantum-safe infrastructure system as described in any one of claims 13 to 15.

20. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions, which, when executed by a processor, implement the steps of the user terminal access method based on a quantum-safe infrastructure system as described in any one of claims 13 to 15.

Images