A Door Access Authentication Method and System Based on Quantum Key

Abstract

The present invention provides an access control authentication method and system based on quantum keys, belonging to the fields of quantum communication and information security. The quantum key distribution technology is adopted to distribute the keys required for authentication in the access control authentication system, and the quantum keys are used to authenticate the identity of users. It can solve the problem that the keys or other information used for user authentication are stolen and misused. When authenticating the identity of a user, the user identity authentication key is obtained by distributing and sharing quantum keys between the user and the background server, and the quantum keys held by both parties are used for authentication. The quantum key distribution process adopts a distribution method based on quantum mechanics, which has high security, thus solving the problem that the shared key used for authentication is stolen and the user opens the door by misusing it.

Description

Technical Field

[0001] The present invention relates to the fields of quantum communication and information security, and in particular to a quantum key-based access control authentication method and system. Background Art

[0002] Currently common access control systems generally use access card swiping or biometric authentication methods, such as face recognition, fingerprint recognition, etc. to identify and authenticate the user's identity. After the authentication is passed, whether to open the door is determined based on the user's corresponding permissions.

[0003] The current technical solution may have the following problems:

[0004] (1) When using the card swiping method, attackers can easily copy the card and use the copied card to open the door.

[0005] (2) When using a card swipe method, the user authentication key stored in the card is obtained by using the same root key to disperse the unique dispersion factors (such as user ID) of each user. The user key uses the same root key to disperse the key of each card. The root key is fixed during use and is not updated for a long time, which can easily lead to key leakage.

[0006] (3) When using biometric authentication, attackers can copy fingerprints or collect biometric information through photos, videos, etc., or use AI adversarial sample technology to crack the face recognition function, etc., and use the user's identity to open the door.

[0007] (4) Card information or biometric information transmitted during the authentication process can be easily intercepted by attackers, resulting in the leakage of user personal information and the misuse of personal information. Summary of the Invention

[0008] In order to solve the above technical problems, the present invention proposes a quantum key-based access control authentication method, comprising the following steps:

[0009] S1. The user terminal registers with the registration server, which verifies the user information and sets the user's access control permissions;

[0010] S2. The registration server injects the quantum key into the user terminal, and the user terminal shares the quantum key with the backend server.

[0011] S3. The access controller verifies the user ID and authenticates the quantum key held by the user.

[0012] Furthermore, step S2 includes the following steps:

[0013] Step S21: After completing user information registration, the user terminal applies to the registration server for quantum key charging. The registration server obtains the quantum key from the first quantum key distribution device connected. The quantum key is a shared quantum random bit string distributed between multiple quantum key distribution devices through quantum key distribution technology.

[0014] Step S22: The registration server injects the acquired quantum random bit string into the user terminal for secure storage, and splits the quantum random bit string into multiple keys of length N;

[0015] Step S23: Setting key identifiers for the multiple keys of length N generated in step S22 and storing them as authentication keys;

[0016] Step S24: The registration server sends the identifier of the key and the identifier of the corresponding user terminal to the backend server;

[0017] Step S25: The backend server obtains the shared quantum key corresponding to the key identifier of the first quantum key distribution device from the connected first quantum key distribution device according to the key identifier, and splits the quantum random bit string into multiple keys of length N in accordance with the method of step S22, sets the key identifier and records the correspondence between the user identifier and the quantum key, and stores it as the authentication key of the backend server.

[0018] Furthermore, the step S22 includes:

[0019] Step 221: Select m bits of the quantum random bit string starting with 1 as the length identifier, where m satisfies log2N-2<m≤log2N-1, and let the number represented by m bits be k;

[0020] Step 222: According to the length identifier m, the next k bits of the random bit string are intercepted, and the key serial number of the fixed data length and the user signature of the key applicant are added; the bit string composed of the k bits of quantum random number, the key serial number and the user signature is recorded as the text string D, with a length of p ;

[0021] Step 223: Calculate the Nmp-bit hash function of the text string D based on the text string D as the check string. The length identifier, the text string, and the check string together constitute a key of length N.

[0022] Step 224: Repeat steps 221-223 until the key number reaches the set value, and then stop generating the key.

[0023] Furthermore, the authentication key format of the user terminal in step 23 includes: quantum authentication key identifier, quantum authentication key length, and quantum authentication key data.

[0024] Further, the authentication key format on the background server side in step 25 includes: user identification, quantum authentication key identification, quantum authentication key length, and quantum authentication key data.

[0025] Further, step S3 includes:

[0026] Step S31: The access control controller generates a random number R as a challenge message and sends it to the user terminal.

[0027] Step S32: The user terminal selects a quantum authentication key data with a key identification of AuKeyID and performs an operation on R to obtain a message authentication code R'.

[0028] Step S33: The user terminal sends the message authentication code R' and the quantum authentication key identification AuKeyID used to calculate the message authentication code to the access control controller.

[0029] Step S34: The access control controller forwards the random number R, the message authentication code R', the quantum authentication key identification AuKeyID, and the user identification UserID to the background server.

[0030] Step S35: The background server verifies the legitimacy of the user identification UserID, selects a corresponding authentication key according to the user identification UserID and the quantum authentication key identification AuKeyID, uses the quantum authentication key data in the selected authentication key to perform the same operation on the random number R to obtain a message authentication code R", and compares whether R' is consistent with R".

[0031] Step S36: If R' is consistent with R", the background server notifies the access control controller to open the door. The access control controller opens the access control and simultaneously sends a verification passed message to the user terminal.

[0032] Step S37: If R' is inconsistent with R", the background server sends a verification failed message to the access control controller, and the access control controller forwards the verification failed message to the user terminal.

[0033] Step S38: The user terminal and the background server delete the authentication key corresponding to the quantum authentication key identification AuKeyID used in this round of authentication process and use a new authentication key in the next authentication.

[0034] Further, the key performs self-check to verify that it has not been tampered with. The self-check steps are as follows:

[0035] A. Extract the key serial number, read the first m bits of the key, obtain the k value according to the m bits, and thus split the key into a length identifier + text string + check string.

[0036] B. Perform a hash function operation on the text string and compare it with the check string. If the two are inconsistent, the verification fails.

[0037] The present invention also proposes an access control authentication system based on quantum key, which is used to implement the access control authentication method. The access control authentication system includes: an access control authentication device and a quantum key distribution system;

[0038] The access control authentication device includes: a user terminal, an access control controller, a registration server, and a background server;

[0039] The quantum key distribution system includes a plurality of quantum key distribution devices;

[0040] The user terminal is used to store user information for identity authentication and apply to the registration server for quantum key charging;

[0041] The registration server verifies user information, sets access control permissions, and issues user authentication keys to legitimate users;

[0042] The access controller authenticates the user authentication information or securely transmits the authentication data, and performs the door opening operation according to the result of the identity authentication;

[0043] The backend server authenticates the user's identity information;

[0044] The quantum key distribution device is used to complete the distribution of quantum keys;

[0045] The authentication key between the user terminal and the background server uses a shared quantum key obtained from a quantum key distribution system.

[0046] Compared with the prior art, the present invention has the following beneficial technical effects:

[0047] 1. Existing access control authentication systems use asymmetric cryptographic algorithms to distribute authentication keys, or pre-set the same root key and then use a key distribution algorithm to calculate the authentication key. Authentication keys distributed using cryptographic algorithms carry the risk of being cracked. However, the access control authentication method proposed in this solution uses quantum key distribution technology to distribute user authentication keys. Because quantum key distribution is based on quantum mechanics, it is untraceable and truly random, eliminating the risk of key theft or cracking and improving the security of authentication keys.

[0048] 2. Authentication using the user's quantum key uses a "one-time pad" approach, using a different quantum key to calculate the challenge-response random number each time. The quantum key used in that round is deleted upon completion. This prevents attackers from stealing the key used during authentication and performing replay attacks, thus providing enhanced security.

[0049] 3. The challenge-response random numbers used in existing access control authentication systems are classical random numbers, which have the risk of being predicted under certain conditions. The random numbers used in this solution can use quantum random numbers, which are unpredictable true random numbers and have high security.

[0050] 4. The way of splitting the key matches the key length required by the authentication algorithm of the existing access control system, increasing the compatibility of this solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0052] Figure 1 It is a schematic structural diagram of the access control authentication system based on quantum key of the present invention;

[0053] Figure 2 It is a schematic flow diagram of the user registration stage of the present invention;

[0054] Figure 3 It is a schematic flow diagram of obtaining quantum key of the present invention;

[0055] Figure 4 It is a schematic structural diagram of the key data of the present invention;

[0056] Figure 5 It is a schematic structural diagram of the storage format of the authentication key of the user terminal of the present invention;

[0057] Figure 6 It is a schematic structural diagram of the storage format of the authentication key of the background server of the present invention;

[0058] Figure 7 It is a schematic flow diagram of user authentication of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0059] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are some, but not all, of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present application.

[0060] In the attached drawings of the specific embodiments of the present invention, in order to better and more clearly describe the working principles of the various components in the system and show the connection relationships of the various parts in the device, only the relative positional relationships between the components are clearly distinguished, and it does not constitute a limitation on the signal transmission direction, connection sequence, and the sizes, dimensions, and shapes of the various parts within the component or structure.

[0061] As Figure 1 shown, it is a schematic structural diagram of the access control authentication system based on quantum key of the present invention, including: an access control authentication device and a quantum key distribution system.

[0062] The access control authentication device includes: a user terminal, an access control controller, a registration server, and a background server.

[0063] The quantum key distribution system includes multiple quantum key distribution devices.

[0064] The user terminal is an authentication device held by the user, such as a mobile phone. The user terminal stores information for user identity authentication, such as a user authentication key, etc.; the registration server registers the relevant information of legitimate users, sets the access permission, and issues relevant information such as the user authentication key to legitimate users; the access control controller is the control terminal of the access control system, authenticates the information for user authentication or securely transmits the authentication data, and performs operations such as opening the door according to the result of the identity authentication; the background server mainly authenticates the identity information of users; the quantum key distribution device mainly completes the distribution of quantum keys. Among them, the authentication key between the user terminal and the background server uses the shared quantum key obtained from the quantum key distribution system.

[0065] As Figure 2 shown is a schematic diagram of the user registration phase process, including the following processes:

[0066] (I) User registration phase

[0067] 1. User terminal registration, setting access control permissions.

[0068] (1) The user terminal registers with the registration server and sends the user identifier UserID and other required user information to the registration server;

[0069] (2) The registration server reviews the user information and sets the corresponding access control permissions for the user;

[0070] (3) The registration server sends the information such as the UserID, user information, and access control permissions of the audited user to the background server;

[0071] (4) The background server records the received user UserID, user information, access control permissions, etc. information;

[0072] (5) The background server updates the UserID in the legal user list of the corresponding access control controller according to the access control permission information of the user.

[0073] 2. The user terminal obtains the shared quantum key.

[0074] Figure 1 In the "quantum key distribution network", the quantum channel is between the quantum key distribution device 1 and the quantum key distribution device 2. First, they will distribute the shared quantum key through the quantum key distribution technology, and then send their respective quantum keys to the registration server and the background server in a secure manner, so that the registration server and the background server also have the shared quantum key.

[0075] The registration server fills the quantum key into the user terminal according to the needs of the user terminal, so that the user terminal and the background server will have the shared quantum key. The specific process is as follows Figure 3 as shown.

[0076] (1) After the user terminal completes the user information registration, it applies to the registration server to fill the quantum key. The registration server obtains the quantum key data from the connected quantum key distribution device 1. The quantum key identifier is QKeyID, and this quantum key is the shared quantum random bit string distributed between the quantum key distribution device 1 and the quantum key distribution device 2 through the quantum key distribution technology;

[0077] (2) The registration server fills the obtained quantum random bit string into the user terminal for secure storage; when storing the key, according to the key length AuKeyLen (denoted by N) required by the authentication algorithm (HMAC, CBCMAC, etc.) of the access control system, the obtained quantum random bit string is split into multiple keys:

[0078] Step 221: Select m bits starting from the 1st bit of the quantum random bit string as the length identifier, where m satisfies log2N - 2 < m ≤ log2N - 1. Let the number represented by these m bits be k.

[0079] Step 222: Intercept the subsequent k bits of the random bit string according to the length identifier m, and append the key serial number with a fixed data length and the user signature of the key applicant; the k-bit quantum random number bit string, the key serial number and the user signature form a bit string denoted as the text string D, with a length of p.

[0080] Step 223: Calculate the hash function of the N - m - p bits of D based on the text string D as the check string. The length identifier, the text string and the check string together constitute the quantum authentication key data, with a length of N.

[0081] As an embodiment of the hash function: Calculate the cube of the text string D as the new bit string D'. Assume the length of D’ is l, and then intercept the th bit to the th bit of D’, a total of N - m - p bits as the check string.

[0082] Step 224: Repeat steps 221 - 223 until the key serial number reaches a set value, which represents the application quantity of the key. Then stop generating keys. As Figure 4 shown in the structure of the key data.

[0083] In addition, the key can be self - checked to verify that it has not been tampered with, further improving the security of the key. The self - check steps are as follows:

[0084] A. First, extract the key serial number, then read the first m bits of the key, obtain the k value according to these m bits, so as to split the key into length identifier + text string + check string.

[0085] B. Perform a hash function operation on the text string and compare it with the check string. If they are inconsistent, the verification fails.

[0086] (3) Store the key generated in (2) as the authentication key data Aukey, and set the identifier AuKeyID of the key. Figure 5 This is the storage format of the authentication key for the user terminal. Each key is stored in the format shown in the figure and then distinguished by the identifier ID.

[0087] (4) The registration server sends the identifier QKeyID of the quantum key obtained and the identifier UserID of the corresponding user terminal to the background server;

[0088] (5) The background server obtains the shared quantum key corresponding to QKeyID in the quantum key distribution device 1 from the quantum key distribution device 2 accessed according to the quantum key identifier QKeyID, and splits the quantum random bit string into multiple keys with a length of N in the manner of (2), sets the key identifier and records the corresponding relationship between the user identifier UserID and the quantum key, and stores it as the authentication key on the background server side. (II) User authentication stage

[0089] Authenticate the quantum authentication key held by the user. The authentication process is as follows Figure 7 shown.

[0090] 1. Verify the user identifier

[0091] (1) The user terminal sends a door - opening request and sends the user identifier UserID to the access control controller.

[0092] (2) The access control controller verifies the UserID to check whether it belongs to a legitimate user. If it is a legitimate UserID, the verification of the quantum key held by the user will start.

[0093] 2. Verify the quantum authentication key held by the user

[0094] The verification of the quantum authentication key held by the user is carried out in a challenge-response manner, and the specific steps are as follows.

[0095] (1) The access control controller generates a random number R as a challenge message and sends it to the user terminal. This random number can be a classical random number or a quantum random number. Using a quantum random number will provide higher security.

[0096] (2) The user terminal selects a quantum authentication key data with the key identifier AuKeyID and performs an operation on R (such as a keyed Hash algorithm or a symmetric encryption algorithm, etc.) to obtain a message authentication code R'.

[0097] (3) The user terminal sends the message authentication code R' and the quantum authentication key identifier AuKeyID used to calculate the message authentication code to the access control controller.

[0098] (4) The access control controller forwards the random number R, the message authentication code R', the quantum authentication key identifier AuKeyID, and the user identifier UserID to the back-end server.

[0099] (5) The back-end server verifies the legitimacy of the UserID, then selects the corresponding quantum authentication key data according to the UserID and AuKeyID, performs the same operation on the random number R using the selected quantum authentication key data to obtain a message authentication code R", and then checks whether R' and R" are consistent.

[0100] (6) If R' and R" are consistent, the back-end server notifies the access control controller to open the door. The access control controller opens the access control and simultaneously sends a verification passed message to the user terminal.

[0101] (7) If R' and R" are inconsistent, the back-end server sends an information of verification failure to the access control controller, and the access control controller forwards the verification failure message to the user terminal.

[0102] (8) The user terminal and the back-end server delete the authentication key corresponding to the AuKeyID used in this round of authentication process and use a new authentication key in the next authentication.

[0103] In the access control system, the quantum key distribution technology is used to distribute the shared quantum key to the user terminal and the back-end server, and it is bound to the user identifier during the storage of the quantum key for the back-end to authenticate the user identity.

[0104] When the access control system uses a shared quantum key for identity authentication, a random number is generated by the access control controller. The user terminal and the background server select corresponding quantum authentication key data according to the user identification and the key identification to calculate the random number (such as a Hash algorithm with a key or a symmetric encryption algorithm, etc.). The user terminal sends the calculation result to the background server through the access control controller, and the background server verifies the calculation result of the user terminal to determine the legitimacy of the user identity.

[0105] The random number used by the access control system for identity authentication can be a quantum random number, which is an unpredictable true random number and has high security.

[0106] During the authentication process of the user terminal by the background server, the "one-time pad" method is used for calculating the random number, and different quantum keys are used each time. After this authentication is completed, the key data used for this authentication is deleted, and new key data is used for the next authentication.

[0107] According to the key length Len required by the authentication algorithm (such as HMAC, CBCMAC, etc.) of the access control system, the obtained quantum key is split into multiple keys according to certain rules as authentication keys for storage, and the identification AuKeyID of the key is set.

[0108] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer-readable storage medium can be any available medium that the computer can access or a data storage device such as a server or a data center that integrates one or more available media. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)), etc.

[0109] As described above, the above is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily think of various equivalent modifications or substitutions, and these modifications or substitutions should all be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A door access authentication method based on quantum keys, characterized in that, It includes the following steps: S1. The user terminal registers with the registration server. The registration server audits the user information and sets the access control permissions for the user. S2. The registration server injects the quantum key into the user terminal, and the user terminal shares the quantum key with the background server. S3. The access control controller verifies the user identification and authenticates the quantum key held by the user, including: Step S31. The access control controller generates a random number R as a challenge message and sends it to the user terminal. Step S32. The user terminal selects a quantum authentication key data with the key identifier AuKeyID and performs an operation on R to obtain the message authentication code R'. Step S33. The user terminal sends the message authentication code R' and the quantum authentication key identifier AuKeyID used to calculate the message authentication code to the access control controller. Step S34. The access control controller forwards the random number R, the message authentication code R', the quantum authentication key identifier AuKeyID, and the user identification UserID to the background server. Step S35. The background server verifies the legitimacy of the user identification UserID, selects the corresponding authentication key according to the user identification UserID and the quantum authentication key identifier AuKeyID, performs the same operation on the random number R using the quantum authentication key data in the selected authentication key to obtain the message authentication code R'', and compares whether R' is consistent with R''. Step S36. If R' is consistent with R'', the background server notifies the access control controller to open the door. The access control controller opens the access control and simultaneously sends a message of successful verification to the user terminal. Step S37. If R' is not consistent with R'', the background server sends an information of failed verification to the access control controller, and the access control controller forwards the message of failed verification to the user terminal. Step S38. The user terminal and the background server delete the authentication key corresponding to the quantum authentication key identifier AuKeyID used in this round of authentication process and use a new authentication key in the next authentication.

2. The access control authentication method according to claim 1, wherein Step S2 includes the following steps: Step S21. After the user terminal completes the user information registration, it applies to the registration server for injecting the quantum key. The registration server obtains the quantum key from the connected first quantum key distribution device. The quantum key is a shared quantum random bit string distributed among multiple quantum key distribution devices through the quantum key distribution technology. Step S22. The registration server injects the obtained quantum random bit string into the user terminal for secure storage and splits the quantum random bit string into multiple keys with the length of N. Step S23. Set the identifier of the key for the multiple keys with the length of N generated in Step S22 and store them as the authentication keys. Step S24. The registration server sends the identifier of the key and the identifier of the corresponding user terminal to the background server. Step S25: The backend server obtains the shared quantum key corresponding to the key identifier of the first quantum key distribution device from the connected first quantum key distribution device according to the key identifier, and splits the quantum random bit string into multiple keys of length N in accordance with the method of step S22, sets the key identifier and records the correspondence between the user identifier and the quantum key, and stores it as the authentication key of the backend server.

3. The access control authentication method according to claim 2, wherein The step S22 includes: Step 221: Select m bits starting from the 1st bit of the quantum random bit string as the length identifier, where m satisfies , and let the number represented by the m bits be k; Step 222: The next k bits of the random bit string are truncated according to the length identifier m, and the key serial number of the fixed data length and the user signature of the key applicant are appended. The bit string composed of the k bits of the quantum random number, the key serial number and the user signature is recorded as the main text string D, with a length of p. Step 223: Calculate the Nmp-bit hash function of the text string D based on the text string D as the check string. The length identifier, the text string, and the check string together constitute a key of length N. Step 224: Repeat steps 221-223 until the key number reaches the set value, and then stop generating the key.

4. The access control authentication method according to claim 2, wherein The authentication key format of the user terminal in step 23 includes: quantum authentication key identifier, quantum authentication key length, and quantum authentication key data.

5. The access control authentication method according to claim 2, wherein The authentication key format of the backend server in step 25 includes: user identifier, quantum authentication key identifier, quantum authentication key length, and quantum authentication key data.

6. The access control authentication method according to claim 2, wherein, The key performs a self-check to verify that it has not been tampered with. The self-check steps are as follows: A. Extract the key serial number, read the first m bits of the key, and obtain the k value based on the m bits, thereby splitting the key into a length identifier + text string + check string; B. Perform a hash function operation on the text string and compare it with the check string. If the two are inconsistent, the verification fails.

7. A door access authentication system based on quantum keys, characterized in that, Used to implement the access control authentication method according to any one of claims 1 to 6, the access control authentication system comprises: an access control authentication device and a quantum key distribution system; The access control authentication device includes: user terminal, access control controller, registration server, and background server; The quantum key distribution system includes a plurality of quantum key distribution devices; The user terminal is used to store user information for identity authentication and apply to the registration server for quantum key charging; The registration server verifies user information, sets access control permissions, and issues user authentication keys to legitimate users; The access controller authenticates the user authentication information or securely transmits the authentication data, and performs the door opening operation according to the result of the identity authentication; The backend server authenticates the user's identity information; The quantum key distribution device is used to complete the distribution of quantum keys; The authentication key between the user terminal and the background server uses a shared quantum key obtained from a quantum key distribution system.

Images