A mobile communication method and communication system resistant to quantum computing

Abstract

The present invention discloses a mobile communication method resistant to quantum computing, wherein a certificate issuing server issues encrypted digital certificates to mobile terminals respectively, and the keys of the two communicating parties are jointly generated by the keys issued by the mobile communication system server and the keys negotiated by the anti-quantum computing communication system, and the mobile communication system server cannot decrypt the communication content, so the security is high. In addition, the present invention discloses a mobile communication system resistant to quantum computing, including a certificate issuing server, a mobile communication system server and one or more mobile terminals; this patent improves the SIM card, and the improved SIM card provides users with an anti-quantum computing communication mechanism, which does not increase the cost for users, but improves the user's communication security to the security level of anti-quantum computing; it does not increase the hardware cost for users, maintains the convenience of use, and avoids the large workload caused by the transformation of the server.

Description

Technical Field

[0001] The present invention relates to the field of quantum computing resistance, and in particular to a quantum computing resistance mobile communication method and communication system. Background Art

[0002] Mobile communications is a communication method used by mobile users to communicate with fixed-point users or between mobile users, with one or both parties in motion. Mobile communications is a modern technology for wireless communications, and is one of the important achievements of the development of electronic computers and mobile Internet. In the past half century, the development of mobile communications has had a profound impact on people's lives, production, work, entertainment, and even politics, economy, and culture. Drones, smart homes, online videos, and online shopping that were imagined 30 years ago have all been realized. Mobile communication technology has gone through five development stages: analog transmission, digital voice transmission, Internet communication, personal communication, and a new generation of wireless mobile communications. However, the encryption and transmission security of traditional mobile communications currently rely on complex mathematical algorithms. That is, due to the current limitations of computer computing power, it is too late to calculate the results within the time period required, so it can be said that the current digital cryptographic system is safe. However, this security status has been increasingly threatened by quantum computers. In the face of powerful quantum computers, even the most advanced mobile confidential communications, as long as they are through current communication methods, will face the possibility of being deciphered and eavesdropped. Therefore, it is an urgent need to establish a practical and usable mobile quantum computing-resistant communication network.

[0003] Problems with existing technologies:

[0004] 1. In the existing mobile communication system, the keys of both parties are issued by the mobile communication system server, that is, the mobile communication system server can decrypt the communication content, which is not secure enough;

[0005] 2. In the existing mobile communication system, a fixed key is stored in the SIM card, so the security of the communication content between the mobile terminal and the mobile communication network is not high enough, and the session key used for communication between the mobile terminals may be leaked during the issuance process; in the existing mobile communication system based on quantum secure communication, although a large number of quantum keys are stored in the SIM card to improve the security of the system, it also places high requirements on the storage capacity of the SIM card. Users need to replace the old SIM card with a new large-capacity SIM card, which increases the cost for users;

[0006] 3. The quantum computing-resistant communication system in the prior art has modified the terminals of the original communication system, such as adding a key card, which increases the hardware cost and reduces the convenience of use for users;

[0007] 4. The quantum computing-resistant communication system in the prior art has also modified the server of the original communication system, such as adding a key card and an interface call to the key card. However, the server of the communication system is generally complex to implement and requires a large amount of modification work. Summary of the invention

[0008] In response to the problems in the related art, the present invention proposes a mobile communication method and communication system that are resistant to quantum computing to overcome the above-mentioned technical problems existing in the existing related technology.

[0009] To this end, the specific technical solution adopted by the present invention is as follows:

[0010] A quantum computing-resistant mobile communication method comprises the following steps:

[0011] S1. The certificate issuing server issues encrypted digital certificates to mobile terminals respectively.

[0012] S2, mobile terminal 1 and mobile terminal 2 respectively perform identity authentication with the mobile communication system server. After the authentication is passed, the mobile communication system server allocates a first key to the mobile terminal, and the first key is used for direct communication of the mobile terminal;

[0013] S3, after completing the two-way identity authentication, the mobile terminal obtains the second key negotiated through the digital certificate;

[0014] S4. The mobile terminal obtains a quantum computing-resistant session key by using the first key and the second key through irreversible function calculation;

[0015] S5. The mobile terminal uses quantum computing-resistant session keys for confidential communications.

[0016] The issuance of the encrypted digital certificate in S1 may be carried out in the following steps: the certificate issuing server generates a first random number, encrypts the digital certificate of the mobile terminal with the first random number and encrypts the first random number with the private key of the certificate issuing server to form an encrypted digital certificate and issues it to the corresponding mobile terminal.

[0017] The two-way identity authentication in S3 is implemented in mobile terminal 1, including the following steps:

[0018] S301, initiating a connection request to the second mobile terminal;

[0019] S302, receiving the encrypted digital certificate and the second random number of the mobile terminal 2;

[0020] S303, using the public key of the certificate issuing server stored in the SIM card of the mobile terminal one to decrypt the encrypted digital certificate of the mobile terminal two to obtain the digital certificate of the mobile terminal two, and using the public key of the certificate issuing server to verify the validity of the digital certificate of the mobile terminal two;

[0021] S304: after the verification is passed, generate a third random number, take out the public key of the mobile terminal 2 from the digital certificate of the mobile terminal 2, encrypt the third random number using the public key of the mobile terminal 2 to obtain a first ciphertext, use the private key of the mobile terminal 1 to sign the combination of the second random number and the third random number to obtain a first signature, and send the encrypted digital certificate of the mobile terminal 1, the first signature, and the first ciphertext together to the mobile terminal 2;

[0022] S305: Use the public key of the second mobile terminal to verify the second signature from the second mobile terminal.

[0023] The two-way identity authentication in S3 is implemented in the mobile terminal 2, including the following steps:

[0024] S311, receiving a connection request from mobile terminal 1;

[0025] S312, sending the digital certificate of mobile terminal 2 and the second random number to mobile terminal 1;

[0026] S313, receiving the encrypted digital certificate, the first signature, and the first ciphertext of the mobile terminal 1;

[0027] S314, using the public key of the certificate issuing server stored in the SIM card of the mobile terminal 2 to decrypt the encrypted digital certificate of the mobile terminal 1 to obtain the digital certificate of the mobile terminal 1, and using the public key of the certificate issuing server to verify the validity of the digital certificate of the mobile terminal 1;

[0028] S315: After verification, the second mobile terminal uses its own private key to decrypt the first ciphertext to obtain a third random number;

[0029] S316, taking out the public key of mobile terminal 1 from the digital certificate of mobile terminal 1 to verify the first signature;

[0030] S317: Use the private key of the second mobile terminal to sign the combination of the second random number and the third random number to obtain a second signature and send it to the first mobile terminal;

[0031] Preferably, the method for obtaining the second key obtained through digital certificate negotiation in S3 can be that mobile terminal one and mobile terminal two respectively obtain the second random number and the third random number after completing two-way identity authentication, and the second random number and the third random number are combined to obtain the second key through an irreversible function operation.

[0032] Optionally, the irreversible function may be a hash function or a message authentication code function.

[0033] Optionally, the session key length is consistent with the first key length.

[0034] A quantum computing-resistant mobile communication system, used for the above-mentioned quantum computing-resistant mobile communication method, characterized in that the system comprises a certificate issuing server, a mobile communication system server and one or more mobile terminals;

[0035] The certificate issuing server is only responsible for certificate management; the certificate issuing server may be located at the location of the customer cluster or deployed in the server room of the mobile communication system;

[0036] The mobile terminal is equipped with a SIM card, in which the CA public key and its own public and private keys are stored; when using the session key, the SIM card can use the key obtained through negotiation with the digital certificate.

[0037] The mobile communication system server distributes keys between any mobile terminals and can obtain communication information between any mobile terminals.

[0038] The mobile communication system server may be an instant messaging server, or an audio and video server, or a storage server, or a WEB server, or a cloud server.

[0039] The beneficial effects of the present invention are:

[0040] 1. In this patent, the keys of the two parties in the call are jointly generated by the key issued by the mobile communication system server and the key generated by negotiation of the anti-quantum computing communication system. The mobile communication system server cannot decrypt the communication content, which has high security;

[0041] 2. In this patent, the improved SIM card provides users with a quantum computing-resistant communication mechanism, and the possibility of quantum computing-resistant session keys used for communication between mobile terminals being obtained is greatly reduced; and the improvement has very low requirements for the storage capacity of the SIM card, and users do not need to replace the old SIM card with a new large-capacity SIM card, which does not increase the cost for users, but improves the user's communication security to the security level of quantum computing-resistant;

[0042] 3. In this patent, the original communication system terminal is not remodeled on a large scale, and the original SIM card is fully utilized without adding a key card, which does not increase the hardware cost for users and maintains the convenience of use;

[0043] 4. In this patent, the server of the original communication system is not modified, and there is no need to add a key card and call the interface of the key card, thus avoiding the heavy workload caused by modifying the server. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 This is a flow chart of a quantum computing-resistant mobile communication method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0046] To further illustrate each embodiment, the present invention provides drawings, which are part of the disclosure of the present invention and are mainly used to illustrate the embodiments and can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. With reference to these contents, ordinary technicians in the field should be able to understand other possible implementations and advantages of the present invention. The components in the figures are not drawn to scale, and similar component symbols are generally used to represent similar components.

[0047] The present invention is now further described in conjunction with the accompanying drawings and specific implementation methods. In this patent, the system structure of the present invention is shown in Figure 1, including a CA server (certificate issuing server), a mobile communication system server and several mobile terminals.

[0048] In this system, a dedicated CA server is deployed for a certain customer cluster. The CA server can be located at the customer cluster location or in the server room of the mobile communication system. The CA server does not have the function of forwarding user information communication and is only responsible for certificate management. The CA server and the improved SIM card in the mobile terminal constitute a quantum computing-resistant communication system.

[0049] The mobile terminal is equipped with a SIM card, in which the CA public key and its own public and private keys are added. In terms of the SIM card software, when using the call key, the use of the key obtained through certificate negotiation is added.

[0050] The mobile communication system server is, for example, an instant messaging server, an audio and video server, a storage server, a WEB server, or a cloud server equivalent to such a server. In the prior art, the mobile communication system server can obtain communication information between any users because it allocates keys between any users. In the present system, the mobile communication system server is not modified, that is, no key card is added.

[0051] Issuance of digital certificates:

[0052] Take the example of a CA server issuing an encrypted digital certificate ECERTA to mobile terminal A.

[0053] CA generates a random number RCERTA and uses it to encrypt A's digital certificate CERTA to obtain {CERTA}RCERTA, which together with the random number RCERTA encrypted using CA's private key SKCA form an encrypted digital certificate ECERTA = {CERTA}RCERTA||{RCERTA}SKCA.

[0054] The process in which CA issues an encrypted digital certificate ECERTB to mobile terminal B is the same as above.

[0055] The detailed steps of the communication process between mobile terminal A and mobile terminal B are described as follows:

[0056] Step 1: The mobile terminals of both parties obtain the key KS allocated by the mobile communication system server.

[0057] After the mobile terminal A and the mobile terminal B respectively perform identity authentication with the mobile communication system server, they both obtain the key KS for communication between A and B allocated by the mobile communication system server.

[0058] Step 2: The mobile terminals of both parties obtain the key KAB obtained through certificate negotiation.

[0059] 1. A initiates a connection request to B.

[0060] 2. B sends the encrypted digital certificate ECERTB and the random number KB to A. The encrypted digital certificate can be expressed as ECERTB={CERTB}RCERTB||{RCERTB}SKCA.

[0061] 3. After receiving it, A uses the CA public key PKCA stored in the SIM card to decrypt {RCERTB}SKCA in ECERTB={CERTB}RCERTB||{RCERTB}SKCA to obtain RCERTB, uses RCERTB to decrypt {CERTB}RCERTB to obtain CERTB, and uses PKCA to verify the validity of CERTB.

[0062] 4. A generates a random number KA, takes out B's public key PKB from CERTB, uses PKB to encrypt the true random number KA to obtain {KA}PKB, uses its own private key SKA to sign KA||KB ​​to obtain SIGA={KA||KB}SKA, and sends {KA}PKB, SIGA and A's encrypted digital certificate ECERTA to B.

[0063] The encrypted digital certificate may be expressed as ECERTA={CERTA}RCERTA||{RCERTA}SKCA.

[0064] 5. After receiving it, B uses the CA public key PKCA stored in the SIM card to decrypt {RCERTA}SKCA in ECERTA={CERTA}RCERTA||{RCERTA}SKCA to get RCERTA, uses RCERTA to decrypt {CERTA}RCERTA to get CERTA, and uses PKCA to verify the validity of CERTA. B takes out his own private key SKB to decrypt {KA}PKB to get KA, and then takes out A's public key PKA in CERTA to verify SIGA. After all the verifications are passed, it is confirmed that A's identity is reliable.

[0065] B uses his private key SKB to sign KB||KA to obtain SIGB={KB||KA}SKB, and sends SIGB to A. After A verifies SIGB with PKB, it confirms that B's identity is reliable.

[0066] At this point, A and B have completed two-way identity authentication, both hold the random number KA||KB, and obtain the shared key KAB=FK(KB,KA), where FK is any irreversible function, such as a hash function or a message authentication code function.

[0067] Step 3: The mobile terminals of both parties form a quantum computing-resistant session key KABS for the call.

[0068] Mobile terminal A and mobile terminal B both calculate KABS=FKS(KS,KAB) based on KS and KAB, where FKS is any irreversible function, such as a hash function or a message authentication code function, and the length of KABS is equal to the length of KS for use by the communication system.

[0069] Step 4: The mobile terminals of both parties use KABS for confidential communication.

[0070] To sum up, with the help of the above-mentioned technical scheme of the present invention, the present invention realizes a mobile communication method that is resistant to quantum computing. The keys of the two parties in the call are jointly generated by the key issued by the mobile communication system server and the key generated by negotiation of the anti-quantum computing communication system. The mobile communication system server cannot decrypt the communication content, and the security is high.

[0071] The quantum computing-resistant mobile communication system implemented by the present invention improves the SIM card. The improved SIM card provides users with a quantum computing-resistant communication mechanism, and the possibility of quantum computing-resistant session keys used for communication between mobile terminals being obtained is greatly reduced; and the improvement has very low requirements on the storage capacity of the SIM card. Users do not need to replace old SIM cards with new large-capacity SIM cards, and there is no cost increase for users, but the communication security of users is improved to the security level of quantum computing resistance; in addition, there is no large-scale transformation of the terminals of the original communication system, and the original SIM cards are fully utilized without adding key cards, which does not increase the hardware cost for users and maintains ease of use; in addition, the server of the original communication system is not transformed, and there is no need to add key cards and interface calls to the key cards, which avoids the large workload caused by the transformation of the server.

[0072] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0073] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A mobile communication method resistant to quantum computing, characterized in that: The following steps are involved: S1. The certificate issuing server issues encrypted digital certificates to the mobile terminals respectively; S2, mobile terminal 1 and mobile terminal 2 respectively perform identity authentication with the mobile communication system server. After the authentication is passed, the mobile communication system server allocates a first key to mobile terminal 1 and mobile terminal 2, and the first key is used for direct communication between mobile terminal 1 and mobile terminal 2; S3, after completing the two-way identity authentication, the mobile terminal 1 and the mobile terminal 2 obtain the second key negotiated through the digital certificate; S4, mobile terminal 1 and mobile terminal 2 calculate a quantum computing-resistant session key using the first key and the second key using an irreversible function; S5, mobile terminal 1 and mobile terminal 2 use quantum computing resistant session key to communicate confidentially; The two-way identity authentication in S3 is implemented on mobile terminal 1, including the following steps: S301, initiating a connection request to the second mobile terminal; S302, receiving the encrypted digital certificate and the second random number of the mobile terminal 2; S303, using the public key of the certificate issuing server stored in the SIM card of the mobile terminal one to decrypt the encrypted digital certificate of the mobile terminal two to obtain the digital certificate of the mobile terminal two, and using the public key of the certificate issuing server to verify the validity of the digital certificate of the mobile terminal two; S304: after the verification is passed, generate a third random number, take out the public key of the mobile terminal 2 from the digital certificate of the mobile terminal 2, encrypt the third random number using the public key of the mobile terminal 2 to obtain a first ciphertext, use the private key of the mobile terminal 1 to sign the combination of the second random number and the third random number to obtain a first signature, and send the encrypted digital certificate of the mobile terminal 1, the first signature, and the first ciphertext together to the mobile terminal 2; S305, verifying the second signature from the mobile terminal 2 using the public key of the mobile terminal 2; The two-way identity authentication in S3 is implemented in the mobile terminal 2, including the following steps: S311, receiving a connection request from mobile terminal 1; S312, sending the digital certificate of mobile terminal 2 and the second random number to mobile terminal 1; S313, receiving the encrypted digital certificate, the first signature, and the first ciphertext of the mobile terminal 1; S314, using the public key of the certificate issuing server stored in the SIM card of the mobile terminal 2 to decrypt the encrypted digital certificate of the mobile terminal 1 to obtain the digital certificate of the mobile terminal 1, and using the public key of the certificate issuing server to verify the validity of the digital certificate of the mobile terminal 1; S315: After verification, the second mobile terminal uses its own private key to decrypt the first ciphertext to obtain a third random number; S316, taking out the public key of mobile terminal 1 from the digital certificate of mobile terminal 1 to verify the first signature; S317: Use the private key of the second mobile terminal to sign the combination of the second random number and the third random number to obtain a second signature and send it to the first mobile terminal; The method for obtaining the second key obtained through digital certificate negotiation in S3 is that mobile terminal one and mobile terminal two respectively obtain the second random number and the third random number after completing two-way identity authentication, and the second random number and the third random number are combined to obtain the second key through an irreversible function operation.

2. A quantum computing-resistant mobile communication method according to claim 1, characterized in that: The issuance of the encrypted digital certificate in S1 adopts the following steps: the certificate issuing server generates a first random number, encrypts the digital certificate of the mobile terminal with the first random number and encrypts the first random number with the private key of the certificate issuing server to form an encrypted digital certificate and issues it to the corresponding mobile terminal.

3. A quantum computing-resistant mobile communication method according to claim 1, characterized in that: The irreversible function is a hash function or a message authentication code function.

4. A quantum computing-resistant mobile communication method according to claim 1, characterized in that: The session key length is consistent with the first key length.

5. A quantum computing-resistant mobile communication system, used to implement a quantum computing-resistant mobile communication method according to any one of claims 1 to 4, characterized in that: The system includes a certificate issuing server, a mobile communication system server and one or more mobile terminals; The certificate issuing server is only responsible for certificate management; the certificate issuing server is located at the location of the customer cluster or deployed in the server room of the mobile communication system; The mobile terminal is equipped with a SIM card, in which the CA public key and its own public and private keys are stored; when using the session key, the SIM card uses the key obtained through digital certificate negotiation.

6. A quantum computing-resistant mobile communication system according to claim 5, characterized in that: The mobile communication system server distributes keys between any mobile terminals and can obtain communication information between any mobile terminals.

7. A quantum computing-resistant mobile communication system according to claim 6, characterized in that: The mobile communication system server is an instant messaging server, or an audio and video server, or a storage server, or a WEB server, or a cloud server.

Images