Information verification method and related device

Abstract

An information verification method, applied to a terminal, and comprising: generating a random number, and encrypting same on the basis of a post-quantum public key to determine an encrypted random number; determining a session key on the basis of a first shared key and the random number, wherein the first shared key is determined on the basis of a server public key and a terminal public key; determining encrypted signaling data on the basis of the session key and the signaling data; and sending a signaling packet to a server, so that the server verifies the signaling packet, wherein the signaling packet comprises the encrypted signaling data and the encrypted random number.

Description

Information verification method and related device

[0001] The present disclosure is based on and claims priority to Chinese Patent Application No. 202410594835.8, filed on May 14, 2024, entitled “Information verification method and related device”, the entire contents of which are incorporated herein by reference. TECHNICAL FIELD

[0002] The present disclosure relates to the field of information security, and in particular, to an information verification method and related device. BACKGROUND

[0003] The rapidly developing Internet has brought great convenience to people's life and work. People can send and receive emails, make phone calls, shop online, and transfer money through the Internet. At the same time, network information security has gradually become a potential huge problem. Generally speaking, network information faces the following security risks: network information is stolen, information is tampered with, attackers impersonate information, and malicious destruction, etc. Among them, information verification is one of the means to protect people's network information, which can ensure the security of the system and data, and the legitimate interests of authorized access. At present, information verification mainly relies on password technology. In the field of cryptography today, there are mainly two kinds of password systems. One is the symmetric key password system, that is, the encryption key and the decryption key use the same key. The other is the public key password system, that is, the encryption key and the decryption key are different, and one of them can be public. Most of the information verification algorithms currently used mainly rely on the public key password system.

[0004] However, with the development of quantum computers, classical asymmetric key encryption algorithms will no longer be secure. Whether it is encryption and decryption or key exchange method, quantum computers can calculate the private key through the public key, so the commonly used asymmetric key will become vulnerable in the quantum era. Therefore, it is difficult to guarantee the security of the information verification process by relying solely on asymmetric algorithms. SUMMARY

[0005] The present disclosure provides an information verification method and related device, which at least partially solves the problem that the asymmetric algorithm in the related art cannot guarantee the security of the information verification process.

[0006] According to one aspect of the present disclosure, a method for information verification is provided, applied to a terminal, comprising: generating a random number, and encrypting the random number according to a quantum-resistant public key to determine an encrypted random number; determining a session key according to a first shared key and the random number, wherein the first shared key is determined according to a server public key and a terminal public key; determining encrypted signaling data according to the session key and signaling data; and sending a signaling message to a server for verification by the server, wherein the signaling message comprises the encrypted signaling data and the encrypted random number.

[0007] In some embodiments, before the generating a random number, and encrypting the random number according to a quantum-resistant public key to determine an encrypted random number, the method further comprises: determining a first shared key according to the server public key and the terminal public key; encrypting user login information according to the first shared key to determine encrypted user login information; and sending the encrypted user login information and the terminal public key to the server for user registration.

[0008] In some embodiments, the signaling message further comprises the terminal login information and a hash message authentication code, wherein the hash message authentication code is generated according to the session key.

[0009] According to one aspect of the present disclosure, a method for information verification is provided, applied to a terminal, comprising: generating a random number, and encrypting the random number according to a quantum-resistant public key to determine an encrypted random number; determining a session key according to a first shared key and the random number, wherein the first shared key is determined according to a server public key and a terminal public key; determining encrypted signaling data according to the session key and signaling data; and sending a signaling message to a server for verification by the server, wherein the signaling message comprises the encrypted signaling data and the encrypted random number.

[0010] In some embodiments, the signaling message further comprises the terminal login information and a hash message authentication code, wherein the hash message authentication code is generated according to the session key; and before the decrypting the encrypted signaling data according to the session key, the method further comprises: verifying the hash message authentication code according to the session key; and if the verification is passed, decrypting the encrypted signaling data according to the session key.

[0011] According to one aspect of the present disclosure, an information verification apparatus applied to a terminal is provided, comprising: an encrypted random number determining module configured to generate a random number, and encrypt the random number according to an anti-quantum public key to determine an encrypted random number; a first session key determining module configured to determine a session key according to a first shared key and the random number, wherein the first shared key is determined according to a server public key and a terminal public key; an encrypted signaling data determining module configured to determine encrypted signaling data according to the session key and signaling data; and a signaling message sending module configured to send a signaling message to a server, so that the server verifies the signaling message, wherein the signaling message comprises the encrypted signaling data and the encrypted random number.

[0012] According to one aspect of the present disclosure, an information verification apparatus applied to a server is provided, comprising: a signaling message obtaining module configured to obtain a signaling message sent by a terminal, wherein the signaling message comprises encrypted random number and encrypted signaling data; a random number determining module configured to decrypt the encrypted random number according to an anti-quantum private key to determine a random number; a second session key determining module configured to determine a session key according to a first shared key and the random number, wherein the first shared key is determined according to a server public key and a terminal public key; and a signaling data decrypting module configured to decrypt the encrypted signaling data according to the session key.

[0013] According to one aspect of the present disclosure, an information verification system is provided, comprising: a terminal generating a random number, and encrypting the random number according to an anti-quantum public key to determine an encrypted random number; the terminal determining a session key according to a first shared key and the random number, wherein the first shared key is determined according to a server public key and a terminal public key; the terminal determining encrypted signaling data according to the session key and signaling data; the terminal sending a signaling message to a server, wherein the signaling message comprises the encrypted signaling data and the encrypted random number; the server obtaining the signaling message sent by the terminal; the server decrypting the encrypted random number according to an anti-quantum private key to determine a random number; the server determining a session key according to the first shared key and the random number; and the server decrypting the encrypted signaling data according to the session key.

[0014] According to another aspect of the present disclosure, an electronic device is also provided, comprising: a processor; and a memory configured to store executable instructions of the processor; wherein the processor is configured to execute the information verification method according to any one of the above aspects via executing the executable instructions.

[0015] According to another aspect of the present disclosure, a computer readable storage medium having a computer program stored thereon is also provided, wherein the computer program is executed by a processor to implement the information verification method according to any one of the above aspects.

[0016] According to another aspect of the present disclosure, there is also provided a computer program product comprising a computer program which, when executed by a processor, implements the information verification method of any one of the above.

[0017] The present disclosure can resist quantum computing attacks and ensure information security by operating the key generated by a conventional key agreement algorithm and the key encapsulated by a quantum-resistant algorithm.

[0018] The particular embodiments of the application will be described in detail in the following description with reference to the accompanying drawings. The description is made in relation to the drawings, but the application is not limited to the embodiments shown. The embodiments of the application include many alternatives, modifications and equivalents. It is to be understood that the application includes all such alternatives, modifications and equivalents. Various specific details are set forth in the description to provide a thorough understanding of the application. However, the application can be practiced without these specific details. In other instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

[0019] Features described and / or illustrated with respect to one implementation can be used in the same or similar manner in one or more other implementations, in combination with or in place of features in the other implementations.

[0020] It should be emphasized that the term comprises / comprising, when used in this specification, is taken to specify the presence of stated features, integers, steps or components but does not preclude the presence or addition of one or more other features, integers, steps, components or groups thereof. BRIEF DESCRIPTION OF DRAWINGS

[0021] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate embodiments consistent with the present disclosure and, together with the description, further serve to explain the principles behind the present disclosure. It is to be expressly understood that the drawings are included solely for purposes of illustration and are not to be construed as a limitation of the present disclosure. It is to be expressly understood that the drawings are included solely for purposes of illustration and are not to be construed as a limitation of the present disclosure. Other drawings can be derived from these drawings by a person of ordinary skill in the art without paying creative effort.

[0022] FIG. 1 shows a schematic diagram of an information verification system structure according to an embodiment of the present disclosure;

[0023] FIG. 2 shows a flowchart of an information verification method applied to a terminal according to an embodiment of the present disclosure;

[0024] FIG. 3 shows a flowchart of a specific example of an information verification method applied to a terminal according to an embodiment of the present disclosure;

[0025] FIG. 4 shows a flowchart of an information verification method applied to a server according to an embodiment of the present disclosure;

[0026] FIG. 5 shows a flowchart of a specific example of an information verification method applied to a server according to an embodiment of the present disclosure;

[0027] FIG. 6 shows a flowchart of a method for information verification between a terminal and a server according to an embodiment of the present disclosure;

[0028] FIG. 7 shows a schematic diagram of an information verification device for a terminal according to an embodiment of the present disclosure;

[0029] FIG. 8 shows a schematic diagram of an information verification device for a server according to an embodiment of the present disclosure;

[0030] FIG. 9 shows a structural block diagram of a computer device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0031] Example implementations will now be described more fully with reference to the accompanying drawings. Example implementations may, however, be implemented in many different forms and should not be construed as limited to the implementations set forth herein; rather, these implementations are provided so that this disclosure will be thorough and complete, and will fully convey the scope of example implementations to those skilled in the art. Features described in the description, examples, or claims that are not essential to the understanding of the application are not limitations of the application.

[0032] In addition, the drawings are to be considered in all respects as illustrative and not restrictive; identical reference numerals have been used, where possible, to denote identical or similar features, and thus repetition of the description thereof will be omitted. Some of the blocks in the drawings are functional blocks that do not necessarily have to be implemented with physical or logical entities. These functional blocks can be implemented with software, or with one or more hardware modules or integrated circuits, or with different network and / or processor devices and / or microcontroller devices.

[0033] For ease of understanding, before introducing the embodiments of the present disclosure, first, several terms involved in the embodiments of the present disclosure are explained as follows:

[0034] Post-Quantum cryptography: PQC, anti-quantum cryptography;

[0035] Hash-based Message Authentication Code: Hmac, hash operation message authentication code.

[0036] The specific embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0037] FIG. 1 shows a schematic diagram of an exemplary application system architecture to which the information verification method according to the embodiments of the present disclosure can be applied. As shown in FIG. 1, the system architecture can include a terminal device 101, a network 102, and a server 103.

[0038] The medium used by the network 102 to provide a communication link between the terminal device 101 and the server 103 can be a wired network or a wireless network.

[0039] Optionally, the wireless network or wired network described above uses standard communication technologies and / or protocols. The network is usually the Internet, but can also be any network, including but not limited to a Local Area Network (LAN), a Metropolitan Area Network (MAN), a Wide Area Network (WAN), a mobile, wired or wireless network, a private network or any combination of virtual private networks). In some embodiments, technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. are used to represent data exchanged through the network. In addition, all or some links can be encrypted using conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPSec), etc. In other embodiments, custom and / or dedicated data communication technologies can be used instead of or in addition to the above data communication technologies.

[0040] The terminal device 101 can be various electronic devices, including but not limited to a smartphone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, a wearable device, an augmented reality device, a virtual reality device, etc.

[0041] Optionally, the clients of the application programs installed in different terminal devices 101 are the same, or the clients of the same type of application programs based on different operating systems. Based on the difference of the terminal platform, the specific form of the client of the application program can also be different, for example, the application program client can be a mobile phone client, a PC client, etc.

[0042] The server 103 can be a server that provides various services, for example, a background management server that provides support for the device operated by the user using the terminal device 101. The background management server can analyze and process the received request data, etc., and feed back the processing result to the terminal device.

[0043] Optionally, the server can be a standalone physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and basic cloud computing services such as big data and artificial intelligence platforms.

[0044] In one embodiment of the present disclosure, the terminal generates a random number, encrypts the random number according to the anti-quantum public key, and determines an encrypted random number; the terminal determines a session key according to the first shared key and the random number, wherein the first shared key is determined according to the service end public key and the terminal public key; the terminal determines encrypted signaling data according to the session key and the signaling data; the terminal sends a signaling message to the service end, wherein the signaling message includes the encrypted signaling data and the encrypted random number; the service end acquires the signaling message sent by the terminal; the service end decrypts the encrypted random number according to the anti-quantum private key, and determines the random number; the service end determines the session key according to the first shared key and the random number; and the service end decrypts the encrypted signaling data according to the session key.

[0045] Those skilled in the art can know that the number of terminal devices, networks and servers in FIG. 1 is only illustrative, and any number of terminal devices, networks and servers can be provided according to actual needs. The present disclosure does not limit this.

[0046] FIG. 2 shows a flowchart of an information verification method applied to a terminal in an embodiment of the present disclosure. As shown in FIG. 2, the information verification method applied to a terminal provided in the present embodiment includes the following steps:

[0047] S202, a random number is generated, and the random number is encrypted according to an anti-quantum public key to determine an encrypted random number.

[0048] It should be noted that the above random number can be a number with randomness and unpredictability within a certain range. For example, the number generated later has nothing to do with the number generated before. In the encryption algorithm, the random number can be used to generate a key, an initialization vector, and other key parameters to ensure the security of the encryption process. For example, in secure communication, the random number plays a key role in the key exchange and protocol handshake process; in the cryptographic hash function, the hash function maps the random number input of any length to the output of a fixed length, has anti-collision property and irreversibility, and in the scenarios of encrypted storage and digital signature, the hash function and the random number together ensure the security of the data. The random number can be generated by a random password generator, for example, a true random number generator, which can ensure that the generated random number has high randomness and unpredictability.

[0049] The above anti-quantum can be an anti-quantum password, also known as a post-quantum password, which is a new generation of password algorithm capable of resisting quantum computing attacks on existing password algorithms, and can ensure the security of the password algorithm in a quantum environment. The main research object of PQC is asymmetric password algorithm, which can run on a classical computer but cannot be cracked using a quantum computer. The PQC algorithms published for standardization at present include public key encryption and key exchange algorithm (CRYSTALS-KYBER) and digital signature algorithm (CRYSTALS-Dilithium, FALCON, SPHINCS+).

[0050] The above public key can be the non-secret half of a key pair, which can be used to encrypt information. Specifically, the public key and the private key are a key pair (i.e., a public key and a private key) obtained through an algorithm, one of which is publicly disclosed and called a public key; the other is kept by oneself and called a private key. The key pair obtained through this algorithm can ensure that it is unique in the world. When using this key pair, if one of the keys is used to encrypt a piece of data, the other key must be used to decrypt it, i.e., if the public key is used to encrypt the data, the private key must be used to decrypt it, and if the private key is used to encrypt it, the public key must be used to decrypt it, otherwise the decryption will not be successful.

[0051] For example, the terminal generates a random number and encrypts it using the platform (server) Kyber public key.

[0052] S204, determining a session key according to the first shared key and the random number, wherein the first shared key is determined according to the server public key and the terminal public key.

[0053] It should be noted that the above-mentioned method of determining the session key can be XOR, splicing, alternating merging, transposition rearrangement, etc.

[0054] For example, the terminal generates a terminal public key, calculates a first shared key through a key agreement algorithm, and performs an XOR operation on the first shared key and the random number to generate a session key.

[0055] S206, determining encrypted signaling data according to the session key and the signaling data.

[0056] For example, the signaling data is encrypted according to the session key to obtain encrypted signaling data.

[0057] S208, sending the signaling message to the server for verification, wherein the signaling message includes encrypted signaling data and encrypted random number.

[0058] It should be noted that the above-mentioned verification of the signaling message by the server is a process of decrypting the encrypted data in the signaling message and comparing it with the pre-stored data.

[0059] The present disclosure can resist quantum computing attacks and ensure information security by operating the key generated by a traditional key agreement algorithm and the key encapsulated by a quantum-resistant algorithm.

[0060] In one embodiment of the present disclosure, as shown in FIG. 3, the information verification method provided in the embodiment of the present disclosure can register the terminal on the server by the following steps before generating a random number, encrypting the random number according to a quantum-resistant public key, and determining the encrypted random number, so that the server verifies the login information of the user in the future:

[0061] S302, determining a first shared key according to the public key of the server and the public key of the terminal;

[0062] S304, encrypting the login information of the user according to the first shared key to determine the encrypted login information of the user;

[0063] S306, sending the encrypted login information of the user and the public key of the terminal to the server for user registration.

[0064] It should be noted that the login information of the user includes user account password information. The encrypted login information of the user corresponds to the public key of the terminal one-to-one.

[0065] In one example of the present disclosure, the signaling message further includes terminal login information and a hash message authentication code, wherein the hash message authentication code is generated according to the session key.

[0066] FIG. 4 shows a flowchart of an information verification method applied to a server in an embodiment of the present disclosure. As shown in FIG. 4, the information verification method applied to the server provided in the embodiment of the present disclosure includes the following steps:

[0067] S402, obtaining the signaling message sent by the terminal, wherein the signaling message includes an encrypted random number and encrypted signaling data.

[0068] It should be noted that the encrypted random number is an encrypted random number determined by the terminal generating a random number and encrypting the random number according to a quantum-resistant public key. The encrypted signaling data is encrypted signaling data determined by the terminal according to a session key and signaling data, wherein the session key is determined (XOR, splicing, alternating merging, transposition rearrangement) according to a first shared key and a random number, and the first shared key is determined according to the public key of the server and the public key of the terminal.

[0069] S404, decrypting the encrypted random number according to a quantum-resistant private key to determine the random number.

[0070] It should be noted that the above anti-quantum can be anti-quantum cryptography, also known as post-quantum cryptography, which is a new generation of cryptographic algorithm capable of resisting quantum computing attacks on existing cryptographic algorithms, and can ensure the security of the cryptographic algorithm in a quantum environment. The main research object of PQC is asymmetric cryptographic algorithm, which can run on a classical computer but cannot be cracked using a quantum computer. The above private key can be the secret half of the key pair, which can be used to encrypt information.

[0071] Specifically, the anti-quantum encryption algorithm is deployed on the server, and the anti-quantum public key is disclosed to the outside world; the anti-quantum private key is retained by the server, and the key pair obtained through this algorithm can ensure that it is unique in the world. When using this key pair, if one of the keys is used to encrypt a piece of data, the other key must be used to decrypt it, i.e., if the public key is used to encrypt the data, the private key must be used to decrypt it, and if the private key is used to encrypt it, the public key must be used to decrypt it, otherwise the decryption will not be successful.

[0072] For example, the encrypted random number is decrypted using the Kyber private key of the server to obtain the random number.

[0073] S406, determining a session key according to the first shared key and the random number, wherein the first shared key is determined according to the server public key and the terminal public key.

[0074] For example, the server constructs a first shared key according to the client public key through a key agreement algorithm, and generates a session key by performing an exclusive or operation on the first shared key and the random number.

[0075] S408, decrypting the encrypted signaling data according to the session key.

[0076] For example, the server decrypts the signaling plaintext data using the session key, and performs subsequent data security communication based on the session key.

[0077] The application processes the key generated by the traditional key agreement algorithm and the key encapsulated by the anti-quantum algorithm, which can resist quantum computing attacks and ensure the security of information.

[0078] In one embodiment of the present disclosure, as shown in FIG. 5, the signaling message in the information verification method provided in the embodiment of the present disclosure further includes terminal login information and a hash message authentication code, wherein the hash message authentication code is generated according to the session key. Before decrypting the encrypted signaling data according to the session key, the present disclosure can verify the user's login information securely through the following steps:

[0079] S502, verifying the hash message authentication code according to the session key;

[0080] S504, if the verification is passed, decrypting the encrypted signaling data according to the session key.

[0081] In one example of the present disclosure, the server finds the terminal public key according to the user account.

[0082] FIG. 6 shows a flowchart of an information verification method between a terminal and a server according to an embodiment of the present disclosure. As shown in FIG. 6, the information verification method between the terminal and the server according to an embodiment of the present disclosure includes the following steps:

[0083] S601, installing an application client on the terminal and completing initialization, configuring a server (management and control platform) public key and a Kyber public key (or transmitting the public key information through a network);

[0084] S602, the terminal generates a terminal public key, calculates a shared key K1 (equivalent to the first shared key described above) through a key agreement algorithm, encrypts user account password information using K1, and uploads the encrypted account password information and the client public key to the server, completing device registration;

[0085] S603, the server stores the terminal public key, calculates a shared key K1 according to the terminal public key and the server public key, and decrypts and stores the account password information;

[0086] S604, the terminal generates a random number K2, encrypts it using the server Kyber public key, calculates a session key K = K1 ⊕ K2, encrypts signaling data using K, sends a signaling message, and the signaling message contains a user account, signaling ciphertext, K2 ciphertext, and verification information (Hmac) generated using K;

[0087] S605, the server finds the terminal public key according to the user account, constructs a shared key K1 through a key agreement algorithm, decrypts the random number K2 using the platform Kyber private key, calculates a session key K = K1 ⊕ K2, and verifies the message authentication code using K;

[0088] S606, if the verification is passed, the signaling plaintext data is decrypted using K, and subsequent data security communication is carried out based on K, and if the verification is not passed, the session is terminated.

[0089] Among them, S601-S603 are device registration, and S604-S606 are signaling communication.

[0090] It should be noted that if the server public key is distributed in a preset form, the key K1 generated by the key agreement algorithm each time is unchanged, and there is a risk of replay attack. After adding the PQC algorithm, a random number K2 is generated each time the signaling communication is performed, so as to ensure the randomness of the session key K (K1 ^ K2) each time. The symbol "^" represents the XOR operation, and the operation rules are as follows: 0 ^ 0 = 0, 0 ^ 1 = 1, 1 ^ 0 = 1, and 1 ^ 1 = 0.

[0091] The traditional password algorithm used in the login registration of the user can be accelerated by the quantum computer to crack the underlying mathematical difficult problem, the security of the algorithm itself is seriously threatened, and then the security of the login registration process is affected.

[0092] The present disclosure uses the anti-quantum key packaging algorithm (for example, CRYSTALS-Kyber) that can resist quantum computing to combine with the traditional key agreement algorithm, so as to improve the anti-quantum security of the information exchange process in the registration and login process of the communication parties.

[0093] The present disclosure focuses on the registration and login process of the terminal to the platform, and the traditional key agreement algorithm (DH) is used in the login process. On the basis of the original registration and login process, the PQC algorithm is added to enhance the anti-quantum security capability. The terminal side configures the PQC public key of the platform, and encrypts the random number K2 by using the public key.

[0094] It should be noted that the Kyber algorithm is used as an example in the present disclosure, and the specific PQC key agreement algorithm can be selected according to the system requirements.

[0095] Based on the same inventive concept, the present disclosure also provides an information verification device applied to a terminal, as described in the following embodiments. Since the principle of solving the problem of the device embodiment is similar to that of the above-mentioned method embodiment, the implementation of the device embodiment can be referred to the implementation of the above-mentioned method embodiment, and the repeated parts will not be described here.

[0096] FIG. 7 shows a schematic diagram of an information verification device applied to a terminal in an embodiment of the present disclosure, as shown in FIG. 7, the device comprises an encrypted random number determination module 71, a session key first determination module 72, an encrypted signaling data determination module 73, a signaling message sending module 74, a first shared key determination module 75, a login information encryption module 76, and a registration module 77.

[0097] The encrypted random number determination module 71 is configured to generate a random number, and encrypt the random number according to the anti-quantum public key to determine the encrypted random number.

[0098] The session key first determination module 72 is configured to determine a session key according to the first shared key and the random number, wherein the first shared key is determined according to the server public key and the terminal public key.

[0099] The encrypted signaling data determination module 73 is configured to determine encrypted signaling data according to the session key and the signaling data.

[0100] The signaling message sending module 74 is configured to send the signaling message to the server for verification, wherein the signaling message comprises the encrypted signaling data and the encrypted random number.

[0101] In an example of the present disclosure, the information verification device applied to the terminal further comprises a first shared key determination module 75 configured to determine a first shared key according to the server public key and the terminal public key.

[0102] In an example of the present disclosure, the information verification device applied to the terminal further comprises a login information encryption module 76 configured to encrypt the login information of the user according to the first shared key to determine encrypted login information of the user.

[0103] In an example of the present disclosure, the information verification device applied to the terminal further comprises a registration module 77 configured to send the encrypted login information of the user and the terminal public key to the server for user registration.

[0104] It should be noted that the encrypted random number determination module 71, the session key first determination module 72, the encrypted signaling data determination module 73, and the signaling message sending module 74 correspond to S202-S208 in the method embodiment, and the modules and the corresponding steps have the same examples and application scenarios, but are not limited to the contents disclosed in the above method embodiment. It should be noted that the modules as part of the device can be executed in a computer system such as a group of computer executable instructions.

[0105] FIG. 8 shows a schematic diagram of an information verification device applied to a server in an embodiment of the present disclosure. As shown in FIG. 8, the device comprises a signaling message obtaining module 81, a random number determination module 82, a session key second determination module 83, a signaling data decryption module 84, and a hash message authentication code verification module 85.

[0106] The signaling message obtaining module 81 is configured to obtain the signaling message sent by the terminal, wherein the signaling message comprises encrypted random number and encrypted signaling data.

[0107] The random number determination module 82 is configured to decrypt the encrypted random number according to the anti-quantum private key to determine the random number.

[0108] The session key second determination module 83 is configured to determine a session key according to the first shared key and the random number, wherein the first shared key is determined according to the server public key and the terminal public key.

[0109] The signaling data decryption module 84 is configured to decrypt the encrypted signaling data according to the session key.

[0110] In one example of the present disclosure, the information verification device applied to the server further includes a hash message authentication code verification module 85 configured to verify a hash message authentication code according to the session key.

[0111] It should be noted that the signaling message obtaining module 81, the random number determination module 82, the session key second determination module 83, and the signaling data decryption module 84 correspond to S402-S408 in the method embodiment, and the above modules have the same examples and application scenarios as the corresponding steps, but are not limited to the content disclosed in the above method embodiment. It should be noted that the above modules as part of the device can be executed in a computer system such as a group of computer executable instructions.

[0112] Those skilled in the art can understand that each aspect of the present disclosure can be implemented as a system, a method or a program product. Therefore, each aspect of the present disclosure can be embodied as a complete hardware embodiment, a complete software embodiment (including firmware, microcode, etc.), or an embodiment combining hardware and software aspects, which can be collectively referred to as "circuitry", "module" or "system" herein.

[0113] The electronic device 900 according to this embodiment of the present disclosure will be described below with reference to FIG. 9. FIG. 9 shows only one example of the electronic device 900, and should not impose any limitation on the functions and use range of the embodiments of the present disclosure.

[0114] As shown in FIG. 9, the electronic device 900 is in the form of a general computing device. The components of the electronic device 900 can include, but are not limited to, the above-mentioned at least one processing unit 910, the above-mentioned at least one storage unit 920, and a bus 930 connecting different system components, including the storage unit 920 and the processing unit 910.

[0115] The storage unit stores program codes which can be executed by the processing unit 910, so that the processing unit 910 performs the steps according to various exemplary embodiments of the present disclosure described in the above "Exemplary Method" section of the present specification.

[0116] For example, the processing unit 910 can perform the following steps of the above method embodiment:

[0117] generating a random number, and encrypting the random number according to the anti-quantum public key to determine encrypted random number;

[0118] determining a session key according to the first shared key and the random number, wherein the first shared key is determined according to the service end public key and the terminal public key;

[0119] determining encrypted signaling data according to the session key and the signaling data;

[0120] sending the signaling message to the service end to enable the service end to verify the signaling message, wherein the signaling message comprises the encrypted signaling data and the encrypted random number.

[0121] For example, the processing unit 910 can perform the following steps of the above method embodiments:

[0122] determining a first shared key according to the service end public key and the terminal public key;

[0123] encrypting the login information of the user according to the first shared key to determine encrypted login information of the user;

[0124] sending the encrypted login information of the user and the terminal public key to the service end for user registration.

[0125] For example, the processing unit 910 can perform the following steps of the above method embodiments:

[0126] obtaining a signaling message sent by a terminal, wherein the signaling message comprises encrypted random number and encrypted signaling data;

[0127] decrypting the encrypted random number according to the anti-quantum private key to determine the random number;

[0128] determining a session key according to the first shared key and the random number, wherein the first shared key is determined according to the service end public key and the terminal public key;

[0129] decrypting the encrypted signaling data according to the session key.

[0130] For example, the processing unit 910 can perform the following steps of the above method embodiments:

[0131] verifying the hash message authentication code according to the session key;

[0132] if the verification is passed, decrypting the encrypted signaling data according to the session key, wherein the signaling message further comprises terminal login information and the hash message authentication code, wherein the hash message authentication code is generated according to the session key.

[0133] The storage unit 920 can include a readable medium in the form of volatile storage such as random access memory (RAM) 9201 and / or cache memory 9202, and also include a non-volatile storage such as read only memory (ROM) 9203.

[0134] The storage unit 920 can also include a program / utility 9204 having a set of program modules 9205 such as an operating system, one or more application programs, other program modules, and program data, each of which can give the electronic device 900 its functionality, at least in part. The program modules 9205 can include, but are not limited to, a network environment implementation, either alone or in some combination.

[0135] The bus 930 can represent one or more of several types of bus structures, including a storage bus or bus for storage controller, a peripheral bus, an accelerated graphics port, a processor or local bus using any of a variety of bus architectures.

[0136] The electronic device 900 can also communicate with one or more external devices 940 such as a keyboard or pointing device, a Bluetooth device, etc.; other devices such as a storage device or an external effects device, and / or to other devices such as a router, a modem, a printer, etc. The communication can occur via an input / output (I / O) interface 950. Still yet, the electronic device 900 can communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), and / or a public network such as the Internet, via a network adapter 960. As depicted, the network adapter 960 can communicate with the other components of the electronic device 900 via the bus 930. It should be appreciated that the network adapter 960 and / or the other hardware and / or software components depicted in FIG. 9 can be utilized in conjunction with the electronic device 900, although they are not explicitly shown. For example, a software or hardware module such as a microcode, a device driver, a redundant processing unit, an external disk drive array, a RAID system, a tape drive, and data archival storage system, etc. can be utilized with the electronic device 900.

[0137] From the above description of the embodiments, those skilled in the art will readily perceive that the example embodiments described herein can be implemented by software and / or by hardware coupled with software. Accordingly, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash disk, a mobile hard disk, etc.) or a network, and includes a number of instructions to cause a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to perform the methods according to the embodiments of the present disclosure.

[0138] In particular, according to the embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer program product, which includes: a computer program, which, when executed by a processor, implements the above information verification method.

[0139] In the exemplary embodiments of the present disclosure, a computer readable storage medium is also provided, which can be a readable signal medium or a readable storage medium. A program product capable of implementing the above method of the present disclosure is stored thereon. In some possible implementations, various aspects of the present disclosure can also be implemented in the form of a program product, which includes program codes for causing terminal equipment to perform the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of the specification when the program product is run on the terminal equipment.

[0140] More specific examples of the computer readable storage medium in the present disclosure can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0141] In the present disclosure, the computer readable storage medium can include a data signal carried in the baseband or as part of a carrier wave, in which readable program codes are borne. Such a propagated data signal can take various forms, including but not limited to electro-magnetic signal, optical signal or any suitable combination of the foregoing. The readable signal medium can also be any readable medium other than the readable storage medium, which can send, propagate or transmit programs for use by or in connection with an instruction execution system, apparatus or device.

[0142] Optionally, the program codes contained on the computer readable storage medium can be transmitted by any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0143] In particular embodiments, the program code utilized by the program code instructions can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++, or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computing device, partly on the user's computing device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider. The application programming interface (API) server can be used to facilitate the communication between the client and the server.

[0144] It should be noted that, although several modules or units of the devices for action execution are mentioned in the foregoing detailed description, such division is not mandatory. Indeed, features and functionalities of two or more modules or units described above can be embodied in one module or unit according to embodiments of the present disclosure. Conversely, features and functionalities of one module or unit described above can be further divided into multiple modules or units.

[0145] Furthermore, although the various steps of the methods in the present disclosure are described in a particular order in the drawings, this is not required or implied as to the order of execution of the steps, nor is it required that all of the steps be executed to achieve the desired result. Additionally or alternatively, certain steps can be omitted, multiple steps can be combined into one step, one step can be broken into multiple steps, etc.

[0146] From the above description of the embodiments, those skilled in the art will readily perceive that the example embodiments described herein can be implemented by software and / or by hardware and / or by a combination of software and hardware. Accordingly, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium, such as a CD-ROM, a USB flash drive, a mobile hard disk, or the like, or on a network, and includes a number of instructions for causing a computing device (such as a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the methods according to the embodiments of the present disclosure.

[0147] Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the features disclosed herein. It is intended that the disclosure be construed as including any patents, patent applications, publications, publications, or other disclosure of complementary subject matter that is within the scope of the disclosure. It is intended that the specification and examples be considered exemplary only, with the true scope and spirit of the disclosure being indicated by the following claims.

Claims

1. An information verification method characterized by comprising: Applied to a terminal, comprising: generating a random number, and encrypting according to the anti-quantum public key to determine the encrypted random number; determining a session key according to the first shared key and the random number, wherein the first shared key is determined according to the service end public key and the terminal public key; determining encrypted signaling data according to the session key and the signaling data; sending a signaling message to the service end to make the service end verify the signaling message, wherein the signaling message includes the encrypted signaling data and the encrypted random number.

2. The information verification method according to claim 1, characterized by, Before the method of generating a random number and encrypting according to the anti-quantum public key to determine the encrypted random number, the method further comprises: determining a first shared key according to the service end public key and the terminal public key; encrypting the user's login information according to the first shared key to determine the user's encrypted login information; sending the user's encrypted login information and the terminal public key to the service end for user registration.

3. The information verification method according to claim 1, characterized by, The signaling message further includes the terminal login information and the hash message authentication code, wherein the hash message authentication code is generated according to the session key.

4. An information verification method characterized by, Applied to a service end, comprising: obtaining a signaling message sent by a terminal, wherein the signaling message includes encrypted random number and encrypted signaling data; decrypting the encrypted random number according to the anti-quantum private key to determine the random number; determining a session key according to the first shared key and the random number, wherein the first shared key is determined according to the service end public key and the terminal public key; decrypting the encrypted signaling data according to the session key.

5. The information verification method according to claim 4, characterized by, The signaling message further includes the terminal login information and the hash message authentication code, wherein the hash message authentication code is generated according to the session key. Before the method of decrypting the encrypted signaling data according to the session key, the method further comprises: verifying the hash message authentication code according to the session key; if the verification is passed, decrypting the encrypted signaling data according to the session key.

6. An information verification device, characterized by comprising: Applied to a terminal, comprising: an encrypted random number determination module for generating a random number and encrypting according to the anti-quantum public key to determine the encrypted random number; a session key first determination module for determining a session key according to the first shared key and the random number, wherein the first shared key is determined according to the service end public key and the terminal public key; an encrypted signaling data determination module for determining encrypted signaling data according to the session key and the signaling data; a signaling message sending module for sending a signaling message to the service end to make the service end verify the signaling message, wherein the signaling message includes the encrypted signaling data and the encrypted random number.

7. An information verification apparatus characterized by comprising: Applied to a service end, comprising: a signaling message obtaining module for obtaining a signaling message sent by a terminal, wherein the signaling message includes encrypted random number and encrypted signaling data; a random number determination module for decrypting the encrypted random number according to the anti-quantum private key to determine the random number; a session key second determination module for determining a session key according to the first shared key and the random number, wherein the first shared key is determined according to the service end public key and the terminal public key; The signaling data decryption module is configured to decrypt the encrypted signaling data according to the session key.

8. An information verification system characterized by comprising: The method comprises the steps of: The terminal generates a random number, encrypts the random number according to the anti-quantum public key, and determines the encrypted random number; The terminal determines a session key according to the first shared key and the random number, wherein the first shared key is determined according to the service end public key and the terminal public key; The terminal determines encrypted signaling data according to the session key and the signaling data; The terminal sends a signaling message to the service end, wherein the signaling message comprises the encrypted signaling data and the encrypted random number; The service end acquires the signaling message sent by the terminal; The service end decrypts the encrypted random number according to the anti-quantum private key, and determines the random number; The service end determines a session key according to the first shared key and the random number; The service end decrypts the encrypted signaling data according to the session key.

9. An electronic device, comprising: The method comprises the steps of: A processor; And A memory for storing executable instructions of the processor; Wherein the processor is configured to execute the executable instructions to perform the information verification method of any one of claims 1-7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the information verification method of any one of claims 1-7.

Images