Post quantum cryptography identity authentication system and post quantum cryptography identity authentication method

Abstract

This case relates to a post-quantum cryptographic authentication method. First, a user terminal receives identity verification information. Then, the user terminal uses at least one post-quantum cryptographic algorithm to generate a first public key corresponding to the identity verification information, a first private key corresponding to the first public key, a second public key, and a second private key corresponding to the second public key. Next, the user terminal stores the first and second private keys in a secure key storage unit. Then, the user terminal organizes the identity verification information, the first public key, and the second public key into a registration request message and sends it to an authentication server. Subsequently, the user terminal and the authentication server perform identity authentication using the first public key and the first private key, and execute a key exchange procedure using the second public key and the second private key.

Claims

1. A post-quantum cryptographic authentication system, comprising: a user terminal, including: a user interface module adapted to initiate a registration procedure and receive identity information; and a post-quantum cryptographic operation module electrically coupled to the user interface module, adapted to generate a first public key, a first private key, a second public key, and a second private key corresponding to the identity information, wherein... The first private key corresponds to the first public key, and the second private key corresponds to the second public key; a secure key storage unit, electrically coupled to the post-quantum cryptography module, is adapted to store the first private key and the second private key; a registration request generation module, electrically coupled to the user interface module and the post-quantum cryptography module, is adapted to organize the identity information, the first public key, and the second public key into a registration request message, wherein the post-quantum cryptography module uses the first private key to sign the registration request message to generate a digital signature; a terminal communication module, electrically coupled to the registration request generation module and the post-quantum cryptography module, is adapted to transmit the registration request message and the digital signature externally; and an authentication server, communicatively connected to the user terminal, includes: a request receiving and dispatching module, adapted to receive the registration request message and the digital signature; A post-quantum cryptography verification module, electrically coupled to the request receiving and dispatching module, is adapted to verify the validity of the digital signature using the first public key in the registration request message; a back-end database; and a back-end database interface module, electrically coupled to the post-quantum cryptography verification module and the back-end database, adapted to associate the identity information in the registration request message with the first public key and the second public key when the digital signature verification is valid, and to store the first public key and the second public key in the back-end database; wherein the first public key and the first private key are used for identity authentication, and the second public key and the second private key are used to execute a key exchange procedure to generate a session key.

2. The quantum cryptographic authentication system as described in claim 1, wherein, The user terminal communicates with the authentication server through a secure channel.

3. The quantum cryptographic authentication system as described in claim 2, wherein, This secure channel is an encrypted channel established using the Transport Layer Security (TLS) protocol.

4. The quantum cryptographic authentication system as described in claim 1 further includes a credential issuing authority, communicatively connected to the authentication server, and possessing a signature private key. The authentication server is adapted to submit a credential signing request (CSR) to the credential issuing authority when the digital signature is verified as valid. The credential issuing authority is adapted to issue a digital credential using the signature private key in response to the credential signing request and transmit it to the authentication server, wherein... The credential signing request contains the first public key and the second public key, and the digital credential contains the first public key and the second public key.

5. A quantum cryptographic authentication system as described in claim 4, wherein, The digital certificate is stored in the backend database.

6. A quantum cryptographic authentication system as described in claim 1, wherein, The first public key and the second public key correspond to different subsequent quantum cryptography algorithms.

7. A post-quantum cryptographic authentication method, applicable to a post-quantum cryptographic authentication system, the post-quantum cryptographic authentication system comprising a user terminal and an authentication server, the user terminal comprising a user interface module, a post-quantum cryptographic operation module, a secure key storage unit, a registration request generation module, and a terminal communication module, the authentication server being communicatively connected to the user terminal, and comprising a request receiving and dispatching module, a post-quantum cryptographic verification module, a backend database interface module, and a backend database, the post-quantum cryptographic authentication method comprising: using the user interface module to initiate a registration procedure and receive identity information; using the post-quantum cryptographic operation module to generate a first public key, a first private key, a second public key, and a second private key corresponding to the identity information, wherein... The first private key corresponds to the first public key, and the second private key corresponds to the second public key; the first private key and the second private key are stored using the secure key storage unit; the registration request generation module organizes the identity information, the first public key, and the second public key into a registration request message; the post-quantum cryptography module uses the first private key to sign the registration request message, generating a digital signature; the terminal communication module transmits the registration request message and the digital signature to the authentication server; the request receiving and dispatching module receives the registration request message and the digital signature; the post-quantum cryptography verification module uses the first public key in the registration request message to verify the validity of the digital signature; and the back-end database interface module, when the digital signature verification is valid, associates the identity information in the registration request message with the first public key and the second public key, and stores the first public key and the second public key in the back-end database; The first public key and the first private key are used for identity authentication, and the second public key and the second private key are used to execute a key exchange procedure to generate a session key.

8. The quantum cryptographic authentication method as described in claim 7, wherein, The step of using the terminal communication module to transmit the registration request message and the digital signature to the authentication server includes using the terminal communication module to establish a secure communication connection to the authentication server.

9. The quantum cryptographic authentication method as described in claim 8, wherein, This secure channel is an encrypted channel established using the Transport Layer Security (TLS) protocol.

10. The quantum cryptographic authentication method as described in claim 7, wherein, The post-quantum cryptographic authentication system further includes a credential issuing authority having a signature private key. The post-quantum cryptographic authentication method further includes: using the authentication server, when the digital signature is verified to be valid, submitting a credential signing request (CSR) to the credential issuing authority; and in response to the credential signing request, using the credential issuing authority to issue a digital certificate using the signature private key and transmitting it to the authentication server; wherein the credential signing request includes the first public key and the second public key, and the digital certificate includes the first public key and the second public key.

11. The quantum cryptographic authentication method as described in claim 10 further includes using the backend database interface module to store the digital credential in the backend database.

12. A quantum cryptographic authentication system as described in claim 7, wherein, The first public key and the second public key correspond to different subsequent quantum cryptography algorithms.

13. The quantum cryptographic authentication method as described in claim 7, wherein, The post-quantum cryptography authentication system further includes a server communication module and a session management module. The post-quantum cryptography authentication method further includes: receiving an identity identifier using the user interface module to generate a login request, the login request containing the identity identifier; transmitting the login request to the authentication server using the terminal communication module; receiving the login request using the request receiving and dispatching module; searching the backend database using the backend database interface module based on the identity identifier in the login request; if the first public key and the second public key corresponding to the identity identifier are found, generating a challenge message using the post-quantum cryptography verification module, the challenge message containing a challenge value; transmitting the challenge message to the user terminal using the server communication module; receiving the challenge message using the terminal communication module, and reading the first private key from the secure key storage unit using the post-quantum cryptography computation module. Using the post-quantum cryptography module, the challenge message is signed using the first private key to generate a digital signature; using the user terminal, the digital signature is transmitted to the authentication server as an authentication response; using the post-quantum cryptography verification module, the validity of the digital signature for the challenge message is verified using the first public key corresponding to the identity identifier; and if the digital signature is valid for the challenge message, an authentication session is established using the session management module.

14. The quantum cryptographic authentication method as described in claim 13, wherein, If the digital signature is valid for the challenge message, the steps of establishing the authentication session using the session management module further include: using the second public key and the second private key to initiate the key exchange procedure to generate the session key.

15. The quantum cryptographic authentication method as described in claim 14, wherein, The steps of initiating the key exchange procedure using the second public key and the second private key to generate the session key include: using the post-quantum cryptography verification module, using the second public key to generate a shared secret and a ciphertext corresponding to the shared secret; using the authentication server to transmit the ciphertext to the user terminal; using the post-quantum cryptography operation module, using the second private key to decapsulate the ciphertext; and if the decapsulation is successful, the user terminal and the authentication server generate the session key based on the shared secret.

16. A post-quantum cryptographic authentication method, applicable to a post-quantum cryptographic authentication system, the post-quantum cryptographic authentication system comprising a user terminal and an authentication server, the post-quantum cryptographic authentication method comprising: the user terminal receiving identity information; the user terminal generating, using at least one post-quantum cryptographic algorithm, a first public key, a first private key, a second public key, and a second private key corresponding to the identity information, wherein... The first private key corresponds to the first public key, and the second private key corresponds to the second public key; the user terminal stores the first private key and the second private key in a secure key storage unit; the user terminal organizes the identity information, the first public key, and the second public key into a registration request message and sends it to the authentication server for registration; and the user terminal and the authentication server use the first public key and the first private key to perform identity authentication, and use the second public key and the second private key to execute a key exchange procedure to generate a session key.

Images