An authentication data processing method, apparatus, system, device, and medium

Abstract

The application discloses an authentication data processing method, device, system, equipment and medium. The application receives authentication data returned by a server, wherein the first true random number is generated by the server through a quantum random number generator; the first true random number encrypted by the private key in the server certificate is decrypted according to the public key in the server certificate to obtain the decrypted first true random number; the first true random number is encrypted according to the private key in the client certificate and the first quantum key to obtain the encrypted first encrypted data; and the first encrypted data is sent to the server, wherein the first encrypted data is used for the server to perform identity authentication on the client. According to the embodiment of the application, the difficulty of forcibly cracking data in the authentication process is increased, and the security of the authentication process is further improved.

Description

Technical Field

[0001] This application belongs to the field of information security technology, and in particular relates to an authentication data processing method, apparatus, system, device and medium. Background Technology

[0002] For information security, the server and client need to authenticate each other before establishing an encrypted session.

[0003] Currently, the most common authentication methods between mobile clients and servers include account and password-based authentication, mobile phone number and SMS verification code-based authentication, and SIM card digital certificate-based authentication. The first two methods often carry the risk of data breaches during the authentication process, making them insecure and compromising user information security. SIM card digital certificate-based authentication also faces a high risk of data breaches, making the authentication process still insecure.

[0004] Therefore, how to increase the difficulty of brute-force attacks on authentication data and further improve authentication security has become an urgent technical problem to be solved. Summary of the Invention

[0005] This application provides an authentication data processing method, apparatus, system, device, and medium, which can increase the difficulty of brute-force attacks on authentication data and further improve authentication security.

[0006] In a first aspect, embodiments of this application provide an authentication data processing method, including:

[0007] Send an authentication request to the server;

[0008] The server receives authentication data, which includes a server certificate and a first true random number encrypted with the private key in the server certificate. The first true random number is generated by the server using a quantum random number generator.

[0009] Based on the public key in the server certificate, the first true random number encrypted by the private key in the server certificate is decrypted to obtain the first true random number.

[0010] The first true random number is encrypted using the private key in the client certificate and the first quantum key to obtain the first encrypted data, wherein the first quantum key is a quantum key determined from the quantum key pool by the target quantum key selection algorithm;

[0011] The first encrypted data is sent to the server, wherein the first encrypted data is used by the server to authenticate the client.

[0012] In one embodiment, after obtaining the first encrypted data, the method further includes:

[0013] Generate a second random number, wherein the second random number includes a true random number generated by a quantum random number generator or a pseudo random number generated by a pseudo random number generation algorithm;

[0014] The second random number is encrypted using the public key in the server certificate to obtain the encrypted second random number.

[0015] The encrypted second random number and the first encrypted data are sent to the server.

[0016] In one embodiment, before sending the authentication request to the server, the method further includes:

[0017] Generate a first random number, wherein the first random number includes a true random number generated by a random number generator or a pseudo random number generated by a pseudo random number generation algorithm;

[0018] An authentication request is generated based on the client certificate, the quantum key selection algorithm supported by the client, the session encryption algorithm supported by the client, and the first random number.

[0019] In one embodiment, after sending the encrypted second random number and the first encrypted data to the server, the method further includes:

[0020] Based on the first random number, the first true random number, and the second random number, a first session key is generated using the target session encryption algorithm, wherein the first session key is used to encrypt session data between the client and the server.

[0021] In one embodiment, before generating the first random number, the method further includes:

[0022] In the absence of a network, the system receives a client certificate issued by a certificate server and a quantum key pool. The client certificate includes a digital certificate generated by the certificate server based on the client's real information, and the quantum key pool is used to store quantum keys.

[0023] Secondly, embodiments of this application provide an authentication data processing method, applied to a server, comprising:

[0024] In response to an authentication request sent by a client, a first true random number is generated using a quantum random number generator, wherein the authentication request includes a quantum key selection algorithm supported by the client and a session encryption algorithm supported by the client;

[0025] Encrypt the first true random number using the private key in the server certificate to obtain the first true random number encrypted with the private key in the server certificate.

[0026] Based on the quantum key selection algorithm and the session encryption algorithm supported by the client, the quantum key selection algorithm supported by the server and the session encryption algorithm supported by the client are determined respectively, thus obtaining the target quantum key selection algorithm and the target session encryption algorithm.

[0027] Authentication data is generated based on the server certificate, the first true random number encrypted with the private key in the server certificate, the target session encryption algorithm, and the target quantum key selection algorithm.

[0028] The authentication data is sent to the client.

[0029] In one embodiment, after sending the authentication data to the client, the method further includes:

[0030] Receive the encrypted second random number and the first encrypted data sent by the client;

[0031] The first encrypted data is decrypted using the public key in the client certificate to obtain the first true random number encrypted with the first quantum key;

[0032] Based on the second quantum key, the first true random number encrypted by the first quantum key is decrypted to obtain decrypted data, wherein the second quantum key is a quantum key determined in the client quantum key pool through the target quantum key selection algorithm;

[0033] When the decrypted data matches the first true random number, the encrypted second random number is decrypted using the private key in the server certificate to obtain the second random number.

[0034] In one embodiment, after decrypting the encrypted second random number based on the private key in the server certificate to obtain the second random number, the method further includes:

[0035] Based on the first random number, the second random number, and the first true random number, a second session key is established using a target session encryption algorithm, wherein the second session key is used to encrypt session data between the server and the client.

[0036] Thirdly, embodiments of this application provide an authentication data processing apparatus, the apparatus comprising:

[0037] The first sending module is used to send authentication requests to the server;

[0038] The first receiving module is used to receive authentication data returned by the server, wherein the authentication data includes a server certificate and a first true random number encrypted by the private key in the server certificate;

[0039] The first decryption module is used to decrypt the first true random number encrypted by the private key in the server certificate according to the public key in the server certificate, so as to obtain the decrypted first true random number.

[0040] The first encryption module is used to encrypt the first true random number based on the private key in the client certificate and the first quantum key to obtain the encrypted first encrypted data, wherein the first quantum key is a quantum key determined from the quantum key pool by the target quantum key selection algorithm;

[0041] The second sending module is used to send the first encrypted data to the server, wherein the first encrypted data is used by the server to authenticate the client.

[0042] Fourthly, embodiments of this application provide an authentication data processing apparatus applied to a server, the apparatus comprising:

[0043] The first generation module is used to respond to the authentication request sent by the client and generate a first true random number through a quantum random number generator. The authentication request includes the quantum key selection algorithm supported by the client, the session encryption algorithm supported by the client, and the client certificate.

[0044] The second encryption module is used to encrypt the first true random number according to the private key in the server certificate, so as to obtain the first true random number encrypted by the private key in the server certificate.

[0045] The determining module is used to determine the quantum key selection algorithm and session encryption algorithm supported by the server based on the quantum key selection algorithm and session encryption algorithm supported by the client, so as to obtain the target session encryption algorithm and the target quantum key selection algorithm.

[0046] The second generation module is used to generate authentication data based on the server certificate, the first true random number encrypted by the private key in the server certificate, the target session encryption algorithm, and the target quantum key selection algorithm;

[0047] The third sending module is used to send the authentication data to the client.

[0048] Fifthly, embodiments of this application provide an authentication data processing system, the system comprising:

[0049] The client includes a quantum identity card and a communication module.

[0050] The communication module is used to: send an authentication request to the server; receive authentication data returned by the server, wherein the authentication data includes a server certificate and a first true random number encrypted by the private key in the server certificate; and send the first encrypted data to the server, wherein the first encrypted data is used by the server to authenticate the client.

[0051] The quantum identity card is used to: decrypt the first true random number encrypted by the private key in the server certificate according to the public key in the server certificate, to obtain the decrypted first true random number; encrypt the first true random number according to the private key in the client certificate and the first quantum key, to obtain the encrypted first encrypted data, wherein the first quantum key is a quantum key determined from the quantum key pool by the target quantum key selection algorithm.

[0052] Sixthly, embodiments of this application provide an authentication data processing device, the device comprising:

[0053] Processor and memory storing computer program instructions;

[0054] When the processor executes the computer program instructions, it implements the authentication data processing method described in any embodiment of this application.

[0055] In a seventh aspect, embodiments of this application provide a computer storage medium storing computer program instructions, which, when executed by a processor, implement the authentication data processing method as described in any embodiment of this application.

[0056] This application discloses an authentication data processing method, apparatus, system, device, and medium. A first truly random number is generated by the server using a quantum random number generator. This ensures greater randomness and unpredictability compared to pseudo-random numbers generated by algorithms, while avoiding client-generated truly random numbers. Cracking the first truly random number would require attacking the server device first, further increasing the difficulty of cracking it. The received first truly random number is encrypted using the server's public key, further increasing the difficulty of data decryption. The first truly random number is then encrypted using the private key in the server certificate, decrypted using the public key, and then encrypted again using the client's private key and a first quantum key. This increases the complexity of data interaction during the authentication process, ensuring data security. Furthermore, the chosen quantum key itself has high security, making the resulting encrypted data even more secure and difficult to crack. Using this highly secure and difficult-to-crack first encrypted data to authenticate the client's identity ensures client information security and further enhances authentication security. Attached Figure Description

[0057] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 This is a schematic diagram of the authentication process for access authentication methods based on SIM card digital certificates in existing technologies;

[0059] Figure 2 This application provides an authentication data processing system.

[0060] Figure 3 This is a schematic diagram of an authentication data processing method provided in an embodiment of this application;

[0061] Figure 4 This is a schematic diagram of another authentication data processing method provided in an embodiment of this application;

[0062] Figure 5 This is a schematic diagram of another authentication data processing method provided in the embodiments of this application;

[0063] Figure 6 This is a schematic diagram of another authentication data processing method provided in the embodiments of this application;

[0064] Figure 7 This is a schematic diagram of an authentication data processing device provided in an embodiment of this application;

[0065] Figure 8 This is a schematic diagram of another authentication data processing device provided in an embodiment of this application. Detailed Implementation

[0066] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0067] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0068] First, let's introduce the technical terms used in this application specification:

[0069] Digital certificate: A data structure issued by a Certificate Authority (CA) based on relevant materials or information of a user, which includes information about the public key owner, the public key, the issuer, the validity period, and extended information.

[0070] Secure Element (SE): A carrier that enables secure data storage, encryption / decryption operations, and other functions through a secure chip and / or chip operating system. It can be packaged in various forms. Common secure elements include Subscriber Identification Module (SIM) cards and hardware digital certificate carriers (Universal Serial Bus Key, USB Key), etc.

[0071] Existing authentication methods commonly include account-password-based access authentication, mobile phone number and SMS verification code-based access authentication, and SIM card digital certificate-based access authentication. Account-password-based access authentication involves users registering an account and setting a password within the application system, then entering their account and password to log in. Mobile phone number and SMS verification code-based access authentication involves users logging in using their mobile phone number and a dynamically obtained SMS verification code. Both of these authentication methods are often at risk of data breaches during the authentication process, making the authentication process insecure.

[0072] The SIM card digital certificate-based access authentication method primarily aims to confirm that only legitimate users can access the system; its focus is not on the security of the authentication process itself. Under this method, users first need to register with a CA (Certificate Authority) using valid credentials and obtain a CA certificate. The application system verifies the certificate of the user requiring login through an identity authentication gateway. When logging into the application system, the user submits certificate information to the identity authentication gateway, which verifies the certificate with the CA online or offline. Only authenticated users can further access the application system. Client-side personal certificates are mainly used for identity verification and electronic signatures. They are typically stored in a dedicated smart key and require a protection password for use. Using this certificate requires physical access to its storage medium, the smart key, and knowledge of the smart key's protection password. The main authentication process between the server and client is as follows: Figure 1 As shown, the main steps include:

[0073] S110, the client sends a request to the server to establish a connection.

[0074] S120, the server sends a digital certificate to the client.

[0075] S130: The client verifies the digital certificate. After successful certificate verification, the client sends the certificate to the server and generates a session key.

[0076] S140, the server verifies the client's certificate and generates a session key.

[0077] S150, the client and server begin an encrypted session.

[0078] The inventors considered that although this two-way authentication method between the server and the client can confirm legitimate users through digital certificates issued by CA institutions, the data exchange during the authentication process is not complicated. Moreover, digital certificates are often stored in secure carriers. With quantum computers breaking public keys to obtain private keys in increasingly shorter times, the data related to digital certificates stored in secure carriers is at risk of being cracked. This means that the data in the authentication process of the SIM card digital certificate-based access authentication method is still at risk of being cracked, and the authentication process is still insecure.

[0079] To increase the difficulty of brute-force attacks on authentication data and further enhance the security of the authentication process, the inventors considered an access authentication method based on symmetric quantum keys. This method first obtains a quantum key from the quantum communication network and then infuses it into a quantum certificate module via a quantum key injection machine. The quantum certificate module is stored in a secure carrier. During authentication, the client randomly selects a quantum key from the quantum key stored in the quantum certificate module, uses a symmetric encryption algorithm to generate authentication data, completes the generation of access authentication information, and sends a data packet to the quantum-secure access authentication gateway. The quantum-secure access authentication gateway has synchronously stored the quantum key distributed by the quantum communication network, the quantum key number, the client's correspondence, and the validity period. Finally, the quantum-secure access authentication gateway extracts the authentication data and the quantum key number from the received data packet, extracts the corresponding key according to the number, and uses a symmetric decryption algorithm to decrypt the authentication data into plaintext data, ultimately completing the authentication.

[0080] The inventors discovered that while symmetric quantum key distribution (SQK)-based access authentication appears to improve security, it doesn't involve verifying the client's identity during the authentication process. This means that such authentication methods are vulnerable to malicious impersonation by the client, making them insecure for the client and posing a risk of leaking critical information needed for user identification. Therefore, the inventors proposed a two-way authentication process between the client and server. The server generates a truly random number, which is then encrypted using the server's certificate private key, the client's quantum key, and the client's certificate private key before being transmitted to the server. The server decrypts the data and compares the true random number to verify the client's identity. This verifies the client's identity and generates a highly secure session key, mitigating the risk of data breaches during authentication and enhancing overall security.

[0081] To address the problems of the prior art, embodiments of this application provide an authentication data processing method, apparatus, system, device, and medium. The following first describes an authentication data processing system provided by an embodiment of this application.

[0082] Figure 2 An authentication data processing system according to an embodiment of this application is shown. The system includes:

[0083] Client 210 and server 220, wherein client 210 includes quantum user identification card 211 and communication module 212;

[0084] The communication module 212 is used to: send an authentication request to the server; receive authentication data returned by the server, wherein the authentication data includes a server certificate and a first true random number encrypted by the private key in the server certificate; and send the first encrypted data to the server, wherein the first encrypted data is used by the server to authenticate the client.

[0085] The quantum user identification card 211 is used to: decrypt the first true random number encrypted by the private key in the server certificate to obtain the decrypted first true random number; encrypt the first true random number according to the private key in the client certificate and the first quantum key to obtain the first encrypted data, wherein the first quantum key is a quantum key determined from the quantum key pool by the target quantum key selection algorithm.

[0086] Specifically, at least one client 210 interacts with the server 220 through the communication module 212, and the client 210 interacts with the quantum identity card 211 through the communication module 212.

[0087] Specifically, the communication module 212 may include a SIM card channel (Open Mobile API, OMA). After the client sends the authentication data returned by the server to the quantum user identity card 211 via the OMA, the quantum user identity card 211 uses the public key of the server certificate included in the authentication data to decrypt the first true random number encrypted with the private key in the server certificate. Then, the quantum user identity card 211 uses the private key in the client certificate and the first quantum key to encrypt the first true random number to obtain the first encrypted data. The quantum user identity card 211 sends the first encrypted data to the client 210 via the communication module 212, or the client 210 accesses the quantum user identity card 211 via the communication module 212, reads the first encrypted data, and then sends the first encrypted data to the server 220 via the communication module 212.

[0088] In one embodiment, the quantum user identification card 211 may include a processing chip, which may include storage of digital certificates and quantum key pools, generation of true random numbers, generation of pseudo random numbers, quantum key selection algorithm and interface service for quantum key pools, selection of quantum key encryption data, and private key encryption and public key decryption services for digital certificates.

[0089] In one embodiment, client 210 may include a mobile client.

[0090] In the system described in this embodiment, the first truly random number received by the client 210 through the communication module 212 is generated by the server 220 using a quantum random number generator. This ensures that the first truly random number is more random and unpredictable than pseudo-random numbers generated by algorithms, while avoiding the need for the client 210 to generate the first truly random number. To crack the first truly random number, the server 220 device must first be attacked, further increasing the difficulty of cracking the first truly random number. Furthermore, the received first truly random number is encrypted using the public key of the server certificate, further increasing the difficulty of data cracking. The first truly random number is encrypted using the private key in the server certificate, then decrypted using the public key in the server certificate, and then encrypted again using the private key of the client certificate and the first quantum key. This increases the complexity of data interaction during the authentication process, ensuring data security. The chosen quantum key itself has high security, making the resulting encrypted data even more secure and difficult to crack. Using this highly secure and difficult-to-crack first encrypted data to authenticate the client's identity ensures the client's information security and further improves authentication security.

[0091] To increase the difficulty of cracking authentication data, in one embodiment, such as Figure 2 The authentication data processing system provided in the embodiment of this application shown may further include:

[0092] Server 220 is configured to: respond to an authentication request sent by a client; generate a first true random number using a quantum random number generator, wherein the authentication request includes a quantum key selection algorithm supported by the client, a session encryption algorithm supported by the client, and a client certificate; encrypt the first true random number using the private key in the server certificate to obtain a first true random number encrypted with the private key in the server certificate; determine the quantum key selection algorithm and the session encryption algorithm supported by the server based on the quantum key selection algorithm and the session encryption algorithm supported by the client, respectively, to obtain a target session encryption algorithm and a target quantum key selection algorithm; generate authentication data based on the server certificate, the first true random number encrypted with the private key in the server certificate, the target session encryption algorithm, and the target quantum key selection algorithm; and send the authentication data to the client.

[0093] In this embodiment, the server 220 generates a first truly random number, ensuring greater randomness and unpredictability compared to pseudo-random numbers generated by algorithms. This avoids the client from generating the truly random number itself. The server encrypts the first truly random number using the public key of its server certificate, protecting it. Furthermore, cracking the first truly random number requires attacking the server device first, further increasing the difficulty of attacking and cracking it. The server 220 can also select a target quantum key selection algorithm and a target session encryption algorithm supported by both the server and the client, based on the algorithms supported by the client, and send the selected algorithms along with authentication data to the client. In other words, the target quantum key selection algorithm and the target session encryption algorithm used in the authentication process are negotiated between the server and the client. It is understood that the probability of the negotiated target quantum key selection algorithm and target session encryption algorithm being the same for each authentication is very small, further increasing the difficulty of maliciously cracking the authentication and enhancing its security.

[0094] To avoid the risk of client user identity being impersonated, in one embodiment, such as Figure 2 The authentication data processing system provided in the embodiment of this application shown may further include:

[0095] Server 220 is configured to: receive an encrypted second random number and first encrypted data sent by a client; decrypt the first encrypted data according to the public key in the client certificate to obtain the first true random number encrypted by the first quantum key; decrypt the first true random number encrypted by the first quantum key according to the second quantum key to obtain decrypted data, wherein the second quantum key is a quantum key determined in the client's quantum key pool through a target quantum key selection algorithm; when the decrypted data is consistent with the first true random number, decrypt the encrypted second random number according to the private key in the server certificate to obtain the second random number.

[0096] In this embodiment, the decrypted data compared with the first true random number is obtained by server 220 using the public key in the client certificate and the second quantum key to decrypt the first encrypted data. It can be understood that the client certificate is a digital certificate corresponding to the client's real identity, and therefore the public key used by server 220 in the client certificate also corresponds to the client's real identity. Furthermore, the second quantum key is a quantum key determined in the client's quantum key pool using a target quantum key selection algorithm. When the decrypted data matches the first true random number, it means that the public key in the client certificate used by server 220 corresponds to the private key in the client certificate, indicating that it is the same client's client certificate. This proves that the client has not been impersonated. The second quantum key is also from the same client's quantum key pool as the first quantum key, further confirming that the client 210 corresponding to the first encrypted data is a trusted client. Only after confirming that the client is a trusted client does server 220 decrypt the encrypted second random number sent by the client, thus avoiding the risk of the client user being impersonated. In addition to using the public key in the client certificate to decrypt the data, a second quantum key is also required. Compared to authentication schemes that only use the public key in the client certificate, this adds an extra layer of quantum key protection, which increases the difficulty of cracking the authentication data and further improves the security of the authentication.

[0097] Figure 3 This illustration shows a flowchart of an authentication data processing method provided in an embodiment of this application, which is applied to... Figure 2 The system and method shown include:

[0098] S310 sends an authentication request to the server.

[0099] S320, Receive authentication data returned by the server, wherein the authentication data includes a server certificate and a first true random number encrypted by the private key in the server certificate, the first true random number being generated by the server using a quantum random number generator.

[0100] S330, based on the public key in the server certificate, decrypt the first true random number encrypted by the private key in the server certificate to obtain the first true random number.

[0101] S340, based on the private key in the client certificate and the first quantum key, encrypt the first true random number to obtain the first encrypted data, wherein the first quantum key is a quantum key determined from the quantum key pool through a target quantum key selection algorithm.

[0102] S350, the first encrypted data is sent to the server, wherein the first encrypted data is used by the server to authenticate the client.

[0103] In this embodiment, the first truly random number is generated by the server using a quantum random number generator. This ensures greater randomness and unpredictability compared to pseudo-random numbers generated by algorithms, while avoiding client-generated truly random numbers. Cracking the first truly random number would require attacking the server device first, further increasing the difficulty of cracking it. Furthermore, the received first truly random number is encrypted using the server's public key, further increasing the difficulty of data decryption. The first truly random number is encrypted using the private key in the server certificate, then decrypted using the public key, and subsequently encrypted again using the client's private key and the first quantum key. This increases the complexity of data interaction during authentication, ensuring data security. The chosen quantum key itself has high security, making the resulting encrypted data even more secure and difficult to crack. Using this highly secure and difficult-to-crack first encrypted data to authenticate the client's identity ensures client information security and further enhances authentication security.

[0104] The steps described above will be explained in detail below.

[0105] In the S310, specifically, the client sends the authentication request to the server via the communication module. Understandably, the communication module supports common communication methods, such as 4G, 5G, and Wi-Fi.

[0106] To further enhance authentication security, in one embodiment, such as Figure 4 The schematic diagram of another authentication data processing method provided in this application embodiment, shown below, may further include steps S410-S420 before sending the authentication request to the server.

[0107] S410, Generate a first random number, wherein the first random number includes a true random number generated by a random number generator or a pseudo random number generated by a pseudo random number generation algorithm.

[0108] S420: Generate an authentication request based on the client certificate, the quantum key selection algorithm supported by the client, the session encryption algorithm supported by the client, and the first random number.

[0109] In this embodiment, a first random number is generated before sending an authentication request to the server. The authentication request is then generated based on this random number, the client certificate, the quantum key selection algorithm supported by the client, and the session encryption algorithm supported by the client. It is understood that a new first random number is generated before each authentication request is sent to the server. This means that each authentication request received by the server will be different because it includes the first random number, increasing the unpredictability of each authentication request and thus improving authentication security before it begins.

[0110] The following is a detailed introduction to S410-S420.

[0111] In S410, specifically, the client accesses the quantum user identification card through the communication module and reads the first random number generated by the pseudo-random number generation algorithm pre-set in the quantum user identification card, or the client accesses the quantum user identification card through the communication module and reads the first random number generated by the quantum random number generator pre-set in the quantum user identification card.

[0112] To ensure the security of authentication data, in one embodiment, such as Figure 4 The schematic diagram of another authentication data processing method provided in this application embodiment, shown below, may further include step S401 before generating the first random number.

[0113] S401, In the absence of a network, receive a client certificate issued by a certificate server and a quantum key pool, wherein the client certificate includes a digital certificate generated by the certificate server based on the client's real information, and the quantum key pool is used to store quantum keys.

[0114] Specifically, the client certificate and quantum key pool received by the client can be injected into the client's quantum user identity card offline via a filling machine, or via a device such as a USB flash drive that does not require a network connection. The size of the quantum key pool does not exceed the storage capacity of the quantum user identity card. It can be understood that each client certificate has a corresponding quantum key pool. The digital certificate generated by the certificate server based on the client's real information is also a digital certificate specific to that client's identity.

[0115] In this embodiment, the client certificate and quantum key pool issued by the certificate server are received without a network connection, avoiding data leakage issues when connected to the public network and ensuring the security of the client certificate and quantum key pool, further guaranteeing the security of the authentication data. Furthermore, the received client certificate is a digital certificate generated based on the client's real identity; that is, the client certificate can represent the client's identity.

[0116] The above describes the specific implementation of S410. The following describes the specific implementation of S420.

[0117] In S420, specifically, the client accesses the quantum user identity card through the communication module, reads the client certificate, the quantum key selection algorithm supported by the client, the session encryption algorithm supported by the client, and the first random number stored in the quantum user identity card, and then generates an authentication request including the client certificate, the quantum key selection algorithm supported by the client, the session encryption algorithm supported by the client, and the first random number.

[0118] The above describes the specific implementation of S310. The following describes the specific implementation of S320.

[0119] In S320, specifically, the client receives authentication data returned by the server through the communication module. The first true random number is generated by the server using a quantum random number generator.

[0120] To verify the reliability and legitimacy of the server certificate and further improve authentication security, in one embodiment, after receiving the authentication data returned by the server, the client may further include...

[0121] Verify the server certificate to obtain the verification result of the server certificate, wherein the server certificate includes the certificate public key, enterprise information, domain name expiration time, and the algorithm supported by the server.

[0122] When the verification result meets the preset conditions, the first true random number encrypted by the private key in the server certificate is decrypted, wherein the preset conditions include at least one of the following: the server certificate has not been revoked, the server certificate has not expired, and the domain name in the server certificate is consistent with the domain name of the server.

[0123] The above describes the specific implementation of S320. The following describes the specific implementation of S330.

[0124] Specifically, in S330, the client sends the authentication data returned by the server to the quantum user identity card through the communication module. The quantum user identity card uses the public key in the server certificate to decrypt the first true random number encrypted by the private key in the server certificate to obtain the first true random number.

[0125] In S340, specifically, the quantum user identification card can first encrypt the first true random number using the first quantum key, then encrypt it again using the private key in the client certificate, and finally store the resulting encrypted data in the quantum user identification card. Alternatively, the quantum user identification card can first encrypt the first true random number using the private key in the client certificate, then encrypt it again using the first quantum key, and finally store the resulting encrypted data in the quantum user identification card. This application embodiment does not limit the encryption order of the first true random number.

[0126] To further enhance authentication security, in one embodiment, such as Figure 4 The schematic diagram shown in this application embodiment illustrates another authentication data processing method, which may further include steps S430-S450 after obtaining the first encrypted data.

[0127] S430, Generate a second random number, wherein the second random number includes a true random number generated by a quantum random number generator or a pseudo random number generated by a pseudo random number generation algorithm.

[0128] Specifically, the client accesses the quantum user identification card through the communication module and reads the second random number generated by the pseudo-random number generation algorithm pre-set within the quantum user identification card; or the client accesses the quantum user identification card through the communication module and reads the second random number generated by the quantum random number generator pre-set within the quantum user identification card.

[0129] S440, encrypt the second random number according to the public key in the server certificate to obtain the encrypted second random number.

[0130] Specifically, the client sends the authentication data returned by the server, including the public key in the server certificate, to the quantum user identity card through the communication module. The quantum user identity card uses the public key in the server certificate to encrypt the second random number and stores the encrypted second random number in the quantum user identity card.

[0131] S450, the encrypted second random number and the first encrypted data are sent to the server.

[0132] Specifically, the client accesses the quantum user identification card through the communication module, reads the encrypted second random number and the first encrypted data stored in the quantum user identification card, and then sends the second random number and the first encrypted data to the server through the communication module.

[0133] In this embodiment, a second random number is generated and encrypted using the public key of the server certificate. It can be understood that a new second random number will be generated each time encrypted data is obtained, which can enhance the randomness of the authentication data, increase the difficulty of data being cracked, and the random number is encrypted when sent to the server, which can effectively prevent malicious injection or replay attacks, thereby further improving the security of authentication.

[0134] The above describes the specific implementation of S340. The following describes the specific implementation of S350.

[0135] Specifically, in S350, the client accesses the quantum user identification card through the communication module, reads the first encrypted data, and then sends the first encrypted data to the server through the communication module.

[0136] The above describes the specific implementation of S350.

[0137] Based on the foregoing, it can be understood that the first random number, the first truly random number, and the second random number are not generated by the same device all at once. The first truly random number is generated by the server before the client sends an authentication request to the server. The second random number is generated after the client encrypts the first truly random number to obtain the first encrypted data. This means that each authentication will generate a different first random number, first truly random number, and second random number, and there is no necessary connection between these three random numbers.

[0138] Therefore, in order to improve the security of authentication results, in one embodiment, such as Figure 4 The schematic diagram of another authentication data processing method provided in this application embodiment, after sending the encrypted second random number and the first encrypted data to the server, may further include step S460.

[0139] S460, Based on the first random number, the first true random number, and the second random number, a first session key is generated using the target session encryption algorithm, wherein the first session key is used to encrypt session data between the client and the server.

[0140] Specifically, the quantum user identification card generates a first session key for encrypting session data between the client and the server based on a first random number, a first true random number, and a second random number using a target session encryption algorithm. The client accesses the quantum user identification card through the communication module, reads the first session key, and then conducts a session with the server using the first session key.

[0141] In this embodiment, the first random number, the first truly random number, and the second random number used to generate the first session key using the target session encryption algorithm are all different each time. Moreover, the first random number, the first truly random number, and the second random number are also different from each other. This means that the first session key generated using these three random numbers is more unpredictable and more difficult to crack. Furthermore, at least one of these three random numbers is a truly random number, which further increases the difficulty of cracking the first session key and improves its security. Consequently, when the first session key is used to encrypt session data between the client and the server, the session data is difficult to crack, effectively preventing eavesdropping and improving the security of the authentication result.

[0142] To increase the difficulty of cracking authentication data, in one embodiment, such as Figure 5 The illustrated flowchart of another authentication data processing method provided in this application embodiment is applied to a server. The method includes,

[0143] S510, in response to the authentication request sent by the client, generates a first true random number using a quantum random number generator, wherein the authentication request includes a quantum key selection algorithm supported by the client and a session encryption algorithm supported by the client.

[0144] Specifically, after receiving the authentication request sent by the client, the server stores the data in the authentication request on the server and generates the first true random number by triggering the quantum random number generator installed on the server.

[0145] In one embodiment, the authentication request may include a quantum key selection algorithm supported by the client, a session encryption algorithm supported by the client, a client certificate, and a quantum key pool. After receiving the authentication request sent by the client, the server stores the client certificate and the quantum key pool in the server.

[0146] S520: Encrypt the first true random number according to the private key in the server certificate to obtain the first true random number encrypted with the private key in the server certificate.

[0147] Specifically, the server uses the private key in the server certificate to encrypt the first true random number, thus obtaining the first true random number encrypted with the private key in the server certificate.

[0148] S530, based on the quantum key selection algorithm and the session encryption algorithm supported by the client, determine the quantum key selection algorithm supported by the server and the session encryption algorithm supported by the client respectively, and obtain the target quantum key selection algorithm and the target session encryption algorithm.

[0149] In one embodiment, the server selects an algorithm supported by the server from the algorithms supported by the client, and uses it as the target quantum key selection algorithm for the quantum key pool stored by the server after receiving the client's authentication request, as well as the target session encryption algorithm for generating the session key after authentication.

[0150] S540, generate authentication data based on the server certificate, the first true random number encrypted with the private key in the server certificate, the target session encryption algorithm, and the target quantum key selection algorithm.

[0151] S550, the authentication data is sent to the client.

[0152] Specifically, the authentication data sent by the server to the client may include the server certificate, a first true random number encrypted with the private key in the server certificate, the target session encryption algorithm, and the target quantum key selection algorithm.

[0153] In this embodiment, the server generates a first truly random number, ensuring greater randomness and unpredictability compared to pseudo-random numbers generated by algorithms. This avoids the client from generating the truly random number itself. The server encrypts the first truly random number using the public key of its server certificate, protecting it. Furthermore, cracking the first truly random number requires attacking the server device first, further increasing the difficulty of attacking and cracking it. The server can also select a target quantum key selection algorithm and a target session encryption algorithm supported by both the server and the client, based on the algorithms supported by the client, and send the selected algorithms along with authentication data to the client. In other words, the target quantum key selection algorithm and the target session encryption algorithm used in the authentication process are negotiated between the server and the client. It is understandable that the probability of the negotiated target quantum key selection algorithm and target session encryption algorithm being the same for each authentication is very small, further increasing the difficulty of maliciously cracking the authentication and enhancing its security.

[0154] To avoid the risk of client user identity being impersonated, in one embodiment, such as Figure 6 The illustrated flowchart of another authentication data processing method provided in this application embodiment is applied to a server. After sending the authentication data to the client, the method may further include...

[0155] S610 receives the encrypted second random number and the first encrypted data sent by the client.

[0156] Specifically, the server receives the encrypted second random number and the first encrypted data sent by the client.

[0157] To verify the reliability and legitimacy of the client certificate and further improve authentication security, in one embodiment, after the server receives the encrypted second random number and the first encrypted data sent by the client, it may further include...

[0158] The client certificate is verified to obtain the verification result of the client certificate, wherein the client certificate includes the certificate public key, enterprise information, domain name expiration time, and the algorithm supported by the client.

[0159] When the verification result meets the preset conditions, the first encrypted data is decrypted, wherein the preset conditions include at least one of the following: the client certificate has not been revoked, the client certificate has not expired, and the domain name in the client certificate is consistent with the domain name of the client.

[0160] S620, decrypt the first encrypted data according to the public key in the client certificate to obtain the first true random number encrypted by the first quantum key.

[0161] S630, based on the second quantum key, decrypt the first true random number encrypted by the first quantum key to obtain decrypted data, wherein the second quantum key is a quantum key determined in the client quantum key pool through a target quantum key selection algorithm.

[0162] Specifically, in S620-S630, the order in which the server decrypts the first encrypted data using the public key from the client certificate and the second quantum key is related to the order in which the client encrypts the first truly random number using the private key from the client certificate and the first quantum key. When the client first encrypts the first truly random number using the first quantum key and then encrypts it using the private key from the client certificate, the server first decrypts the first encrypted data using the public key from the client certificate and then decrypts it using the second quantum key. When the client first encrypts the first truly random number using the private key from the client certificate and then encrypts it using the first quantum key, the server first decrypts the first encrypted data using the second quantum key and then decrypts it using the public key from the client certificate. In this application, the encryption order of the first truly random number is not limited; this embodiment only uses one possible order as an example.

[0163] S640, when the decrypted data is consistent with the first true random number, the encrypted second random number is decrypted according to the private key in the server certificate to obtain the second random number.

[0164] In this embodiment, the decrypted data compared with the first true random number is obtained by the server using the public key in the client certificate and the second quantum key to decrypt the first encrypted data. It can be understood that the client certificate is a digital certificate corresponding to the client's real identity, and the public key used by the server in the client certificate also corresponds to the client's real identity. Furthermore, the second quantum key is a quantum key determined from the client's quantum key pool using a target quantum key selection algorithm. When the decrypted data matches the first true random number, it means that the public key in the client certificate used by the server corresponds to the private key in the client certificate, indicating that it is the same client's client certificate. This proves that the client has not been impersonated. The second quantum key is also from the same client's quantum key pool as the first quantum key, further confirming that the client corresponding to the first encrypted data is a trusted client. Only after confirming that the client is a trusted client does the server decrypt the encrypted second random number sent by the client, avoiding the risk of the client user being impersonated. In addition to using the public key in the client certificate to decrypt the data, a second quantum key is also required. Compared to authentication schemes that only use the public key in the client certificate, this adds an extra layer of quantum key protection, which increases the difficulty of cracking the authentication data and further improves the security of the authentication.

[0165] To improve the security of authentication results, in one embodiment, such as Figure 6 The embodiment of this application provides another authentication data processing method, applied to a server. After decrypting the encrypted second random number based on the private key in the server certificate to obtain the second random number, it may further include step S650.

[0166] S650, based on the first random number, the second random number, and the first true random number, a second session key is established using a target session encryption algorithm, wherein the second session key is used to encrypt session data between the server and the client.

[0167] Specifically, the server generates a second session key based on a first random number, a first true random number, and a second random number using a target session encryption algorithm. This second session key is then used to encrypt session data between the server and the client.

[0168] In this embodiment, the first random number, the first truly random number, and the second random number used to generate the second session key through the target session encryption algorithm are all different each time, and the first random number, the first truly random number, and the second random number are also different from each other. This means that the second session key generated using these three random numbers is more unpredictable and more difficult to crack. Moreover, at least one of these three random numbers is a truly random number, which further increases the difficulty of cracking the second session key and improves its security. As a result, when the second session key is used to encrypt the session data between the server and the client, the session data is difficult to crack, which can effectively prevent eavesdropping and improve the security of the authentication result.

[0169] Based on the authentication data processing method provided in any of the above embodiments, this application also provides an embodiment of an authentication data processing apparatus. See details. Figure 7 .

[0170] Figure 7 A schematic diagram of an authentication data processing apparatus provided in an embodiment of this application is shown. Figure 7 As shown, the device may include:

[0171] The first sending module 710 is used to send authentication requests to the server.

[0172] The first receiving module 720 is used to receive authentication data returned by the server, wherein the authentication data includes a server certificate and a first true random number encrypted by the private key in the server certificate, and the first true random number is generated by the server through a quantum random number generator.

[0173] The first decryption module 730 is used to decrypt the first true random number encrypted by the private key in the server certificate according to the public key in the server certificate, so as to obtain the decrypted first true random number.

[0174] The first encryption module 740 is used to encrypt the first true random number based on the private key in the client certificate and the first quantum key to obtain the encrypted first encrypted data, wherein the first quantum key is a quantum key determined from the quantum key pool by a target quantum key selection algorithm.

[0175] The second sending module 750 is used to send the first encrypted data to the server, wherein the first encrypted data is used by the server to authenticate the client.

[0176] In the apparatus of this application embodiment, the first receiving module 720 receives a first truly random number generated by the server using a quantum random number generator. This ensures that the first truly random number is more random and unpredictable than pseudo-random numbers generated by algorithms, while avoiding the need for the client to generate the truly random number. To crack the first truly random number, the client would first need to attack the server device, further increasing the difficulty of cracking the first truly random number. Furthermore, the received first truly random number is encrypted using the public key of the server certificate, further increasing the difficulty of data cracking. The first decryption module 730 encrypts the first truly random number using the private key in the server certificate and then decrypts it using the public key in the server certificate. Subsequently, the first encryption module 740 encrypts the first truly random number using the private key of the client certificate and the first quantum key, increasing the complexity of data interaction during the authentication process. While ensuring data security, the chosen quantum key itself has high security, making the resulting encrypted data even more secure and difficult to crack. Using this highly secure and difficult-to-crack first encrypted data to authenticate the client's identity ensures the client's information security and further improves authentication security.

[0177] In one embodiment, before sending the authentication request to the server, the first sending module 710 may further include,

[0178] The first generation unit is used to generate a first random number, wherein the first random number includes a true random number generated by a random number generator or a pseudo random number generated by a pseudo random number generation algorithm.

[0179] The second generation unit is used to generate an authentication request based on the client certificate, the quantum key selection algorithm supported by the client, the session encryption algorithm supported by the client, and the first random number.

[0180] In this embodiment, the first generation unit generates a first random number before sending an authentication request to the server. The second generation unit then generates an authentication request based on this random number, the client certificate, the quantum key selection algorithm supported by the client, and the session encryption algorithm supported by the client. It is understood that a new first random number is generated before each authentication request is sent to the server. This means that each authentication request received by the server will be different because it includes the first random number, increasing the unpredictability of each authentication request and thus improving authentication security before it begins.

[0181] In one embodiment, after obtaining the first encrypted data, the first encryption module 740 may further include,

[0182] The third generation unit is used to generate a second random number, wherein the second random number includes a true random number generated by a quantum random number generator or a pseudo random number generated by a pseudo random number generation algorithm.

[0183] The first encryption unit is used to encrypt the second random number according to the public key in the server certificate to obtain the encrypted second random number.

[0184] The first sending unit is used to send the encrypted second random number and the first encrypted data to the server.

[0185] In this embodiment of the application, the first generation unit generates a second random number, and the first encryption unit encrypts the random number using the public key of the server certificate. It can be understood that a new second random number will be generated after each encrypted data is obtained, which can enhance the randomness of the authentication data, increase the difficulty of the data being cracked, and the random number is encrypted when it is sent to the server, which can effectively prevent malicious injection or replay attacks, thereby further improving the security of authentication.

[0186] In one embodiment, after sending the encrypted second random number and the first encrypted data to the server, the first sending unit may further include,

[0187] The first generation subunit is used to generate a first session key based on the first random number, the first true random number, and the second random number using the target session encryption algorithm, wherein the first session key is used to encrypt session data between the client and the server.

[0188] In this embodiment, the first random number, the first truly random number, and the second random number used to generate the first session key through the target session encryption algorithm are all different each time, and the first random number, the first truly random number, and the second random number are also different from each other. This means that the first session key generated by the first generation subunit using these three random numbers is more unpredictable and more difficult to crack. Moreover, at least one of these three random numbers is a truly random number, which further increases the difficulty of cracking the first session key and improves its security. As a result, when the first session key is used to encrypt the session data between the client and the server, the session data is difficult to crack, which can effectively prevent eavesdropping and improve the security of the authentication result.

[0189] In one embodiment, before generating the first random number, the first generation unit may further include,

[0190] The first receiving subunit is used to receive a client certificate issued by a certificate server and a quantum key pool in the absence of a network. The client certificate includes a digital certificate generated by the certificate server based on the client's real information, and the quantum key pool is used to store quantum keys.

[0191] Based on the authentication data processing method provided in any of the above embodiments, this application also provides another embodiment of the authentication data processing apparatus, see details below. Figure 8 .

[0192] Figure 8 A schematic diagram of another authentication data processing apparatus provided in an embodiment of this application is shown. Figure 8 As shown, this device, applied to a server, may include:

[0193] The first generation module 810 is used to respond to the authentication request sent by the client and generate a first true random number through a quantum random number generator. The authentication request includes the quantum key selection algorithm supported by the client, the session encryption algorithm supported by the client, and the client certificate.

[0194] The second encryption module 820 is used to encrypt the first true random number according to the private key in the server certificate, so as to obtain the first true random number encrypted by the private key in the server certificate.

[0195] The determining module 830 is used to determine the quantum key selection algorithm and session encryption algorithm supported by the server based on the quantum key selection algorithm and session encryption algorithm supported by the client, so as to obtain the target session encryption algorithm and the target quantum key selection algorithm.

[0196] The second generation module 840 is used to generate authentication data based on the server certificate, the first true random number encrypted by the private key in the server certificate, the target session encryption algorithm, and the target quantum key selection algorithm.

[0197] The third sending module 850 is used to send the authentication data to the client.

[0198] In this embodiment, the first generation module 810 generates a first truly random number, ensuring that it is more random and unpredictable than pseudo-random numbers generated by algorithms. This avoids the client generating the truly random number; the server encrypts the first truly random number using the public key of the server certificate, protecting it. Furthermore, cracking the first truly random number requires attacking the server device first, further increasing the difficulty of attacking and cracking it. The determining module 830 can also select a target quantum key selection algorithm and a target session encryption algorithm supported by both the server and the client, based on the algorithms supported by the client. The second generation module 840 and the third sending module 850 send the selected algorithms and authentication data to the client. In other words, the target quantum key selection algorithm and the target session encryption algorithm used in the authentication process are negotiated between the server and the client. It is understandable that the probability of the negotiated target quantum key selection algorithm and target session encryption algorithm being the same for each authentication is very small, further increasing the difficulty of maliciously cracking the authentication and improving authentication security.

[0199] In one embodiment, after sending the authentication data to the client, the third sending module 850 may further include,

[0200] The first receiving unit is used to receive the encrypted second random number and the first encrypted data sent by the client;

[0201] The first decryption unit is used to decrypt the first encrypted data according to the public key in the client certificate to obtain the first true random number encrypted by the first quantum key;

[0202] The second decryption unit is used to decrypt the first true random number encrypted by the first quantum key according to the second quantum key to obtain decrypted data, wherein the second quantum key is a quantum key determined in the client quantum key pool through the target quantum key selection algorithm;

[0203] The third decryption unit is used to decrypt the encrypted second random number according to the private key in the server certificate when the decrypted data is consistent with the first true random number, so as to obtain the second random number.

[0204] In this embodiment, the decrypted data compared with the first true random number is obtained by the first decryption unit and the second decryption unit using the public key in the client certificate and the second quantum key to decrypt the first encrypted data. It can be understood that the client certificate is a digital certificate corresponding to the client's real identity, and the public key used by the server in the client certificate also corresponds to the client's real identity. Furthermore, the second quantum key is a quantum key determined in the client's quantum key pool using a target quantum key selection algorithm. When the decrypted data matches the first true random number, it means that the public key in the client certificate used by the first decryption unit corresponds to the private key in the client certificate, indicating that it is the same client's client certificate. This proves that the client has not been impersonated. The second quantum key is also from the same client's quantum key pool as the first quantum key, further confirming that the client corresponding to the first encrypted data is a trusted client. Only after confirming that the client is a trusted client does the third decryption unit decrypt the encrypted second random number sent by the client, thus avoiding the risk of the client user being impersonated. In addition to using the public key in the client certificate to decrypt the data, a second quantum key is also required. Compared to authentication schemes that only use the public key in the client certificate, this adds an extra layer of quantum key protection, which increases the difficulty of cracking the authentication data and further improves the security of the authentication.

[0205] In one embodiment, after decrypting the encrypted second random number based on the private key in the server certificate to obtain the second random number, the third decryption unit may further include...

[0206] The second generation subunit is used to establish a second session key based on the first random number, the second random number, and the first true random number using a target session encryption algorithm. The second session key is used to encrypt session data between the server and the client.

[0207] In this embodiment, the first random number, the first truly random number, and the second random number used to generate the second session key through the target session encryption algorithm are all different each time, and the first random number, the first truly random number, and the second random number are also different from each other. This means that the second session key generated by the second generation subunit using these three random numbers is more unpredictable and more difficult to crack. Moreover, at least one of these three random numbers is a truly random number, which further increases the difficulty of cracking the second session key and improves its security. As a result, when the second session key is used to encrypt the session data between the server and the client, the session data is difficult to crack, which can effectively prevent eavesdropping and improve the security of the authentication result.

[0208] Furthermore, in conjunction with the authentication data processing method in the above embodiments, this application embodiment can provide an authentication data processing device, which may include a processor and a memory storing computer program instructions, wherein the processor implements the above authentication data processing method when executing the computer program instructions.

[0209] In addition, in conjunction with the above-described authentication data processing method, embodiments of this application may provide a computer storage medium storing computer program instructions, which, when executed by a processor, implement the above-described authentication data processing method.

[0210] The processor may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement embodiments of the present invention.

[0211] Memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the methods according to one aspect of this disclosure.

[0212] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0213] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0214] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0215] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0216] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for processing authentication data, characterized in that, include: Send an authentication request to the server; The server receives authentication data, which includes a server certificate and a first true random number encrypted with the private key in the server certificate. The first true random number is generated by the server using a quantum random number generator. Based on the public key in the server certificate, the first true random number encrypted by the private key in the server certificate is decrypted to obtain the first true random number. The first true random number is encrypted using the private key in the client certificate and the first quantum key to obtain the first encrypted data, wherein the first quantum key is a quantum key determined from the quantum key pool by the target quantum key selection algorithm; The first encrypted data is sent to the server, wherein the first encrypted data is used by the server to authenticate the client.

2. The method according to claim 1, characterized in that, After obtaining the first encrypted data, it also includes: Generate a second random number, wherein the second random number includes a true random number generated by a quantum random number generator or a pseudo random number generated by a pseudo random number generation algorithm; The second random number is encrypted using the public key in the server certificate to obtain the encrypted second random number. The encrypted second random number and the first encrypted data are sent to the server.

3. The method according to claim 2, characterized in that, Before sending the authentication request to the server, it also includes: Generate a first random number, wherein the first random number includes a true random number generated by a random number generator or a pseudo random number generated by a pseudo random number generation algorithm; An authentication request is generated based on the client certificate, the quantum key selection algorithm supported by the client, the session encryption algorithm supported by the client, and the first random number.

4. The method according to claim 3, characterized in that, After sending the encrypted second random number and the first encrypted data to the server, the method further includes: Based on the first random number, the first true random number, and the second random number, a first session key is generated using a target session encryption algorithm, wherein the first session key is used to encrypt session data between the client and the server.

5. The method according to claim 3, characterized in that, Before generating the first random number, the process also includes: In the absence of a network, the system receives a client certificate issued by a certificate server and a quantum key pool. The client certificate includes a digital certificate generated by the certificate server based on the client's real information, and the quantum key pool is used to store quantum keys.

6. A method for processing authentication data, characterized in that, Applied to servers, including: In response to an authentication request sent by a client, a first true random number is generated using a quantum random number generator, wherein the authentication request includes a quantum key selection algorithm supported by the client and a session encryption algorithm supported by the client; Encrypt the first true random number using the private key in the server certificate to obtain the first true random number encrypted with the private key in the server certificate. Based on the quantum key selection algorithm and the session encryption algorithm supported by the client, the quantum key selection algorithm supported by the server and the session encryption algorithm supported by the client are determined respectively, thus obtaining the target quantum key selection algorithm and the target session encryption algorithm. Authentication data is generated based on the server certificate, the first true random number encrypted with the private key in the server certificate, the target session encryption algorithm, and the target quantum key selection algorithm. The authentication data is sent to the client.

7. The method according to claim 6, characterized in that, After sending the authentication data to the client, the process also includes: Receive the encrypted second random number and the first encrypted data sent by the client; The first encrypted data is decrypted using the public key in the client certificate to obtain the first true random number encrypted with the first quantum key; Based on the second quantum key, the first true random number encrypted by the first quantum key is decrypted to obtain decrypted data, wherein the second quantum key is a quantum key determined in the client quantum key pool through the target quantum key selection algorithm; When the decrypted data matches the first true random number, the encrypted second random number is decrypted using the private key in the server certificate to obtain the second random number.

8. The method according to claim 7, characterized in that, After decrypting the encrypted second random number using the private key in the server certificate to obtain the second random number, the process further includes: Based on the first random number, the second random number, and the first true random number, a second session key is established using a target session encryption algorithm, wherein the second session key is used to encrypt session data between the server and the client.

9. An authentication data processing device, characterized in that, The device includes: The first sending module is used to send authentication requests to the server; The first receiving module is used to receive authentication data returned by the server, wherein the authentication data includes a server certificate and a first true random number encrypted by the private key in the server certificate, and the first true random number is generated by the server through a quantum random number generator. The first decryption module is used to decrypt the first true random number encrypted by the private key in the server certificate according to the public key in the server certificate, so as to obtain the decrypted first true random number. The first encryption module is used to encrypt the first true random number based on the private key in the client certificate and the first quantum key to obtain the encrypted first encrypted data, wherein the first quantum key is a quantum key determined from the quantum key pool by the target quantum key selection algorithm; The second sending module is used to send the first encrypted data to the server, wherein the first encrypted data is used by the server to authenticate the client.

10. An authentication data processing device, characterized in that, Applied to a server, the device includes: The first generation module is used to respond to the authentication request sent by the client and generate a first true random number through a quantum random number generator. The authentication request includes the quantum key selection algorithm supported by the client, the session encryption algorithm supported by the client, and the client certificate. The second encryption module is used to encrypt the first true random number according to the private key in the server certificate, so as to obtain the first true random number encrypted by the private key in the server certificate. The determining module is used to determine the quantum key selection algorithm and session encryption algorithm supported by the server based on the quantum key selection algorithm and session encryption algorithm supported by the client, so as to obtain the target session encryption algorithm and the target quantum key selection algorithm. The second generation module is used to generate authentication data based on the server certificate, the first true random number encrypted by the private key in the server certificate, the target session encryption algorithm, and the target quantum key selection algorithm; The third sending module is used to send the authentication data to the client.

11. An authentication data processing system, characterized in that, include: The client includes a quantum user identification card and a communication module. The communication module is used to: send an authentication request to the server; The server receives authentication data, which includes a server certificate and a first true random number encrypted with the private key in the server certificate. The first true random number is then encrypted to obtain first encrypted data. The server sends the first encrypted data to the server, whereby the first encrypted data is used by the server to authenticate the client. The quantum user identification card is used to: decrypt the first true random number encrypted by the private key in the server certificate according to the public key in the server certificate, to obtain the decrypted first true random number; encrypt the first true random number according to the private key in the client certificate and the first quantum key, to obtain the first encrypted data, wherein the first quantum key is a quantum key determined from the quantum key pool by the target quantum key selection algorithm.

12. An authentication data processing device, characterized in that, The device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the authentication data processing method as described in any one of claims 1-8.

13. A computer storage medium, characterized in that, The computer storage medium stores computer program instructions, which, when executed by a processor, implement the authentication data processing method as described in any one of claims 1-8.

Images