A post-quantum key encapsulation method and system

Abstract

This invention discloses a post-quantum key encapsulation method and system, relating to the fields of cryptography and network security. Based on the difficult problem of modular learning with errors, it combines FO transform to achieve the IND-CCA2 security level, including key generation, encapsulation, and decapsulation steps. Key generation generates a public-private key pair based on the security parameter λ. The encapsulation step obtains the public key to generate ciphertext and a shared key. The decapsulation step verifies the ciphertext and recovers the key. The system includes six modules such as parameter configuration and key management, adaptable to scenarios such as industrial control systems. This invention optimizes computational efficiency, compresses ciphertext volume, integrates side-channel protection, and solves the problems of weak resistance to quantum attacks and poor adaptability of traditional solutions. It balances security and real-time performance and can be widely applied in industrial control, IoT, and other fields.

Description

Technical Field

[0001] This invention relates to the field of cryptography and network security, and in particular to a post-quantum key encapsulation method and system. Background Technology

[0002] Industrial control systems are a core support of critical infrastructure. Their intelligent and networked development leads to increasingly frequent equipment communication, creating an urgent need for communication security. The development of quantum computing technology exposes traditional RSA / ECC key negotiation schemes to the threat of Shor's algorithm quantum attacks. NIST has selected ML-KEM as the key encapsulation standard, but existing MLWE key encapsulation schemes have many shortcomings: they only support IND-CPA security, have large ciphertext sizes, low computational efficiency, lack side-channel protection, and have poor adaptability to industrial scenarios, making it difficult to meet the security and real-time requirements of industrial control systems. Therefore, there is an urgent need for quantum-resistant key encapsulation schemes adapted to industrial scenarios.

[0003] With the rapid iteration of quantum computing technology, traditional key negotiation schemes based on large number factorization (RSA) and elliptic curve discrete logarithm (ECC) problems can no longer meet the security requirements of industrial control systems and face serious threats from quantum attacks. Shor's quantum algorithm can efficiently solve large number factorization and discrete logarithm problems in polynomial time. Once large-scale quantum computers are commercially available, most existing cryptographic systems in industrial control systems will be easily cracked, leading to serious security incidents such as tampering with industrial control commands, leakage of equipment operating data, and illegal hijacking of industrial control equipment. This will directly affect the continuity and stability of industrial production and may even trigger safety accidents.

[0004] Therefore, a post-quantum key encapsulation method and system are needed to solve the above problems. Summary of the Invention

[0005] The purpose of this invention is to provide a post-quantum key encapsulation method and system, which is based on the MLWE difficult problem to achieve the IND-CCA2 security level. By optimizing the algorithm design, the computational efficiency is improved, the bandwidth usage is reduced, and a side-channel protection mechanism is added. This solves the problems of weak resistance to quantum attacks, low efficiency, and poor adaptability of traditional key encapsulation schemes. It is especially suitable for the deployment needs of industrial control systems and ensures the security and stability of industrial control communication.

[0006] To achieve the above objectives, this invention provides a post-quantum key encapsulation method, which uses modular lattice learning with error MLWE combined with FO transform to achieve IND-CCA2 key negotiation, specifically including the following steps: S1: Generate a public key pk and a private key sk based on the preset security parameter λ; S2: Obtain the receiver's public key pk, and generate ciphertext c and shared symmetric key K; S3: Use the private key sk to decrypt the ciphertext c, restore the shared symmetric key K, or return the rejection symbol ⊥; S4: Derive m' and H(c) through the key derivation function G, and output the final shared symmetric key K=G(m'∥H(c)); S5: Store the private key sk in a secure sandbox or encrypted storage unit of the industrial equipment and update it regularly.

[0007] Preferably, the key generation process in S1 is as follows: S11: Randomly generate seed By using the SHAKE-128 extension function Expand to ,in Seed for the private key; S12: Sampling the seed using the private key Generate a uniform random matrix ,in It is a polynomial ring. Modulo a large prime number, Let the degree be a polynomial. From a module perspective; S13: From Sampling short vectors in a central binomial distribution or Gaussian distribution Error vector The range of values ​​for the elements of the short vector and the error vector is determined by the safety factor λ, which ranges from -2 to 2. The sampling process employs randomization. S14: Accelerated computation via NTT ,in" "" represents matrix-vector multiplication over a polynomial ring; the operation is deployed in the embedded chip of the industrial gateway; S15: Output the key pair, public key private key ,in It uses the SHA3-256 hash function. The public key hash value, .

[0008] Preferably, in S2, the sender obtains the receiver's public key. Then, an encapsulation operation is performed to generate ciphertext and a shared symmetric key. The specific steps are as follows: S21: Generate the initial seed for a random shared symmetric key. ; S22: By and Generate a seed using SHA3-256 hash derivation. ,based on Sample temporary short vectors from the central binomial distribution. Error vector Error elements Sampling time <10μs; S23: Calculate the ciphertext , ;in, For matrix transpose, For model A half-integer, used to represent the message Embedded middle; S24: Compress according to preset parameters right and Quantization compression is performed to obtain the compressed ciphertext component. , Output ciphertext The data is 1088 bytes in size and is sent to the field PLC via the Profinet bus. S25: Messages are processed via the key derivation function G. and By performing derivation, a shared symmetric key is obtained. , For ciphertext The hash value is used to bind the ciphertext to the shared symmetric key, and the output is... ,in Used to encrypt industrial control commands and equipment operation data.

[0009] Preferably, in step S3, after the receiver obtains the ciphertext, it uses its private key to perform a decapsulation operation, sharing the symmetric key with the server. If the ciphertext is invalid, it returns a rejection symbol. The specific steps are as follows: S31: For ciphertext components Perform the decompression operation separately to obtain... and The decompression algorithm is embedded in the chip of industrial equipment, with a decompression time of <10μs, which does not affect the PLC and normal acquisition of power data; S32: Calculation The calculation result is quantized and compressed using a 1-bit method to obtain the recovered message. ,in Short vector of private key The transpose of the text is modified to incorporate an error correction mechanism to resist ciphertext errors caused by electromagnetic interference in the industrial environment. S33: Based on and Re-derived seeds Sampling temporary short vectors Error vector , Reconstructing the ciphertext ,like ,return ;like Execute S4; verification process <15μs.

[0010] Preferably, in S4, the key derivation function G is used to derive the key pair. and The derivation process yields the final shared symmetric key K=G(m'∥H(c)); the final shared symmetric key is temporarily stored in the memory of the industrial equipment and used to decrypt received industrial control commands and equipment operation data, and is destroyed immediately after the session ends.

[0011] A post-quantum key encapsulation system includes a parameter configuration module, a key management module, an encapsulation module, a decapsulation module, a communication interface module, and a security monitoring module. The modules work together to implement the steps of a post-quantum key encapsulation method.

[0012] Preferably, the parameter configuration module is used to load the core parameters of the encapsulated system, supports dynamic switching of security levels, and adapts to different application scenarios. The core parameters include security parameters. Modulus parameters polynomial degree Module Dimension Compression parameters Error distribution type, hash or expansion function, key derivation function G; error distribution types include central binomial distribution or Gaussian distribution; configuration according to actual needs. For any item in the set (1,3,5), configure the Kyber-768 parameters in the industrial control system. =3, =3329, =256, =3, , ; The key management module connects with the parameter configuration module to perform key generation, storage, update, and destruction operations. When generating a key, it calls the parameters from the parameter configuration module. For industrial control systems, the private key is stored in the secure sandbox or encrypted storage unit of the industrial equipment. It supports regular key updates and proactive destruction to ensure the security of the key lifecycle. It also supports key backup and recovery to meet the fault redundancy requirements of industrial equipment.

[0013] Preferably, the encapsulation module and the decapsulation module are connected to the parameter configuration module, the key management module, and the communication interface module, respectively, and are used to perform key encapsulation operations and key decapsulation operations, respectively.

[0014] Preferably, the communication interface module enables communication and interaction between the encapsulation system and external devices, adapts to industrial bus protocols, interfaces with the encapsulation module and decapsulation module, realizes the transmission of ciphertext and public key, and ensures continuous communication compatibility.

[0015] Preferably, the security monitoring module is connected to the encapsulation module, decapsulation module, and key management module, and includes an abnormal ciphertext detection unit, a side-channel protection unit, and an attack log recording unit. The abnormal ciphertext detection unit is used to identify invalid ciphertext and tampered ciphertext, trigger the rejection mechanism, and send an alarm signal to the industrial control center. The side-channel protection unit uses techniques such as masking operations, random delays, and noise injection to resist side-channel attacks of the power consumption analysis and timing analysis categories in industrial scenarios. The attack log recording unit is used to record abnormal operations and attack behaviors and stores them in the log server of the industrial control center.

[0016] Therefore, the present invention employs the above-described post-quantum key encapsulation method and system, and the technical effects are as follows: (1) The present invention adopts FO transformation to improve the security level, effectively resist adaptive selection ciphertext attack, adapt to the high security requirements of industrial control system, and resist the attack of malicious attackers to forge control commands and tamper with equipment data.

[0017] (2) The present invention designs a quantitative compression and decompression algorithm, configures compression parameters according to bandwidth requirements, greatly reduces the ciphertext volume, reduces transmission bandwidth occupation, adapts to resource-constrained scenarios such as the Internet of Things, especially adapts to the characteristics of limited industrial bus bandwidth, avoids occupying industrial control bus bandwidth, and ensures smooth transmission of control commands.

[0018] (3) The polynomial ring multiplication method in this invention adopts number theory transformation, which significantly improves the operation speed of key generation, encapsulation and decapsulation, and is compatible with a variety of hardware platforms such as general CPU and MCU. In particular, it is compatible with equipment with limited computing power such as industrial PLC and industrial control terminal, and meets the real-time requirements of industrial control.

[0019] (4) The present invention embeds the public key hash value in the private key and performs ciphertext consistency verification during the decapsulation process, thus doubly preventing private key tampering, ciphertext forgery and replay attacks; it adapts to the security requirements of industrial control systems, avoids attackers from forging control instructions, and ensures that the instructions executed by industrial equipment are real and valid.

[0020] (5) The present invention integrates a side-channel protection unit, which resists common side-channel attacks through masking, randomization and other technologies, and improves the security of the system in actual hardware deployment; it adapts to the operating environment of industrial equipment, avoids key leakage due to side-channel attacks, and ensures the stable operation of industrial control systems. Attached Figure Description

[0021] Figure 1This is a flowchart of a post-quantum key encapsulation method according to the present invention; Figure 2 This is an organizational framework diagram of a post-quantum key encapsulation system according to the present invention. Detailed Implementation

[0022] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0023] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning as understood by one of ordinary skill in the art to which this invention pertains.

[0024] Example 1 like Figure 1 As shown, this invention provides a post-quantum key encapsulation method, which uses modular lattice learning with error MLWE combined with FO transform to achieve IND-CCA2 key negotiation, including three steps: key generation, key encapsulation, and key decapsulation. Specifically, it includes the following steps: S1: Generate a public key pk and a private key sk based on the preset security parameter λ; the security parameter λ corresponds to NIST security levels 1, 3, and 5, respectively, and is adapted to Kyber-512 / Kyber-768 / Kyber-1024 parameter configurations. In combination with the needs of the industrial control system field, this embodiment selects the Kyber-768 parameter configuration (λ=3, NIST security level 3), which balances security and computational efficiency and is adapted to the limited computing resources of industrial equipment. The key generation process in S1 is as follows: S11: Randomly generate seed By using the SHAKE-128 extension function Expand to ,in It samples seeds for private keys; adapts to industrial control system deployment scenarios, integrates side-channel protection in the seed generation process to avoid seed leakage due to the complex operating environment of industrial equipment, and ensures the security of key generation.

[0025] S12: Sampling the seed using the private key Generate a uniform random matrix ,in It is a polynomial ring. For large prime number modulo, this embodiment uses the Kyber-768 configuration. The value is 3329. Let the degree be a polynomial. =256, From a module perspective, =3; The polynomial ring multiplication method is accelerated using NTT, reducing the time complexity from Down to It is compatible with industrial PLCs, industrial control terminals and other devices with limited computing power, ensuring that the key generation speed meets the real-time requirements of industrial control, with a generation time of <50μs.

[0026] S13: From Sampling short vectors in a central binomial distribution or Gaussian distribution Error vector The element values ​​of the short vector and error vector are determined by the security coefficient λ, which ranges from -2 to 2. The sampling process is randomized to ensure the difficulty of the MLWE problem. The sampling process is randomized to resist side-channel attacks in industrial scenarios and prevent the private key from being stolen.

[0027] S14: Accelerated computation via NTT ,in" "" represents matrix-vector multiplication on a polynomial ring; the operation is deployed in the embedded chip of the industrial gateway; it does not require excessive hardware resources, ensuring that it does not affect the normal transmission and execution of industrial control commands.

[0028] S15: Output the key pair, public key Under the Kyber-768 configuration, the public key size is 1184 bytes, and the private key... ,in It uses the SHA3-256 hash function. The public key hash value, Used for subsequent ciphertext consistency verification to prevent private key tampering; adapts to the key management needs of industrial control systems, with private keys stored in the secure sandbox or encrypted storage unit of industrial equipment to avoid private key leakage after physical hijacking of equipment in industrial environments. It also supports regular key updates to adapt to the operation and maintenance cycle of industrial control systems, and it is recommended to update every 3 months to ensure the security of the key lifecycle.

[0029] S2: Obtain the receiver's public key pk, generate ciphertext c and shared symmetric key K; in S2, the sender obtains the receiver's public key. Afterwards, an encapsulation operation is performed to generate ciphertext and a shared symmetric key. In industrial control system scenarios, the sender is typically an industrial control center or industrial gateway, and the receiver is a field PLC, sensor, actuator, or other device. The specific steps are as follows: S21: Generate the initial seed for a random shared symmetric key. ; The generation process takes into account the randomness requirements of industrial control scenarios, avoiding the predictability of seeds due to the periodicity of industrial equipment operation, and ensuring the uniqueness and security of the shared symmetric key.

[0030] S22: By and Generate a seed using SHA3-256 hash derivation. ,based on Sample temporary short vectors from the central binomial distribution. Error vector Error elements The sampling process is adapted to the computing power of industrial equipment, simplifies redundant calculations, and has a sampling time of <10μs; S23: Calculate the ciphertext , ;in, For matrix transpose, For model A half-integer, 1665 in the Kyber-768 configuration, used to send messages. Embedded The encrypted calculation process is optimized to meet the bandwidth requirements of industrial control, avoiding excessive occupation of industrial bus bandwidth and ensuring that the transmission efficiency of industrial control commands is not affected.

[0031] S24: Compress according to preset parameters right and Quantization compression is performed to obtain the compressed ciphertext component. , Output ciphertext The data is 1088 bytes in size and is sent to the field PLC via the Profinet bus. S25: Messages are processed via the key derivation function G. and By performing derivation, a shared symmetric key is obtained. 256 bits For ciphertext The hash value is used to bind the ciphertext to the shared symmetric key, and the output is... ,in As a key for encrypting industrial control data, it is used to encrypt industrial control commands and equipment operation data, ensuring that the data transmission process is not tampered with or leaked.

[0032] S3: Decapsulate the ciphertext c using the private key sk, restoring the shared symmetric key K or returning the rejection symbol ⊥; In S3, after the receiver obtains the ciphertext, it performs the decapsulation operation using the private key, restoring the shared symmetric key. If the ciphertext is invalid, it returns a rejection symbol. The specific steps are as follows: S31: For ciphertext components Perform the decompression operation separately to obtain... and The decompression algorithm is embedded in the chip of industrial equipment, with a decompression time of <10μs, which does not affect the PLC and normal acquisition of power data; S32: Calculation The calculation result is quantized and compressed using a 1-bit method to obtain the recovered message. ,in Short vector of private key The transpose of the algorithm optimizes the calculation process, avoids complex operations, adapts to the lower limit of computing power of industrial equipment, and incorporates an error correction mechanism to resist ciphertext errors caused by electromagnetic interference in the industrial environment. S33: Based on and Re-derived seeds Sampling temporary short vectors Error vector , Reconstructing the ciphertext ,like ,return ;like Execute S4; verification process <15μs. This verification step can effectively resist malicious attacks in industrial scenarios and prevent industrial control equipment from executing malicious commands.

[0033] S4: Derive m' and H(c) through the key derivation function G, and output the final shared symmetric key K=G(m'∥H(c)); In S4, the key derivation function G is used to pair... and The derivation process yields the final shared symmetric key K=G(m'∥H(c)). This final shared symmetric key is temporarily stored in the memory of the industrial equipment and used to decrypt received industrial control commands and equipment operation data. It is destroyed immediately after the session ends to avoid the risk of leakage caused by long-term key storage and to meet the security requirements of industrial control systems.

[0034] S5: Store the private key sk in a secure sandbox or encrypted storage unit of the industrial equipment and update it regularly.

[0035] like Figure 2 As shown, a post-quantum key encapsulation system includes a parameter configuration module, a key management module, an encapsulation module, a decapsulation module, a communication interface module, and a security monitoring module. These modules work together to implement the steps of a post-quantum key encapsulation method.

[0036] The parameter configuration module is used to load the core parameters of the encapsulated system, supports dynamic switching of security levels, and adapts to different application scenarios. The core parameters include security parameters. Modulus parameters polynomial degree Module Dimension Compression parameters Error distribution type, hash or expansion function, key derivation function G; error distribution types include central binomial distribution or Gaussian distribution; configuration according to actual needs. For any item in the set (1,3,5), configure the Kyber-768 parameters in the industrial control system. =3, =3329, =256, =3, , It balances safety and efficiency, and supports switching to Kyber-1024 parameters according to the safety level requirements of industrial scenarios to improve the safety level; parameter configuration can be remotely distributed through the industrial control center, adapting to the centralized management needs of industrial control systems, eliminating the need for manual on-site configuration and reducing operation and maintenance costs.

[0037] The key management module connects with the parameter configuration module to perform key generation, storage, update, and destruction operations. When generating a key, it calls the parameters from the parameter configuration module. For industrial control systems, the private key is stored in the secure sandbox or encrypted storage unit of the industrial equipment. It supports regular key updates and proactive destruction to ensure the security of the key's lifecycle. It also supports key backup and recovery to meet the fault redundancy requirements of industrial equipment and prevent key loss due to equipment failure, which could affect industrial control communication.

[0038] The encapsulation module and the decapsulation module are connected to the parameter configuration module, the key management module, and the communication interface module, respectively, and are used to perform key encapsulation and key decapsulation operations.

[0039] The encapsulation module can be deployed on industrial control center servers or industrial gateways, adapts to industrial hardware architectures, has high computing efficiency (encapsulation time <30μs), and does not affect the real-time transmission of industrial control commands; it outputs the shared symmetric key to the subsequent encryption module for encrypting industrial control data, and sends the ciphertext to the communication interface module, adapting to industrial bus transmission protocols.

[0040] The decapsulation module obtains the ciphertext through the communication interface module, calls the private key from the key management module, executes the above S3 step, and restores the shared symmetric key or returns. For industrial control systems, the decapsulation module can be deployed on field PLCs, sensors, actuators and other industrial control equipment. It is small in size, has low computational load, is compatible with embedded chips, and has a decapsulation time of <40μs. It does not consume too much computing power of the equipment, ensuring that the industrial control equipment can perform data acquisition and control tasks normally. If the restoration is successful, the restored shared symmetric key will be output to the subsequent encryption module for decrypting industrial control data.

[0041] The communication interface module enables communication between the encapsulation system and external devices, supporting communication protocols such as TLS 1.3, MQTT, and TCP / IP. It also adapts to industrial bus protocols, interfacing with the encapsulation and decapsulation modules to achieve the transmission of ciphertext and public keys, ensuring continuous communication compatibility. Targeting the transmission characteristics of industrial control systems, it optimizes the anti-interference capability of the communication link, resisting electromagnetic interference in the industrial environment, ensuring the stability of ciphertext and public key transmission, and preventing key negotiation failures due to transmission errors that could affect industrial control operation.

[0042] The security monitoring module is connected to the encapsulation module, decapsulation module, and key management module, and includes an abnormal ciphertext detection unit, a side-channel protection unit, and an attack log recording unit. The abnormal ciphertext detection unit is used to identify invalid or tampered ciphertext, triggering a rejection mechanism and sending an alarm signal to the industrial control center, facilitating timely attack investigation by maintenance personnel. The side-channel protection unit uses techniques such as masking, random delay, and noise injection to resist side-channel attacks of power consumption analysis and timing analysis types in industrial scenarios, adapting to the operating environment of industrial equipment. The attack log recording unit records abnormal operations and attack behaviors, storing them on the log server of the industrial control center for subsequent auditing and investigation, meeting the security and compliance requirements of the industrial control system.

[0043] Example 2 Deployed in a power industry DCS control system with Kyber-768 parameters, the deployment scenarios include an industrial control center and industrial gateway as the sender, and field PLCs, power sensors, or actuators as the receivers. Key negotiation between the control center and field devices is required to encrypt control commands (such as unit start-up and shutdown, parameter adjustment) and equipment operating data (such as voltage, current, and temperature), resisting quantum attacks and side-channel attacks to ensure the safe and stable operation of the power DCS system. Field PLCs and sensors are resource-constrained devices with <10KB of memory, limited computing power, and limited industrial bus (Profinet) bandwidth; therefore, security, real-time performance, and bandwidth usage must be balanced.

[0044] Parameter configuration: =3, =3329, =256, =3, , The error distribution follows a central binomial distribution. The hash function is SHA3-256, the expansion function is SHAKE-128 / 256, and the key derivation function G is implemented based on SHAKE-256; polynomial ring. It adopts NTT to accelerate polynomial multiplication; it is adapted to the needs of industrial DCS systems, the parameters are remotely configured through the industrial control center, and the key update cycle is set to 3 months.

[0045] The industrial control center, the recipient (field PLC), and the power sensors execute the key generation process: S11: Randomly generate seed via SHAKE-128 Expand to ,in The seed is 256 bits; the generation process uses masking to prevent seed leakage caused by electromagnetic interference in the power industry. S12: By Generate a 3×3 uniform random matrix Each element in the matrix is The polynomials in the data; NTT is used to accelerate polynomial multiplication, ensuring key generation time <50μs, which is suitable for the computing power of the PLC in the field; S13: From the central binomial distribution Medium-sampled short vector Error vector , and The coefficients of each element polynomial range from [-2, 2]; the sampling process employs randomization to resist power consumption analysis attacks; S14: Accelerated computation via NTT The matrix-vector multiplication is based on polynomial ring operations; the operation process is adapted to the embedded chip of PLC and does not consume too much computing power. S15: Calculation Output public key The private key is 1184 bytes in size. The private key is stored in the PLC's security chip, while the private key in the industrial control center is stored in the encrypted storage unit of the security server, which supports regular updates.

[0046] The industrial control center executes the key encapsulation process; S21: Generate random message , as the original seed for the shared symmetric key; S22: Calculation , The public key for the field PLC is obtained via the industrial bus, based on... sampling The sampling distribution is consistent with S13; S23: Calculation ; S24: Yes Obtained by 10-bit quantization compression ,right Obtained by 11-bit quantization compression Output ciphertext It is 1088 bytes in size and is sent to the field PLC via the Profinet bus. It has low bandwidth usage and does not affect the transmission of control commands. S25: Calculation ,pass derived A 256-bit shared symmetric key was obtained. ; Used to encrypt power control commands, which are then sent to the PLC via an industrial bus.

[0047] On-site PLC execution of key decryption process: S31: Obtain ciphertext via Profinet bus ,right , Decompress them separately to get Decompression time <10μs, does not affect the PLC's normal acquisition of power data; S32: Calculation The result is obtained by performing 1-bit quantization compression. An error correction mechanism has been added to resist encrypted errors caused by electromagnetic interference in the industrial environment. S33: Calculation ,sampling , , Reconstruction ;verify and Consistent, confirming the validity of the encrypted text, verification time <15μs; S34: Calculation Output a 256-bit final symmetric shared key. ; It is used to decrypt load adjustment commands sent by the control center to ensure that the commands are authentic and valid. It is also used to encrypt the voltage and current data collected by the PLC and feed it back to the control center.

[0048] After deployment in a power DCS control system, the following performance indicators were tested: key generation time <50μs (PLC end), encapsulation time <30μs (control center end), decapsulation time <40μs (PLC end); public key size 1184 bytes, ciphertext size 1088 bytes, shared key 256 bits; memory usage <10KB, compatible with field PLC devices; in terms of security, it meets the IND-CCA2 security level, resists Shor's quantum algorithm attack, and resists power analysis attack through a side-channel protection mechanism, effectively preventing control commands from being tampered with and device data from being leaked; low bandwidth usage, does not affect the normal communication of the Profinet bus, ensuring the real-time performance and stability of the power DCS system; it can be widely used in industrial control systems such as power, chemical, and metallurgical industries, improving the anti-quantum attack capability of industrial control communication.

[0049] Therefore, the present invention adopts the above-mentioned post-quantum key encapsulation method and system, which is based on the MLWE difficult problem to improve the security level. By optimizing the algorithm design, it improves the computational efficiency, reduces bandwidth occupation, and adds a side channel protection mechanism to solve the problems of weak anti-quantum attack capability, low efficiency and poor adaptability of traditional key encapsulation schemes. It is especially suitable for the deployment needs of industrial control system field and ensures the security and stability of industrial control communication.

[0050] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A post-quantum key encapsulation method, characterized in that, The IND-CCA2 key negotiation is implemented based on lattice learning with error MLWE combined with FO transform, specifically including the following steps: S1: Generate a public key pk and a private key sk based on the preset security parameter λ; S2: Obtain the receiver's public key pk, and generate ciphertext c and shared symmetric key K; S3: Use the private key sk to decrypt the ciphertext c, restore the shared symmetric key K, or return the rejection symbol ⊥; S4: Recover the message m' and ciphertext using the key derivation function G. The hash value H(c) is used to derive the final shared symmetric key K=G(m'∥H(c)); S5: Store the private key sk in a secure sandbox or encrypted storage unit of the industrial equipment and update it regularly.

2. The post-quantum key encapsulation method according to claim 1, characterized in that, The key generation process in S1 is as follows: S11: Randomly generate seed By using the SHAKE-128 extension function Expand to ,in Seed for the private key; S12: Sampling the seed using the private key Generate a uniform random matrix ,in It is a polynomial ring. Modulo a large prime number, Let the degree be the polynomial. From a module perspective; S13: From Sampling short vectors in a central binomial distribution or Gaussian distribution Error vector The range of values ​​for the elements of the short vector and the error vector is determined by the safety factor λ, which ranges from -2 to 2. The sampling process employs randomization. S14: Accelerated computation via NTT ,in" "" represents matrix-vector multiplication over a polynomial ring; the operation is deployed in the embedded chip of the industrial gateway; S15: Output the key pair, public key private key ,in It uses the SHA3-256 hash function. The public key hash value, .

3. The post-quantum key encapsulation method according to claim 2, characterized in that, In S2, the sender obtains the receiver's public key. Then, an encapsulation operation is performed to generate ciphertext and a shared symmetric key. The specific steps are as follows: S21: Generate the initial seed for a random shared symmetric key. ; S22: By and Generate a seed using SHA3-256 hash derivation. ,based on Sample temporary short vectors from the central binomial distribution. Error vector Error elements Sampling time <10μs; S23: Calculate the ciphertext , ;in, For matrix transpose, For model A half-integer, used to represent the message Embedded middle; S24: Compress according to preset parameters right and Quantization compression is performed to obtain the compressed ciphertext component. , Output ciphertext The data is 1088 bytes in size and is sent to the field PLC via the Profinet bus. S25: Messages are processed via the key derivation function G. and By performing derivation, a shared symmetric key is obtained. , For ciphertext The hash value is used to bind the ciphertext to the shared symmetric key, and the output is... ,in Used to encrypt industrial control commands and equipment operation data.

4. The post-quantum key encapsulation method according to claim 3, characterized in that, In S3, after the receiver obtains the ciphertext, it uses its private key to perform a decryption operation, sharing the symmetric key with the receiver. If the ciphertext is invalid, a rejection symbol is returned. The specific steps are as follows: S31: For ciphertext components Perform the decompression operation separately to obtain... and The decompression algorithm is embedded in the chip of industrial equipment, with a decompression time of <10μs, which does not affect the PLC and normal acquisition of power data; S32: Calculation The calculation result is quantized and compressed using a 1-bit method to obtain the recovered message. ,in Short vector of private key The transpose of the text is modified to incorporate an error correction mechanism to resist ciphertext errors caused by electromagnetic interference in the industrial environment. S33: Based on and Re-derived seeds Sampling temporary short vectors Error vector , Reconstructing the ciphertext ,like ,return ;like Execute S4; verification process <15μs.

5. The post-quantum key encapsulation method according to claim 4, characterized in that, In S4, the key derivation function G is used to pair... and The derivation process yields the final shared symmetric key K=G(m'∥H(c)); the final shared symmetric key is temporarily stored in the memory of the industrial equipment and used to decrypt received industrial control commands and equipment operation data, and is destroyed immediately after the session ends.

6. A post-quantum key encapsulation system, characterized in that: It includes a parameter configuration module, a key management module, an encapsulation module, a decapsulation module, a communication interface module, and a security monitoring module. These modules work together to implement the steps of a post-quantum key encapsulation method as described in any one of claims 1-5.

7. A post-quantum key encapsulation system according to claim 6, characterized in that: The parameter configuration module is used to load the core parameters of the encapsulated system, supports dynamic switching of security levels, and adapts to different application scenarios. The core parameters include security parameters. Modulus parameters polynomial degree Module Dimension Compression parameters Error distribution type, hash or expansion function, key derivation function G; error distribution types include central binomial distribution or Gaussian distribution; configuration according to actual needs. For any item in the set (1,3,5), configure the Kyber-768 parameters in the industrial control system. =3, =3329, =256, =3, , ; The key management module is connected to the parameter configuration module and is used to perform key generation, storage, update and destruction operations. When generating a key, the parameters of the parameter configuration module are called. For industrial control systems, the private key is stored in the secure sandbox or encrypted storage unit of the industrial equipment. It supports regular key updates and proactive key destruction to ensure key lifecycle security; it also supports key backup and recovery to meet the fault redundancy requirements of industrial equipment.

8. A post-quantum key encapsulation system according to claim 7, characterized in that: The encapsulation module and the decapsulation module are connected to the parameter configuration module, the key management module, and the communication interface module, respectively, and are used to perform key encapsulation and key decapsulation operations.

9. A post-quantum key encapsulation system according to claim 7, characterized in that: The communication interface module enables communication and interaction between the encapsulation system and external devices, adapts to industrial bus protocols, interfaces with the encapsulation and decapsulation modules, and enables the transmission of encrypted text and public keys, ensuring continuous communication compatibility.

10. A post-quantum key encapsulation system according to claim 7, characterized in that: The security monitoring module is connected to the encapsulation module, decapsulation module and key management module respectively, and includes an abnormal ciphertext detection unit, a side channel protection unit and an attack log recording unit; the abnormal ciphertext detection unit is used to identify invalid ciphertext and tampered ciphertext, trigger the rejection mechanism, and send an alarm signal to the industrial control center at the same time. The side-channel protection unit employs masking operations, random delays, and noise injection techniques to resist side-channel attacks of the power consumption and timing analysis categories in industrial scenarios; the attack log recording unit is used to record abnormal operations and attack behaviors, which are stored in the log server of the industrial control center.

Images