Quantum encrypted digital signature method and system

Abstract

The present application provides a digital signature method and system based on quantum encryption, and the method applied to the client includes: receiving a quantum shared key assigned by a quantum key machine, and the quantum shared key is also assigned to the server; using the quantum shared key to encrypt authentication information to generate first encrypted authentication data; using the quantum shared key to encrypt a randomly selected message digest algorithm to generate message digest algorithm encrypted data; executing the message digest algorithm on the authentication information to generate digital summary data of the authentication information; using the quantum shared key to encrypt the first public key of the randomly generated first key pair to generate first public key encrypted data; using the first private key of the first key pair to encrypt the digital summary data to generate a digital signature; sending the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data and the digital signature to the server. The present application improves the security of data transmission in video conferencing.

Description

Background Art

[0002] With the development of Internet technology, video conferencing has become an important network application, but it also brings huge hidden dangers to network security. Network security threats and risks are becoming increasingly prominent, and video-related network security incidents are emerging in an endless stream, such as: network cameras are illegally logged in, video conferencing systems are hacked and eavesdropped, and video conferencing security challenges are becoming increasingly urgent.

[0003] At present, video conferencing generally uses firewalls or network isolation technology to ensure the security of data communication. However, firewalls are difficult to configure, which can easily cause security vulnerabilities and cannot prevent application layer viruses and eavesdropping. At the same time, although network isolation can prevent attacks from unsafe networks, on the one hand, it requires good support for the latest video conferencing protocols, otherwise it will lead to communication failures; on the other hand, due to the characteristics of network isolation, it is not suitable for large-scale and frequent real-time data interactions, especially when it involves large-scale encrypted meetings, which seriously affects the effectiveness of video conferencing.

[0004] Therefore, how to improve the security of data transmission in video conferencing is a technical problem that needs to be solved urgently by those skilled in the art. Summary of the invention

[0005] In order to overcome the defects of the above-mentioned prior art, the present application provides a quantum encryption digital signature method and system, thereby improving the security of data transmission in video conferencing.

[0006] According to one aspect of the present application, a digital signature method based on quantum encryption is provided, which is applied to a client and includes:

[0007] The client receives the quantum shared key assigned by the quantum key machine, and the quantum shared key is also assigned to the server;

[0008] The client encrypts authentication information using the quantum shared key to generate first encrypted authentication data, where the authentication information is used for communication encryption between the client and the server;

[0009] The client uses the quantum shared key to encrypt the randomly selected message digest algorithm to generate message digest algorithm encrypted data;

[0010] The client executes the message digest algorithm on the authentication information to generate digital summary data of the authentication information;

[0011] The client uses the quantum shared key to encrypt the first public key of the randomly generated first key pair to generate first public key encrypted data;

[0012] The client encrypts the digital summary data using the first private key of the first key pair to generate a digital signature;

[0013] The client sends the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data and the digital signature to the server, so that the server uses the quantum shared key to obtain the authentication information and authenticate the digital signature.

[0014] In some embodiments of the present application, the authentication information includes at least a second symmetric key. After the server successfully authenticates the client:

[0015] The client encrypts the first signaling and / or the first code stream using the second symmetric key to generate first encrypted transmission data, and sends the first encrypted transmission data to the server via network address translation; and / or

[0016] The client uses the second symmetric key to decrypt the second encrypted transmission data sent by the server to obtain the second signaling and / or second code stream sent by the server.

[0017] In some embodiments of the present application, the authentication information includes a first authentication identifier and an authentication identifier bit randomly generated by the client, the authentication identifier bit includes a first value for indicating that the client requests to continue connecting to the server and a second value for indicating that the client requests to re-authenticate with the server, and the method further includes:

[0018] In response to the connection between the client and the server being disconnected, and the client requesting to continue the connection with the server, the client uses the first authentication identifier and the authentication identifier bit set to a first value as parameters of the authentication information, and again generates the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data, and the digital signature, and sends them to the server, so that the server can compare the first authentication identifier with the second authentication identifier locally stored on the server based on the value of the authentication identifier bit to determine whether the client has been successfully authenticated;

[0019] In response to the server returning an authentication success message, the client continues to use the second symmetric key to perform signaling and / or code stream communication with the server;

[0020] In response to the server returning an authentication failure, the client re-randomly generates a third authentication identifier, uses the third authentication identifier and the authentication identifier bit set to the second value as parameters of the authentication information, and again generates the first encrypted authentication data, message digest algorithm encrypted data, first public key encrypted data, and digital signature, and sends them to the server, so that the server can use the value of the authentication identifier bit to execute the steps of obtaining the authentication information using the quantum shared key and authenticating the digital signature.

[0021] In some embodiments of the present application, the client sends the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data and the digital signature to the server, so that the server can use the quantum shared key to obtain the authentication information, and saves the first authentication identifier locally on the server as a second authentication identifier. In response to the time interval between the current time and the disconnection of the connection between the client and the server being less than or equal to the first session keep-alive period, the second authentication identifier is valid.

[0022] In some embodiments of the present application, the client uses the first authentication identifier and the authentication identifier bit set to the first value as parameters of the authentication information, performs the generation of the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data, and the digital signature again, and sends them to the server, including:

[0023] In response to the time interval between the current time and the disconnection of the connection between the client and the server being less than or equal to a second session keep alive period, the client uses the first authentication identifier and the authentication identifier bit set to a first value as parameters of the authentication information, generates the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data, and the digital signature again, and sends them to the server, wherein the second session keep alive period is less than the first session keep alive period;

[0024] In response to the time interval between the current time and the disconnection of the connection between the client and the server being greater than the second session keep-alive period, the client randomly regenerates the third authentication identifier, uses the third authentication identifier and the authentication identifier bit set to the second value as parameters of the authentication information, and again performs the generation of the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data, and the digital signature, and sends them to the server side, so that the server side uses the value of the authentication identifier bit to execute the steps of obtaining the authentication information using the quantum shared key and authenticating the digital signature.

[0025] According to another aspect of the present application, a digital signature method based on quantum encryption is also provided, which is applied to a server side and includes:

[0026] The server receives the quantum shared key assigned by the quantum key machine, and the quantum shared key is also assigned to the client;

[0027] The server receives the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data and the digital signature sent by the client by executing the digital signature method based on quantum encryption as described above;

[0028] The server uses the quantum shared key to decrypt the first encrypted authentication data to obtain the authentication information;

[0029] The server uses the quantum shared key to decrypt the message digest algorithm encrypted data to obtain the message digest algorithm;

[0030] The server uses the quantum shared key to decrypt the first public key encrypted data to obtain the first public key of the first key pair;

[0031] The server uses the first public key to decrypt the digital signature to obtain first digital summary data to be authenticated;

[0032] The server executes the message digest algorithm on the authentication information to obtain second digital digest data to be authenticated;

[0033] In response to the first digital summary data to be authenticated being consistent with the second digital summary data to be authenticated, the server sends an authentication success message to the client.

[0034] In some embodiments of the present application, the authentication information includes at least a second symmetric key. After the server successfully authenticates the client:

[0035] The server encrypts the second signaling and / or the second code stream using the second symmetric key to generate second encrypted transmission data, and sends the second encrypted transmission data to the client via network address translation; and / or

[0036] The server uses the second symmetric key to decrypt the first encrypted transmission data sent by the client to obtain the first signaling and / or the first code stream sent by the client.

[0037] According to another aspect of the present application, a digital signature system based on quantum encryption is also provided, comprising:

[0038] A plurality of clients, configured to execute the digital signature method based on quantum encryption as described above;

[0039] A server side configured to execute the digital signature method based on quantum encryption as described above; and

[0040] A quantum key machine is configured to distribute a quantum shared key to the client and the server.

[0041] In some embodiments of the present application, the client requests a quantum shared key from the quantum key machine through network address conversion, and the quantum key machine distributes a quantum shared key to the client through the network address conversion.

[0042] In some embodiments of the present application, there are multiple quantum key machines, and the multiple quantum key machines negotiate the quantum shared key to determine the quantum shared key allocated to the server and client ends respectively connected.

[0043] According to another aspect of the present application, an electronic device is provided, comprising: a processor; and a storage medium storing a computer program, wherein the computer program executes the above steps when executed by the processor.

[0044] According to another aspect of the present application, a storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps described above are executed.

[0045] It can be seen that the solution provided by this application has the following advantages compared with the prior art:

[0046] On the one hand, the quantum shared key is obtained by using a quantum key machine to encrypt the first public key in the digital signature, so that the quantum shared key can be used to determine that the first public key is sent by the client communicating with the quantum key machine, thereby determining the identity of the sender; on the other hand, the quantum shared key is used to enable the first public key to be encrypted and transmitted on the network, and a third party cannot crack it without the quantum shared key. Even if the message is intercepted and tampered with, there is no quantum shared key to encrypt the data, so that the server decryption fails and the digital signature authentication cannot be completed, thereby improving the authentication security; on the other hand, the quantum shared key is obtained by using a quantum key machine to encrypt the digital signature message, message digest algorithm and the first public key, so that the digital signature is absolutely confidential throughout the entire authentication process, preventing third parties on the network from tampering with and forging data; on the other hand, the authentication process is completed through a single data interaction between the client and the server, reducing multiple information interaction steps and improving data interaction efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The above and other features and advantages of the present application will become more apparent by describing in detail example embodiments thereof with reference to the attached drawings.

[0048] Figure 1A flow chart of a digital signature method based on quantum encryption applied to a client according to an embodiment of the present application is shown.

[0049] Figure 2 A schematic diagram of a digital signature method based on quantum encryption applied to a client according to an embodiment of the present application is shown.

[0050] Figure 3 A flow chart of a digital signature method based on quantum encryption applied to a server according to an embodiment of the present application is shown.

[0051] Figure 4 A schematic diagram of a digital signature method based on quantum encryption applied to a server according to an embodiment of the present application is shown.

[0052] Figure 5 A schematic diagram of a digital signature system based on quantum encryption according to an embodiment of the present application is shown.

[0053] Figure 6 A schematic diagram of distributing quantum shared keys in a digital signature system based on quantum encryption according to an embodiment of the present application is shown.

[0054] Figure 7 A schematic diagram of the authentication process of a digital signature system based on quantum encryption according to an embodiment of the present application is shown.

[0055] Figure 8 A schematic diagram of the signaling / code stream transmission process of a digital signature system based on quantum encryption according to an embodiment of the present application is shown.

[0056] Fig. 9 A schematic diagram of a quantum shared key distribution process of a quantum encryption-based digital signature system with multiple quantum key machines according to an embodiment of the present application is shown.

[0057] Fig.10 A schematic diagram of a computer-readable storage medium in an exemplary embodiment of the present disclosure is schematically shown.

[0058] Fig.11 The figure schematically shows a schematic diagram of an electronic device in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0059] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0060] In addition, the accompanying drawings are only schematic illustrations of the present application and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and thus their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0061] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the steps. For example, some steps may be decomposed, while some steps may be combined or partially combined. Therefore, the actual execution order may be changed according to the actual situation.

[0062] See first Figure 1 , Figure 1 A flowchart of a digital signature method based on quantum encryption applied to a client according to an embodiment of the present application is shown. The digital signature method based on quantum encryption applied to a client provided by the present application includes:

[0063] Step S101: The client receives the quantum shared key assigned by the quantum key machine, and the quantum shared key is also assigned to the server.

[0064] Specifically, each time a digital signature is performed, the quantum key machine updates the quantum shared key K distributed to the client and the server. Q , improving the security and confidentiality of video conferencing.

[0065] Step S102: The client uses the quantum shared key to encrypt authentication information to generate first encrypted authentication data, and the authentication information is used for communication encryption between the client and the server.

[0066] Specifically, the authentication information may include a second symmetric key pair. The second symmetric key pair is used to encrypt the communication between the client and the server. The authentication information may also include identification information such as the client's IP address and terminal conference number for the client and the server to connect. Further, the authentication information may also include an authentication identifier for disconnection and reconnection between the client and the server.

[0067] Furthermore, specifically, the second symmetric key pair of the authentication information is updated at each authentication, so that the client uses a new second symmetric key each time it authenticates and connects to the server, which can prevent the subsequent decryption of the ciphertext and ensure forward security. Compared with the use of asymmetric keys (such as RSA asymmetric keys), the use of second symmetric keys is more secure. This is because when the private key of the asymmetric key pair is leaked, it can be decrypted by a third party, and the private key can be used to decrypt all intercepted ciphertexts before the decryption, which cannot guarantee forward security. In addition, the encryption efficiency of the symmetric key pair is high, while the RSA asymmetric key has more interactive steps and low efficiency.

[0068] Specifically, the encryption algorithm used in step S102 may be Advanced Encryption Standard (AES), but the present application is not limited thereto, and the use of other encryption algorithms is also within the protection scope of the present application.

[0069] Step S103: The client uses the quantum shared key to encrypt the randomly selected message digest algorithm to generate message digest algorithm encrypted data.

[0070] Specifically, the message digest algorithm may be a hash algorithm for performing digital digest calculations. Step S103 may randomly select one of a plurality of hash algorithms (such as a one-way hash function, MD5 (Message-Digest Algorithm, cryptographic hash function), SHA-1 (Secure Hash Algorithm 1, secure hash algorithm 1) and SHA-2 (Secure Hash Algorithm 2, secure hash algorithm 2)) for encryption. The encryption algorithm of step S103 may be the same as the encryption algorithm used in step S102, or may be different from the encryption algorithm used in step S102.

[0071] Furthermore, each time the client signs, it performs a random selection of the message digest algorithm, improving the security and confidentiality of the video conference.

[0072] Step S104: The client executes the message digest algorithm on the authentication information to generate digital summary data of the authentication information.

[0073] Step S105: The client uses the quantum shared key to encrypt the first public key of the randomly generated first key pair to generate first public key encrypted data.

[0074] Specifically, the first key pair is randomly generated, thereby improving the security and confidentiality of the video conference.

[0075] Step S106: The client uses the first private key of the first key pair to encrypt the digital summary data to generate a digital signature.

[0076] Step S107: The client sends the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data and the digital signature to the server, so that the server uses the quantum shared key to obtain the authentication information and authenticate the digital signature.

[0077] Specifically, the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data and the digital signature can be combined into encrypted digital signature data to be sent to the server.

[0078] Therefore, in the digital signature method based on quantum encryption applied to the client and the server provided by the present application, on the one hand, the quantum shared key is obtained by using the quantum key machine to encrypt the first public key in the digital signature, so that the first public key can be determined by the quantum shared key. The first public key is sent by the client communicating with the quantum key machine, and thus the identity of the sender can be determined; on the other hand, the quantum shared key is used to enable the first public key to be encrypted and transmitted on the network, and the third party cannot crack it without the quantum shared key. Even if the message is intercepted and tampered with, there is no quantum shared key to encrypt the data, so that the server decryption fails and the digital signature authentication cannot be completed, thereby improving the authentication security; on the other hand, the quantum shared key is obtained by using the quantum key machine to encrypt the digital signature message, the message digest algorithm and the first public key, so that the digital signature is absolutely confidential during the entire authentication process, preventing third parties on the network from tampering with and forging data; on the other hand, the authentication process is completed through a single data interaction between the client and the server, reducing multiple information interaction steps, improving data interaction efficiency, and facilitating large-capacity concurrent communication of the proxy server.

[0079] Furthermore, in this application, the client and the server obtain the quantum shared key through the quantum key machine distribution, and encrypt and sign the authentication information used for communication encryption between the client and the server through the quantum shared key, so as to realize the authentication of the client by the server and ensure that the server communicates with the authenticated client. Furthermore, this application enables the authentication message to carry the second symmetric key, realizes the transmission of the second symmetric key, and when the server authentication is successful, the second symmetric key can be obtained, so as to be used as the negotiation of the encryption key for communication between the client and the server, thereby realizing the negotiation of the encryption key for communication between the client and the server at the same time of authentication. Therefore, through the method of quantum encryption, in one interaction between the client and the server, the authentication and encryption key negotiation of the client and the server are realized at the same time, which not only improves the communication security of the client and the server, but also reduces the number of interactions between the client and the server, improves the real-time interaction of the signaling code stream between the client and the server, and reduces the bandwidth occupied by the communication.

[0080] Figure 2 The following is a digital signature method based on quantum encryption for a client according to a specific embodiment of the present application. Figure 2 :

[0081] Client 100 uses quantum shared key K to authenticate the authentication information M to be sent. Q Perform AES encryption to obtain the first encrypted authentication data C1=E(M, K Q ). The first encrypted authentication data C1 can prevent the authentication information M from being transmitted in plain text over the network, and because each signature quantum shared key K Q Different, even if the encrypted authentication information M is intercepted and replayed, the security of authentication information communication can still be guaranteed.

[0082] Client 100 pairs randomly select message digest algorithm A Hash , through the quantum shared key K Q Perform AES encryption to obtain the message digest algorithm encrypted data C2=E(A Hash , K Q ). The message digest algorithm encrypted data C2 can inform the server side which message digest algorithm to use for digital digest for use by the server side during authentication comparison.

[0083] The client 100 performs the selected message digest algorithm on the authentication information M to be sent to obtain the digital summary data C5=E(M, A Hash ).

[0084] When the client 100 performs digital signature, it randomly generates a first key pair Kc (K pb , K pv ), where Kpb is the first public key of the first key pair, K pv is the first private key of the first key pair. pb , through the quantum shared key K Q Perform AES encryption to obtain the first public key encrypted data C3=E(K pb , K Q The first public key encrypted data C3 is used to notify the server to use the first public key K of the client 100 pb Decrypt the following digital signature C4 to obtain the digital summary data to be authenticated.

[0085] The client 100 uses the first private key K pv Encrypt the digital summary data C5 and obtain the digital signature C4=E(C5, K pv ).

[0086] When the client 100 sends a message to the server, it sends the first encrypted authentication data C1, the message digest algorithm encrypted data C2, the first public key encrypted data C3 and the digital signature C4 to the server. In other words, the message C0 sent by the client 100 to the server is C1+C2+C3+C4.

[0087] See below Figure 3 , Figure 3 A flowchart of a digital signature method based on quantum encryption applied to a server according to an embodiment of the present application is shown. The digital signature method based on quantum encryption applied to a server provided by the present application includes:

[0088] Step S201: The server receives the quantum shared key assigned by the quantum key machine, and the quantum shared key is also assigned to the client.

[0089] Step S202: The server receives the client's execution of Figure 1 The first encrypted authentication data, message digest algorithm encrypted data, first public key encrypted data and digital signature sent by the digital signature method based on quantum encryption.

[0090] Step S203: The server uses the quantum shared key to decrypt the first encrypted authentication data to obtain the authentication information.

[0091] Step S204: The server uses the quantum shared key to decrypt the message digest algorithm encrypted data to obtain the message digest algorithm.

[0092] Step S205: The server uses the quantum shared key to decrypt the first public key encrypted data to obtain the first public key of the first key pair.

[0093] Step S206: The server uses the first public key to decrypt the digital signature to obtain first digital summary data to be authenticated.

[0094] Step S207: The server executes the message digest algorithm on the authentication information to obtain second digital digest data to be authenticated.

[0095] Step S208: In response to the first digital summary data to be authenticated being consistent with the second digital summary data to be authenticated, the server sends an authentication success message to the client.

[0096] Therefore, in the digital signature method based on quantum encryption applied to the client and the server provided by the present application, on the one hand, the quantum shared key is obtained by using the quantum key machine to encrypt the first public key in the digital signature, so that the first public key can be determined by the quantum shared key. The first public key is sent by the client communicating with the quantum key machine, and thus the identity of the sender can be determined; on the other hand, the quantum shared key is used to enable the first public key to be encrypted and transmitted on the network, and the third party cannot crack it without the quantum shared key. Even if the message is intercepted and tampered with, there is no quantum shared key to encrypt the data, so that the server decryption fails and the digital signature authentication cannot be completed, thereby improving the authentication security; on the other hand, the quantum shared key is obtained by using the quantum key machine to encrypt the digital signature message, the message digest algorithm and the first public key, so that the digital signature is absolutely confidential during the entire authentication process, preventing third parties on the network from tampering with and forging data; on the other hand, the authentication process is completed through a single data interaction between the client and the server, reducing multiple information interaction steps, improving data interaction efficiency, and facilitating large-capacity concurrent communication of the proxy server.

[0097] Furthermore, in this application, the client and the server obtain the quantum shared key through the quantum key machine distribution, and encrypt and sign the authentication information used for communication encryption between the client and the server through the quantum shared key, so as to realize the authentication of the client by the server and ensure that the server communicates with the authenticated client. Furthermore, this application enables the authentication message to carry the second symmetric key, realizes the transmission of the second symmetric key, and when the server authentication is successful, the second symmetric key can be obtained, so as to be used as the negotiation of the encryption key for communication between the client and the server, thereby realizing the negotiation of the encryption key for communication between the client and the server at the same time of authentication. Therefore, through the method of quantum encryption, in one interaction between the client and the server, the authentication and encryption key negotiation of the client and the server are realized at the same time, which not only improves the communication security of the client and the server, but also reduces the number of interactions between the client and the server, improves the real-time interaction of the signaling code stream between the client and the server, and reduces the bandwidth occupied by the communication.

[0098] Combine the following Figure 4 , a digital signature method based on quantum encryption for a server in a specific embodiment of the present application is described:

[0099] The server 200 receives a message C0=C1+C2+C3+C4 sent from the client, wherein C1 is first encrypted authentication data, C2 is message digest algorithm encrypted data, C3 is first public key encrypted data, and C4 is a digital signature.

[0100] The server 200 uses the quantum shared key K Q The first encrypted authentication data C1 is decrypted using the AES decryption algorithm to obtain the authentication information M.

[0101] The server 200 uses the quantum shared key K Q The AES decryption algorithm is used to decrypt the message digest algorithm encrypted data C2 to obtain the message digest algorithm A Hash .

[0102] The server 200 uses the quantum shared key K Q The first public key encrypted data C3 is decrypted using the AES decryption algorithm to obtain the first public key K pb .

[0103] The server 200 uses the first public key K pb Decrypt the digital signature C4 to obtain the first digital summary data C5 to be authenticated.

[0104] The server 200 uses the message digest algorithm A Hash Calculate the message digest value of the authentication information to obtain the second digital digest data to be authenticated C5'=E(M, AHash ).

[0105] The server 200 compares the first digital summary data C5″ to be authenticated and the second digital summary data C5′ to be authenticated to see if they are consistent. If they are consistent, the signature authentication succeeds; if they are inconsistent, the signature authentication fails.

[0106] Furthermore, the present application may be applicable to various video conferencing protocols (such as H.323, sip (Session Initialization Protocol), rtc (Real-Time Communication), but the present application is not limited thereto.

[0107] Specifically, after the authentication between the client and the server is completed, the authentication information during the authentication can be used between the client and the server for encrypted transmission of signaling and / or code streams. Specifically, the authentication information includes at least a second symmetric key. The second symmetric key can be a shared key randomly generated by the client. The shared key is randomly generated by the client, which reduces the steps of generating and managing a large number of client-server key pairs on the server side, and improves the performance of quantum encryption proxy server video conferencing.

[0108] After the server successfully authenticates the client, the server and the client can communicate in the following manner: the client uses the second symmetric key to encrypt the first signaling and / or the first code stream to generate the first encrypted transmission data, and can send it to the server via network address translation. The server uses the second symmetric key to decrypt the first encrypted transmission data sent by the client to obtain the first signaling and / or the first code stream sent by the client. The server uses the second symmetric key to encrypt the second signaling and / or the second code stream to generate the second encrypted transmission data, and sends it to the client via network address translation. The client uses the second symmetric key to decrypt the second encrypted transmission data sent by the server to obtain the second signaling and / or the second code stream sent by the server.

[0109] In some embodiments, when the connection between the server and the client is disconnected, the present application can also provide a disconnection authentication mechanism.

[0110] Specifically, the authentication information M may include a first authentication identifier M randomly generated by the client. ID1 and an authentication flag MF. The authentication flag MF includes a first value (eg, set to 1) for indicating that the client requests to continue the connection with the server and a second value (eg, set to 0) for indicating that the client requests to re-authenticate with the server.

[0111] During the first authentication, the client sets the authentication identification bit MF to the second value, and the server uses the quantum shared key to obtain the authentication information M and the authentication identification bit. Since the authentication identification bit is the second value, the server sets the first authentication identification bit M to ID1 The second authentication identifier M is saved locally on the server. ID2 In response to the time interval between the current time and the disconnection of the connection between the client and the server being less than or equal to the first session keep alive period T s The second authentication identifier M ID2 In other words, the time interval between the current time and the disconnection between the client and the server is greater than the first session keep alive period T s , then the second authentication identifier M ID2 Will be deleted by the server.

[0112] In response to the disconnection between the client and the server, the client may ID1 and the authentication identifier MF set to the first value as the parameter of the authentication information M, and again perform the generation of the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data and the digital signature, and send them to the server end, so that the server end can identify that the client needs to continue the connection based on the authentication identifier MF, so that the server end needs to use the first authentication identifier M ID1 and the second authentication identifier M stored locally on the server ID2 The comparison determines whether the client continues to authenticate successfully.

[0113] In response to the server returning an authentication success message, the client continues to use the second symmetric key to communicate with the server via signaling and / or code stream.

[0114] In response to the server returning an authentication failure, the client re-randomly generates a third authentication identifier M ID3 , the third authentication mark M ID3 and the authentication identifier MF set to the first value as the parameter of the authentication information, and again perform the generation of the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data and the digital signature, and send them to the server end, so that the server end can identify that the client needs to be re-authenticated based on the authentication identifier, so that the server end uses the quantum shared secret key to obtain the authentication information, and authenticates the digital signature to obtain an updated third authentication identifier M ID3 Furthermore, when re-authenticating, the second symmetric key is also updated. In other words, when the server returns the authentication failure, the client re-executes the following steps: Figure 1Follow the steps shown for server authentication.

[0115] Thus, by setting the authentication identifier MF, the server can know whether the client needs to continue the previously disconnected connection or needs to re-authenticate, so as to avoid the situation where when the client needs to re-authenticate, the server compares the authentication identifier and finds inconsistency, thus returning an authentication failure message and no longer re-authenticating, resulting in a situation where re-authentication is impossible. Furthermore, by setting the authentication identifier, when the client needs to re-authenticate, the server does not need to compare the authentication identifier, thus reducing redundant authentication identifier comparison steps and improving authentication efficiency.

[0116] Furthermore, the client can maintain a second keep-alive period T c In response to the time interval between the current time and the disconnection of the connection between the client and the server being less than or equal to the second session keep alive period T c The client sends the first authentication identifier M ID1 and the authentication identifier set to the first value as the parameter of the authentication information M, and again perform the generation of the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data and the digital signature, and send them to the server, wherein the second session keep alive period T c Less than the first session keep alive period T s Specifically, by making the second session keep alive period T c Less than the first session keep alive period T s To avoid the second session keep alive period T c Greater than the first session keep alive period T s The server has deleted the second authentication identifier M ID2 , resulting in the failure of authentication between the client and the server, requiring secondary authentication, adding unnecessary authentication steps. Further, the second session keep alive period T c Less than the first session keep alive period T s , which can minimize the number of authentication times, especially in scenarios where a large number of concurrent clients access the server.

[0117] In response to the time interval between the current time and the disconnection of the connection between the client and the server being greater than the second session keep alive period T c , the client re-randomly generates a third authentication identifier M ID3 , the third authentication mark M ID3and the authentication identifier set to the second value as the parameter of the authentication information, and the generation of the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data and the digital signature is performed again, and sent to the server end, so that the server end can identify that the client needs to be re-authenticated based on the authentication identifier, so that the server end uses the quantum shared key to obtain the authentication information and authenticate the digital signature. Furthermore, when re-authenticating, the second symmetric key is also updated.

[0118] Therefore, the time interval between the last disconnection of the client and the next establishment of a connection (such as a TCP connection) with the server does not exceed the second session keep-alive period T c When the client and the server establish a connection, there is no need to authenticate again. The secret key and other related information used by both ends are consistent with the last communication, which is conducive to reducing the number of authentication times and improving the real-time performance of video conference signaling and code stream interaction. In other words, the present application can eliminate the need to perform authentication every time the client and the server establish a connection during the communication process, and the time interval between disconnection and establishment of the connection does not exceed the second session keep-alive period T c When the client authentication process is omitted after this connection.

[0119] According to multiple embodiments of the present application, the authentication information of the client and the server is highly scalable. Different business logics can be implemented according to different authentication information. Through the disconnection authentication mechanism, the present application can solve the problem of repeated authentication. By adding an authentication identifier to the authentication information, when the connection between the client and the server is disconnected, the client can send the authentication identifier to the server. Since the server has saved this authentication identifier, when the server receives the authentication identifier of the client again, if it is the same as the authentication identifier saved by the server, it means that the authentication has been passed before, and there is no need to authenticate again this time. Thereby, the authentication efficiency is improved, and the signaling interaction delay and bandwidth occupancy are reduced.

[0120] Furthermore, the present application adds a client registration message to the authentication information, thereby sending the client registration message to the server, so that the server actively invites the terminal to join the meeting under the network address translation networking mode, instead of only using the single and troublesome joining method of the terminal actively joining the meeting. The platform invites all terminals to join the meeting in a unified manner, greatly improving the efficiency of the meeting. At the same time, it can also reduce the message interaction between the client and the server.

[0121] Furthermore, in this application, authentication information, message digest algorithm, and public key are all encrypted in the network using quantum secret key, which is invisible and improves the confidentiality level. In addition, the authentication method of quantum encryption combined with asymmetric encryption (national secret or RSA) is more secure.

[0122] Furthermore, the present application completes the authentication of the client by the server through a single information interaction, and the process is simple. It can effectively avoid the problem of increased bandwidth usage, increased signaling interaction delay, and reduced real-time performance of signaling interaction due to multiple authentication message interactions in large-capacity conferences. The present application adopts a maximum of one authentication method between the client and the server. Within a session cycle, the server does not need to authenticate the client again if it connects and registers again, which improves the efficiency of program operation, simplifies the amount of calculation, and has a significant effect in large-capacity conferences.

[0123] The above examples illustrate multiple implementations of the present application, but the present application is not limited thereto. In each implementation, the addition, omission, and sequence change of steps are all within the protection scope of the present application; each implementation can be implemented individually or in combination.

[0124] This application also provides a digital signature system based on quantum encryption, such as Figure 5 As shown, the digital signature system includes a client 100, a server 200, and a quantum key machine 300. The client 100 is configured to execute Figure 1 The server 200 is configured to execute the following: Figure 3 The quantum key machine 300 is configured to distribute a quantum shared key to the client 100 and the server 200.

[0125] Specifically, when signature authentication is required between the client 100 and the server 200, the client 100 and the server 200 respectively request the quantum key machine 300 to obtain the quantum shared key. After receiving the request from the client 100 and the server 200, the quantum key machine distributes the same quantum shared key to the client 100 and the server 200 respectively. In a specific implementation, see Figure 6 , client 100A and client 100B need to conduct a video conference through server 200. Before conducting a video conference, it is necessary to register with server 200 through signature authentication of server 200. Therefore, client 100A and client 100B can respectively request the quantum key machine 300 to allocate a quantum shared key through network address translation 400. At the same time, server 200 also requests the quantum key machine 300 to allocate a quantum shared key. After receiving the request from server 200 and the request from client 100A and client 100B through network address translation 400, quantum key machine 300 allocates quantum shared keys to server 200, client 100A and client 100B respectively.

[0126] Specifically, for some applications that require a higher level of conference confidentiality, the client can be deployed in conjunction with network address conversion, so that the distribution, authentication, and signaling / code stream encryption of quantum shared keys can be implemented in conjunction with network address conversion to improve the security of data transmission. In the scenario of network address conversion, in order for the server to directly call the client in the network address conversion, each client can actively register its information to the server through a TCP connection, and then the server can actively call the client. As a result, the video conference divides the network into an intranet and an extranet through a network address conversion agent. By improving the communication method of the video conferencing protocol stack, the video conferencing equipment can pass through the network address conversion or firewall, and forward the signaling and code stream data to the destination through the proxy server, thereby realizing the establishment of a video conference. In the following embodiments, all are explained in conjunction with network address conversion, and this application is not limited to this. Application scenarios where network address conversion is not deployed are also within the scope of protection of this application.

[0127] Furthermore, after the client 100 and the server 200 obtain the quantum shared key, they can Figure 1 and Figure 3 The method shown is used to perform signature authentication. In a specific implementation, see Figure 7 The client 100A and the client 100B can respectively send an authentication message C0 to the server 200 through the network address translation 400 for the server 200 to perform authentication, and return the authentication result through the network address translation 400 to complete the signature authentication between the client 100A, 100B and the server 200.

[0128] After the authentication between the client 100 and the server 200 is completed, the authentication information used during the authentication can be used to encrypt the transmission of signaling and / or code streams between the client 100 and the server 200. Specifically, the authentication information includes at least a second symmetric key. The second symmetric key can be a shared key M1 randomly generated by the client 100. The shared key is randomly generated by the client, which reduces the steps of generating and managing a large number of client-server key pairs on the server side, and improves the performance of quantum encryption proxy server video conferencing. Therefore, after the server 200 successfully authenticates the client 100, the server 200 and the client 100 communicate in the following manner:

[0129] The client 100 uses the second symmetric key M1 to encrypt the first signaling and / or the first code stream D c1 , generate the first encrypted transmission data C m1 =E(M1,D c1), and can be sent to the server 200 via network address translation. The server 200 uses the second symmetric key M1 to decrypt the first encrypted transmission data C sent by the client 100 m1 =E(M1,D c1 ), obtain the first signaling and / or the first code stream D sent by the client c1 .

[0130] The server 200 uses the second symmetric key M1 to encrypt the second signaling and / or the second code stream Ds1 to generate the second encrypted transmission data S m1 =E(M1, Ds1), and sent to the client 100 via network address translation. The client 100 uses the second symmetric key M1 to decrypt the second encrypted transmission data S sent by the server. m1 , obtain the second signaling and / or the second code stream Ds1 sent by the server.

[0131] In some specific implementations, the server is connected to multiple clients. Figure 8 Taking the two clients 100A and 100B as examples, the data transmission process after both the clients 100A and 100B pass the authentication is described.

[0132] The client 100A uses the second symmetric key M randomly generated by the client 1A Encrypting the first signaling and / or the first code stream D c1A , generate the first encrypted transmission data C m1A =E(M1,D c1A ), and can be sent to the server 200 via network address translation. The server 200 uses the second symmetric key M 1A Decrypt the first encrypted transmission data C sent by the client 100A m1A =E(M1,D c1A ), obtain the first signaling and / or the first code stream D sent by the client c1A .

[0133] The server 200 uses the second symmetric key M of the client 100B 1B Encrypting the second signaling and / or the second code stream Ds 2B (In the data forwarding scenario, Ds 2B With D c1A Same), generate the second encrypted transmission data S m2B =E(M1, Ds 2B ), and sends it to the client 100B via network address translation. The client 100B uses the second symmetric key M 1BDecrypt the second encrypted transmission data S sent by the server m2B , obtain the second signaling and / or second code stream Ds sent by the server 2B The client 100B may send encrypted data to the server 200, and the server 200 may send encrypted data to the client 100A in the same manner, which will not be described in detail here.

[0134] In some specific implementations of the above embodiments, the code stream and signaling can be encrypted simultaneously when the client 100 and the server 200 communicate, so as to effectively prevent a third party from analyzing the conference signaling content through network packet capture and then attacking the video conference.

[0135] In some specific implementations of the above embodiments, the national secret SM4 algorithm can be used to encrypt signaling and code streams to prevent third parties from eavesdropping or cracking video conference data, thereby making video conference communications more secure and reliable.

[0136] See below Fig. 9 , Fig. 9 A schematic diagram of the quantum shared key distribution process of a quantum encryption-based digital signature system with multiple quantum key machines according to an embodiment of the present application is shown. In this embodiment, client 1, client 2, and server 1 are connected to quantum key machine 1, and client 3, client 4, and server 2 are connected to quantum key machine 2. Client 1, client 2, server 1, and quantum key machine 1 distribute quantum shared keys in the aforementioned manner; client 3, client 4, server 2, and quantum key machine 2 distribute quantum shared keys in the aforementioned manner. In order to realize communication between client 1, client 2, server 1 and client 3, client 4, and server 2, quantum key machine 1 and quantum key machine 2 also negotiate quantum shared keys.

[0137] Therefore, this application can achieve the expansion of the number of clients, servers and quantum key machines.

[0138] The above examples illustrate multiple implementations of the present application, but the present application is not limited thereto. In each implementation, the addition, omission, and sequence change of devices are all within the protection scope of the present application; each implementation can be implemented individually or in combination.

[0139] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a computer program is stored, and when the program is executed by, for example, a processor, the steps of the digital signature method based on quantum encryption described in any of the above embodiments can be implemented. In some possible implementations, various aspects of the present application can also be implemented in the form of a program product, which includes a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps of various exemplary implementations of the present application described in the digital signature method based on quantum encryption described in the above section of this specification.

[0140] refer to Fig.10 As shown, a program product 800 for implementing the above method according to an embodiment of the present application is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present application is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0141] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0142] The computer readable storage medium may include a data signal propagated in a baseband or as a part of a carrier wave, wherein a readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by an instruction execution system, an apparatus, or a device or used in combination with it. The program code contained on the readable storage medium may be transmitted by any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0143] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the tenant computing device, partially on the tenant device, as a separate software package, partially on the tenant computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device may be connected to the tenant computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0144] In an exemplary embodiment of the present disclosure, an electronic device is also provided, which may include a processor and a memory for storing executable instructions of the processor, wherein the processor is configured to execute the steps of the digital signature method based on quantum encryption in any of the above embodiments by executing the executable instructions.

[0145] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0146] Refer to the following Fig.11 The electronic device 600 according to this embodiment of the present application is described. Fig.11 The electronic device 600 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0147] like Fig.11 As shown, the electronic device 600 is in the form of a general computing device. The components of the electronic device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different system components (including the storage unit 620 and the processing unit 610), a display unit 640, etc.

[0148] The storage unit stores a program code, which can be executed by the processing unit 610, so that the processing unit 610 performs the steps according to various exemplary embodiments of the present application described in the digital signature method based on quantum encryption described above in this specification. For example, the processing unit 610 can perform the following steps: Figure 1 or the steps shown in 3.

[0149] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache memory unit 6202 , and may further include a read-only memory unit (ROM) 6203 .

[0150] The storage unit 620 may also include a program / utility 6204 having a set (at least one) of program modules 6205, such program modules 6205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include the implementation of a network environment.

[0151] Bus 630 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0152] The electronic device 600 may also communicate with one or more external devices 700 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may communicate with one or more devices that enable tenants to interact with the electronic device 600, and / or communicate with any device that enables the electronic device 600 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface 650. In addition, the electronic device 600 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 660. The network adapter 660 may communicate with other modules of the electronic device 600 through a bus 630. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0153] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, or a network device, etc.) to execute the above-mentioned digital signature method based on quantum encryption according to the implementation of the present disclosure.

[0154] It can be seen that the solution provided by this application has the following advantages compared with the prior art:

[0155] On the one hand, the quantum shared key is obtained by using a quantum key machine to encrypt the first public key in the digital signature, so that the quantum shared key can be used to determine that the first public key is sent by the client communicating with the quantum key machine, thereby determining the identity of the sender; on the other hand, the quantum shared key is used to enable the first public key to be encrypted and transmitted on the network, and a third party cannot crack it without the quantum shared key. Even if the message is intercepted and tampered with, there is no quantum shared key to encrypt the data, so that the server decryption fails and the digital signature authentication cannot be completed, thereby improving the authentication security; on the other hand, the quantum shared key is obtained by using a quantum key machine to encrypt the digital signature message, message digest algorithm and the first public key, so that the digital signature is absolutely confidential throughout the entire authentication process, preventing third parties on the network from tampering with and forging data; on the other hand, the authentication process is completed through a single data interaction between the client and the server, reducing multiple information interaction steps and improving data interaction efficiency.

[0156] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A digital signature method based on quantum encryption, characterized in that: Applied to the client, including: The client receives the quantum shared key assigned by the quantum key machine, and the quantum shared key is also assigned to the server; The client encrypts authentication information using the quantum shared key to generate first encrypted authentication data, where the authentication information is used for communication encryption between the client and the server; The client uses the quantum shared key to encrypt the randomly selected message digest algorithm to generate message digest algorithm encrypted data; The client executes the message digest algorithm on the authentication information to generate digital summary data of the authentication information; The client uses the quantum shared key to encrypt the first public key of the randomly generated first key pair to generate first public key encrypted data; The client encrypts the digital summary data using the first private key of the first key pair to generate a digital signature; The client sends the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data and the digital signature to the server, so that the server uses the quantum shared key to obtain the authentication information and authenticate the digital signature.

2. The digital signature method based on quantum encryption as claimed in claim 1, characterized in that: The authentication information includes at least a second symmetric key. After the server successfully authenticates the client: The client encrypts the first signaling and / or the first code stream using the second symmetric key to generate first encrypted transmission data, and sends the first encrypted transmission data to the server via network address translation; and / or The client uses the second symmetric key to decrypt the second encrypted transmission data sent by the server to obtain the second signaling and / or second code stream sent by the server.

3. The digital signature method based on quantum encryption as claimed in claim 2, characterized in that: The authentication information includes a first authentication identifier and an authentication identifier bit randomly generated by the client, the authentication identifier bit includes a first value for indicating that the client requests to continue connecting to the server and a second value for indicating that the client requests to re-authenticate with the server, and the method further includes: In response to the connection between the client and the server being disconnected, and the client requesting to continue the connection with the server, the client uses the first authentication identifier and the authentication identifier bit set to a first value as parameters of the authentication information, and again generates the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data, and the digital signature, and sends them to the server, so that the server can compare the first authentication identifier with the second authentication identifier locally stored on the server based on the value of the authentication identifier bit to determine whether the client has been successfully authenticated; In response to the server returning an authentication success message, the client continues to use the second symmetric key to perform signaling and / or code stream communication with the server; In response to the server returning an authentication failure, the client re-randomly generates a third authentication identifier, uses the third authentication identifier and the authentication identifier bit set to the second value as parameters of the authentication information, and again generates the first encrypted authentication data, message digest algorithm encrypted data, first public key encrypted data, and digital signature, and sends them to the server, so that the server can use the value of the authentication identifier bit to execute the steps of obtaining the authentication information using the quantum shared key and authenticating the digital signature.

4. The digital signature method based on quantum encryption as claimed in claim 3, characterized in that: The client sends the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data and the digital signature to the server, so that the server uses the quantum shared key to obtain the authentication information, and saves the first authentication identifier locally on the server as the second authentication identifier. In response to the time interval between the current time and the disconnection of the connection between the client and the server being less than or equal to the first session keep-alive period, the second authentication identifier is valid.

5. The digital signature method based on quantum encryption as claimed in claim 4, characterized in that: The client uses the first authentication identifier and the authentication identifier bit set to the first value as parameters of the authentication information, generates the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data, and the digital signature again, and sends them to the server, including: In response to the time interval between the current time and the disconnection of the connection between the client and the server being less than or equal to a second session keep alive period, the client uses the first authentication identifier and the authentication identifier bit set to a first value as parameters of the authentication information, generates the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data, and the digital signature again, and sends them to the server, wherein the second session keep alive period is less than the first session keep alive period; In response to the time interval between the current time and the disconnection of the connection between the client and the server being greater than the second session keep-alive period, the client randomly regenerates the third authentication identifier, uses the third authentication identifier and the authentication identifier bit set to the second value as parameters of the authentication information, and again performs the generation of the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data, and the digital signature, and sends them to the server side, so that the server side uses the value of the authentication identifier bit to execute the steps of obtaining the authentication information using the quantum shared key and authenticating the digital signature.

6. A digital signature method based on quantum encryption, characterized in that: Applied to the server side, including: The server receives the quantum shared key assigned by the quantum key machine, and the quantum shared key is also assigned to the client; The server receives the first encrypted authentication data, the message digest algorithm encrypted data, the first public key encrypted data and the digital signature sent by the client by executing the digital signature method based on quantum encryption according to any one of claims 1 to 5; The server uses the quantum shared key to decrypt the first encrypted authentication data to obtain the authentication information; The server uses the quantum shared key to decrypt the message digest algorithm encrypted data to obtain the message digest algorithm; The server uses the quantum shared key to decrypt the first public key encrypted data to obtain the first public key of the first key pair; The server uses the first public key to decrypt the digital signature to obtain first digital summary data to be authenticated; The server executes the message digest algorithm on the authentication information to obtain second digital digest data to be authenticated; In response to the first digital summary data to be authenticated being consistent with the second digital summary data to be authenticated, the server sends an authentication success message to the client.

7. The digital signature method based on quantum encryption as claimed in claim 6, characterized in that: The authentication information includes at least a second symmetric key. After the server successfully authenticates the client: The server encrypts the second signaling and / or the second code stream using the second symmetric key to generate second encrypted transmission data, and sends the second encrypted transmission data to the client via network address translation; and / or The server uses the second symmetric key to decrypt the first encrypted transmission data sent by the client to obtain the first signaling and / or the first code stream sent by the client.

8. A digital signature system based on quantum encryption, characterized in that: include: A client, configured to execute the digital signature method based on quantum encryption as described in any one of claims 1 to 5; The server is configured to execute the digital signature method based on quantum encryption as claimed in claim 6 or 7; and A quantum key machine is configured to distribute a quantum shared key to the client and the server.

9. The quantum encrypted digital signature system according to claim 8, characterized in that: The client requests a quantum shared key from the quantum key machine through network address conversion, and the quantum key machine distributes a quantum shared key to the client through the network address conversion.

10. The quantum encrypted digital signature system according to claim 8, characterized in that: There are multiple quantum key machines, and the multiple quantum key machines negotiate a quantum shared key to determine the quantum shared key allocated to the server and client ends respectively connected thereto.

Images