A method and system for implementing a quantum-safe protocol based on SSL.

Abstract

This invention provides a method and system for implementing a quantum-secure protocol based on the SSL protocol, relating to the field of quantum secure communication technology. The method includes: Step A: Establishing a connection between the client and server via a handshake protocol, where the client authenticates the server, and subsequently the server authenticates the client, completing the handshake protocol; Step B: Segmenting the query request or plaintext data returned from the data center into data segments via a record layer protocol, compressing the data segments, encrypting the compressed data segments, and adding record information. The client receives the encrypted information and decrypts it. This invention integrates quantum key distribution technology with network security protocols, preventing business data leakage and tamper-proof verification data, thus enhancing the security of information transmission.

Description

Technical Field

[0001] This invention relates to the field of quantum secure communication technology, and more specifically, to a method and system for implementing a quantum secure protocol based on the SSL protocol. Background Technology

[0002] Since the beginning of the 21st century, the rapid development of quantum computers has posed a significant threat to existing mainstream public-key cryptosystems. Mainstream public-key algorithms, such as the RSA algorithm based on large number factorization, will be easily cracked by quantum computers. Furthermore, the current browser security protocol SSL uses asymmetric encryption, and browser encryption methods are increasingly unable to meet security requirements.

[0003] Quantum secure communication is considered one of the important means to ensure information security, and quantum key distribution (QKD) is the technology in quantum secure communication that is moving towards practical engineering application the fastest, and is an important direction in quantum communication. Based on the fundamental properties of quantum physics rather than computational complexity, QKD allows spatially separated users to share keys in an absolutely secure manner through a quantum channel. QKD technology does not directly transmit information; instead, it distributes keys. After key negotiation, both communicating parties obtain the same quantum key, which is then used to encrypt the plaintext before transmitting the ciphertext through a classical channel. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a method and system for implementing a quantum-safe protocol based on the SSL protocol.

[0005] According to the present invention, a method and system for implementing a quantum-safe protocol based on the SSL protocol are provided, the solution of which is as follows:

[0006] Firstly, a method for implementing a quantum-safe protocol based on the SSL protocol is provided, the method comprising:

[0007] Step A: Establish a connection between the client and the server through a handshake protocol. The client authenticates the server, and then the server authenticates the client, thus completing the handshake protocol.

[0008] Step B: The query request or plaintext data returned from the data center is segmented into data segments through the record layer protocol, the data segments are compressed, the compressed data segments are encrypted, and record information is added. After the client receives the encrypted information, it decrypts it.

[0009] The handshake protocol and the record layer protocol are interdependent. When establishing an SSL connection, the handshake protocol is performed first, and the security of the communicating parties is ensured through related steps such as authentication and algorithm negotiation. The successful completion of the handshake protocol will result in the generation of a quantum key frame header and other security parameters. These parameters will be used for data encryption and integrity protection of the record layer protocol. Once the handshake is successful, the record layer protocol will use the quantum key and algorithm negotiated during the handshake phase to encrypt and protect the transmission of upper-layer application data.

[0010] Preferably, step A includes:

[0011] Step A1: This includes two parts: the client sending a Client Hello message to the server and the server sending back a Server Hello message. The client initiates the process by informing the server of the supported encryption algorithm combinations, the list of cipher suites, and the session ID. The server selects an encryption algorithm and a compression algorithm from the list of cipher suites sent by the client and sends them back along with the session ID.

[0012] Step A2: The server sends a certificate message, a client certificate request message, and a certificate request completion message to the client;

[0013] Step A3: If the server requires a client certificate, this stage is executed. The client first verifies whether the server provides a valid certificate. If the conditions are met, the client sends a client certificate message and a certificate authentication message to the server.

[0014] Step A4: Complete the handshake protocol. The client sends a completion message, calculates the MAC value of the plaintext data using a quantum key, and encrypts the MAC value and the Finished character field using the agreed encryption algorithm. The encrypted data is then transmitted to the server. After the server decrypts the data and identifies the Finished character field, it calculates the MAC value. If the MAC values ​​are the same, the server returns a completion message; otherwise, the session is terminated immediately.

[0015] Preferably, the MAC algorithm is as follows: calculate the MAC value based on the plaintext data and the quantum key, and then symmetrically encrypt the calculated MAC value and the plaintext data using the quantum key to obtain the final ciphertext.

[0016] Preferably, step B includes:

[0017] Step B1: Divide the plaintext data into data segments;

[0018] Step B2: Compress the data segment using the compression algorithm selected in Step A. The compressed data segment is called a compression unit. If no compression algorithm is selected, compression is not performed by default.

[0019] Step B3: Extract the corresponding quantum key using the quantum key frame header information negotiated by the handshake protocol, calculate the MAC value of the quantum key and the compression unit, and then use the quantum key to encrypt the compression unit and the MAC value. The encrypted compression unit and MAC value are called the encryption unit.

[0020] Step B4: Add recording information to the encryption unit, the recording information including higher-level protocol information, protocol version, and compression length information;

[0021] Step B5: Transmit data to the client. After receiving the encrypted information, the client decrypts it.

[0022] Preferably, the length of the segmented data block is 16KB.

[0023] Preferably, the length of the compressed unit does not exceed 1024 bytes.

[0024] Secondly, a quantum-safe protocol implementation system based on the SSL protocol is provided, the system comprising:

[0025] Module A: Establishes a connection between the client and the server through a handshake protocol. The client authenticates the server, and then the server authenticates the client, thus completing the handshake protocol.

[0026] Module B: The module segments query requests or plaintext data returned from the data center into data segments using the record layer protocol, compresses the data segments, encrypts the compressed data segments, and adds record information. The client decrypts the encrypted information upon receiving it.

[0027] The handshake protocol and the record layer protocol are interdependent. When establishing an SSL connection, the handshake protocol is performed first, and the security of the communicating parties is ensured through related steps such as authentication and algorithm negotiation. The successful completion of the handshake protocol will result in the generation of a quantum key frame header and other security parameters. These parameters will be used for data encryption and integrity protection of the record layer protocol. Once the handshake is successful, the record layer protocol will use the quantum key and algorithm negotiated during the handshake phase to encrypt and protect the transmission of upper-layer application data.

[0028] Preferably, module A includes:

[0029] Module A1 consists of two parts: the client sending a Client Hello message to the server and the server sending back a Server Hello message. The client initiates the process by informing the server of the supported encryption algorithm combinations, the list of cipher suites, and the session ID. The server selects the encryption algorithm and compression algorithm from the list of cipher suites sent by the client and sends them back along with the session ID.

[0030] Module A2: The server sends certificate messages, client certificate request messages, and certificate request completion messages to the client;

[0031] Module A3: If the server requires a client certificate, this stage is executed. The client first verifies whether the server provides a valid certificate. If the conditions are met, the client sends a client certificate message and a certificate authentication message to the server.

[0032] Module A4: Complete the handshake protocol. The client sends a completion message, calculates the MAC value of the plaintext data using quantum key distribution, and encrypts the MAC value and the Finished character field using the agreed encryption algorithm. The encrypted data is then transmitted to the server. After the server decrypts the data and identifies the Finished character field, it calculates the MAC value. If the MAC values ​​are the same, the server returns a completion message. If they are different, the session is terminated immediately.

[0033] The MAC algorithm is as follows: calculate the MAC value based on the plaintext data and the quantum key, and then symmetrically encrypt the calculated MAC value and the plaintext data using the quantum key to obtain the final ciphertext;

[0034] Module B includes:

[0035] Module B1: Divides plaintext data into data segments, with each data block being 16KB in length;

[0036] Module B2: Compresses the data segment using the compression algorithm selected in Module A. The compressed data segment is called a compressed unit. If no compression algorithm is selected, no compression is performed by default. The length of the compressed unit does not exceed 1024 bytes.

[0037] Module B3: Extract the corresponding quantum key using the quantum key frame header information negotiated by the handshake protocol, calculate the MAC value of the quantum key and the compression unit, and then use the quantum key to encrypt the compression unit and the MAC value. The encrypted compression unit and MAC value are called the encryption unit.

[0038] Module B4: Add recording information to the encryption unit, the recording information including higher-layer protocol information, protocol version, and compression length information;

[0039] Module B5: Transmits data to the client. After receiving the encrypted information, the client decrypts it.

[0040] Thirdly, a computer-readable storage medium is provided that stores a computer program, which, when executed by a processor, implements the steps in the quantum security protocol implementation method based on the SSL protocol.

[0041] Fourthly, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps in the method for implementing the quantum security protocol based on the SSL protocol.

[0042] Compared with the prior art, the present invention has the following beneficial effects:

[0043] 1. This invention can integrate quantum key distribution technology with network security protocols to prevent business data leakage and verification data tampering, thereby enhancing the security of information transmission;

[0044] 2. The quantum security protocol described in this invention is compatible with traditional symmetric encryption algorithms, requiring minimal modifications to existing systems;

[0045] 3. The quantum security protocol based on SSL described in this invention uses quantum key distribution keys instead of asymmetric encryption algorithms, which can resist attacks from quantum computers and has unconditional security.

[0046] Other beneficial effects of the present invention will be explained in detail through the introduction of specific technical features and technical solutions in specific embodiments. Those skilled in the art should be able to understand the beneficial technical effects brought about by these technical features and technical solutions through the introduction of these technical features and technical solutions. Attached Figure Description

[0047] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0048] Figure 1 This is a handshake protocol for a quantum-safe protocol based on the SSL protocol.

[0049] Figure 2 It is a record layer protocol for a quantum-safe protocol based on the SSL protocol. Detailed Implementation

[0050] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0051] This invention provides a method for implementing a quantum-safe protocol based on the SSL protocol, referring to... Figure 1 As shown, the method specifically includes:

[0052] Step A: Establish a connection between the client and the server through a handshake protocol. The client authenticates the server, and then the server authenticates the client, thus completing the handshake protocol.

[0053] Step B: The plaintext data is segmented and compressed using the record layer protocol. The compressed data segments are then encrypted, and record information is added. The client receives the encrypted information and decrypts it.

[0054] The handshake protocol and the record layer protocol are interdependent. During SSL connection establishment, the handshake protocol is performed first, ensuring the security of both communicating parties through authentication, algorithm negotiation, and other steps. Successful completion of the handshake protocol results in the generation of a quantum key frame header and other security parameters, which are used for data encryption and integrity protection by the record layer protocol. Once the handshake is successful, the record layer protocol uses the quantum key and algorithm negotiated during the handshake phase to encrypt and protect the transmission of upper-layer application data.

[0055] Specifically, step A includes:

[0056] Step A1: This includes two parts: the client sending a Client Hello message to the server and the server sending back a Server Hello message. The client initiates the process by informing the server of the supported encryption algorithm combinations, compression algorithm combinations (i.e., a list of cipher suites), and the session ID. The server selects the encryption algorithm and compression algorithm from the list of cipher suites sent by the client and sends them back along with the session ID.

[0057] Step A2: The server sends a certificate message, a client certificate request message, and a certificate request completion message to the client;

[0058] Step A3: If the server requires a client certificate, this stage is executed. The client first verifies whether the server provides a valid certificate. If the conditions are met, the client sends a client certificate message and a certificate authentication message to the server.

[0059] Step A4: Complete the handshake protocol. The client sends a completion message, uses the quantum key to calculate the MAC value of the plaintext data (including the encryption algorithm, compression algorithm, and quantum key frame header information), and encrypts the MAC value and the Finished character field with the agreed encryption algorithm. The data is then transmitted to the server. After the server decrypts and identifies the Finished character field, it calculates the MAC value. If the MAC values ​​are the same, the server returns a completion message; otherwise, the session is terminated immediately.

[0060] The MAC algorithm is as follows: calculate the MAC value based on the plaintext data and the quantum key, and then symmetrically encrypt the calculated MAC value and the plaintext data using the quantum key to obtain the final ciphertext.

[0061] Step B includes:

[0062] Step B1: Divide the plaintext data into data segments. The length of each data segment is 16K bytes. The plaintext data here can be a query request or plaintext information returned by the data center.

[0063] Step B2: Compress the data segment using the compression algorithm selected in Step A. The compressed data segment is called a compressed unit. If no compression algorithm is selected, no compression is performed by default. The length of the compressed unit does not exceed 1024 bytes.

[0064] Step B3: Extract the corresponding quantum key using the quantum key frame header information negotiated by the handshake protocol, calculate the MAC value of the quantum key and the compression unit, and then use the quantum key to encrypt the compression unit and the MAC value. The encrypted compression unit and MAC value are called the encryption unit.

[0065] Step B4: Add recording information to the encryption unit. The recording information includes higher-level protocol information, protocol version, compression length information, and encapsulates it into a TCP data packet.

[0066] Step B5: Transmit data to the client. After receiving the encrypted information, the client decrypts it.

[0067] This invention also provides a quantum-safe protocol implementation system based on the SSL protocol. This system can be implemented by executing the steps of the SSL-based quantum-safe protocol implementation method. Therefore, those skilled in the art can understand the SSL-based quantum-safe protocol implementation method as a preferred embodiment of the SSL-based quantum-safe protocol implementation system. The system specifically includes:

[0068] Module A: Establishes a connection between the client and the server through a handshake protocol. The client authenticates the server, and then the server authenticates the client, thus completing the handshake protocol.

[0069] Module B: The plaintext data is segmented into data segments and compressed using the record layer protocol. The compressed data segments are then encrypted, and record information is added. The client receives the encrypted information and decrypts it.

[0070] The handshake protocol and the record layer protocol are interdependent. During SSL connection establishment, the handshake protocol is performed first, ensuring the security of both communicating parties through authentication, algorithm negotiation, and other steps. Successful completion of the handshake protocol results in the generation of a quantum key frame header and other security parameters, which are used for data encryption and integrity protection by the record layer protocol. Once the handshake is successful, the record layer protocol uses the quantum key and algorithm negotiated during the handshake phase to encrypt and protect the transmission of upper-layer application data.

[0071] Specifically, module A includes:

[0072] Module A1 consists of two parts: the client sending a Client Hello message to the server and the server sending back a Server Hello message. The client initiates the process by informing the server of the supported encryption algorithm combinations, compression algorithm combinations (i.e., a list of cipher suites), and the session ID. The server selects the encryption algorithm and compression algorithm from the list of cipher suites sent by the client and sends them back along with the session ID.

[0073] Module A2: The server sends certificate messages, client certificate request messages, and certificate request completion messages to the client;

[0074] Module A3: If the server requires a client certificate, this stage is executed. The client first verifies whether the server provides a valid certificate. If the conditions are met, the client sends a client certificate message and a certificate authentication message to the server.

[0075] Module A4: Complete the handshake protocol. The client sends a completion message, calculates the MAC value using quantum key calculation, including the encryption algorithm, compression algorithm, and quantum key frame header information used, and encrypts the MAC value and the Finished character field using the negotiated encryption algorithm. The message is then transmitted to the server. The server decrypts the message, identifies the Finished character field, and calculates the MAC value. If the MAC values ​​are the same, the server returns a completion message; otherwise, the session is terminated immediately.

[0076] The MAC algorithm is as follows: calculate the MAC value based on the plaintext data and the quantum key, and then symmetrically encrypt the calculated MAC value and the plaintext data using the quantum key to obtain the final ciphertext.

[0077] Module B includes:

[0078] Module B1: Divides plaintext data into data segments, with each segment being 16KB in length. The plaintext data can be query requests or plaintext information returned from the data center.

[0079] Module B2: Compresses the data segment using the compression algorithm selected in Module A. The compressed data segment is called a compressed unit. If no compression algorithm is selected, no compression is performed by default. The length of the compressed unit does not exceed 1024 bytes.

[0080] Module B3: Extract the corresponding quantum key using the quantum key frame header information negotiated by the handshake protocol, calculate the MAC value of the quantum key and the compression unit, and then use the quantum key to encrypt the compression unit and the MAC value. The encrypted compression unit and MAC value are called the encryption unit.

[0081] Module B4: Adds recording information to the encryption unit. The recording information includes higher-level protocol information, protocol version, compression length information, and is encapsulated into TCP data packets.

[0082] Module B5: Transmits data to the client. After receiving the encrypted information, the client decrypts it.

[0083] The present invention will now be described in more detail.

[0084] This invention provides a method for implementing a quantum-safe protocol based on the SSL protocol. The method includes a handshake protocol and a record layer protocol, as detailed below:

[0085] Handshake protocol: A connection is established between the client and the server. Then the client authenticates the server, the server authenticates the client, and finally the handshake protocol is completed.

[0086] Reference Figure 1 As shown, the handshake protocol steps include:

[0087] Step A1: This step consists of two parts: the client sending a Client Hello message to the server and the server sending back a Server Hello message. The client initiates the step by informing the server of the supported encryption algorithm combinations, compression algorithm combinations (i.e., a list of cipher suites), and session ID. The server selects an encryption algorithm and a compression algorithm from the list of cipher suites sent by the client and sends them back along with the session ID.

[0088] Step A2: The server sends a certificate message, a client certificate request message, and a certificate request completion message to the client.

[0089] Step A3: If the server requires a client certificate, this stage is executed. The client first verifies whether the server provides a valid certificate. If the conditions are met, the client sends a client certificate message and a certificate authentication message to the server.

[0090] Step A4: The final stage completes the handshake protocol. The client sends a completion message, calculates the MAC value using quantum key distribution, including the encryption algorithm, compression algorithm, and quantum key frame header information, and encrypts the MAC value and data information using the agreed encryption algorithm before transmitting it to the server. After the server decrypts the data, it calculates the MAC value. If the MAC values ​​are the same, the server returns a completion message; otherwise, the session is terminated immediately.

[0091] The MAC algorithm is MtE (MAC-then-Encrypt): First, the MAC value is calculated based on the plaintext and the quantum key. Then, the calculated MAC value and the plaintext are symmetrically encrypted using the quantum key to obtain the final ciphertext.

[0092] Reference Figure 2 As shown, the record layer protocol divides the user layer data into data segments, then compresses them using the compression algorithm defined in the handshake protocol, calculates the required quantum key and the MAC (Message Authentication Code) of the compression unit, encrypts the entire unit, adds record information to the encrypted unit, transmits the data to the client, and the client decrypts the encrypted information after receiving it.

[0093] The record layer protocol includes: application layer data, record protocol units, compression units, encryption units, and TCP packets;

[0094] Application layer data refers to the raw information from the application, which is the actual data that needs to be encrypted, transmitted and protected in the protocol, i.e. plaintext data.

[0095] A record protocol unit is the basic data unit in the protocol, consisting of type, version, length, and content. The sender encapsulates application layer data into record protocol units and encrypts the data using the encryption algorithm negotiated in the handshake protocol. Upon receiving a record protocol unit, the receiver decrypts and processes it according to the record type and encryption algorithm to obtain the original application layer data.

[0096] A compression unit refers to a data unit that has been compressed from application layer data in the record layer protocol. In the record layer, compression algorithms negotiated in the handshake protocol can be used to compress application layer data to reduce the amount of data transmitted.

[0097] An encrypted unit refers to a data unit that has been encrypted with both the compressed unit and the MAC value. At the record layer, the encrypted unit and MAC value are encrypted using the encryption algorithm negotiated in the handshake protocol to ensure the confidentiality and security of the data during transmission.

[0098] A TCP packet is the basic unit of transmission carrying record layer data, including encryption units, higher-layer protocol information, protocol version, and compression length information. It is responsible for transmitting record layer data from one endpoint to another in the network.

[0099] The specific implementation process is as follows:

[0100] Step B1: Segment the plaintext data into record protocol units, with each unit being 16KB in length. This plaintext data can be a query request or plaintext information returned from the data center. 16KB is the default setting in the classic SSL protocol and can be adjusted according to the specific implementation and configuration.

[0101] Step B2: The data segment is compressed using the compression algorithm defined in the handshake protocol. If no compression algorithm is selected, compression is performed by default. To balance data transmission efficiency and security, and to reduce potential security vulnerabilities, the length of the compressed unit does not exceed 1024 bytes.

[0102] Step B3: Extract the corresponding quantum key using the quantum key frame header information negotiated by the rights handshake protocol, and calculate the MAC (Message Authentication Code) value of the quantum key and the compression unit. Use the quantum key to encrypt the MAC value and the compression unit to form an encryption unit. Here, MAC is a function of message and key, MAC = C(K, M), where M is the input information, K is the shared key, and C is the MAC function, which is determined during the handshake process.

[0103] Step B4: Add record information to the encryption unit, including higher-level protocol information, protocol version, compression length information, and encapsulate it into a TCP data packet.

[0104] Step B5: Transmit TCP packets to the client. After receiving the TCP packets, the client decrypts them. The decryption process is the reverse of the encryption process.

[0105] This invention provides a method and system for implementing a quantum security protocol based on the SSL protocol, which integrates quantum key distribution technology with network security protocols, prevents leakage of business data and tamper-proof verification data, and enhances the security of information transmission.

[0106] Those skilled in the art will understand that, besides implementing the system and its various devices, modules, and units provided by this invention in the form of purely computer-readable program code, the same functions can be achieved entirely through logical programming of the method steps, making the system and its various devices, modules, and units of this invention function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, the system and its various devices, modules, and units provided by this invention can be considered as a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; alternatively, the devices, modules, and units for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0107] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A method for implementing a quantum-safe protocol based on the SSL protocol, characterized in that, include: Step A: Establish a connection between the client and the server through a handshake protocol. The client authenticates the server, and then the server authenticates the client, thus completing the handshake protocol. Step B: The query request or plaintext data returned from the data center is segmented into data segments through the record layer protocol, the data segments are compressed, the compressed data segments are encrypted, and record information is added. After the client receives the encrypted information, it decrypts it. The handshake protocol and the record layer protocol are interdependent. When establishing an SSL connection, the handshake protocol is performed first, and the security of the communicating parties is ensured through related steps such as authentication and algorithm negotiation. The successful completion of the handshake protocol will result in the generation of a quantum key frame header and other security parameters. These parameters will be used for data encryption and integrity protection of the record layer protocol. Once the handshake is successful, the record layer protocol will use the quantum key and algorithm negotiated during the handshake phase to encrypt and protect the transmission of upper-layer application data. Step A includes: Step A1: This includes two parts: the client sending a Client Hello message to the server and the server sending back a Server Hello message. The client initiates the process by informing the server of the supported encryption algorithm combinations, the list of cipher suites, and the session ID. The server selects an encryption algorithm and a compression algorithm from the list of cipher suites sent by the client and sends them back along with the session ID. Step A2: The server sends a certificate message, a client certificate request message, and a certificate request completion message to the client; Step A3: If the server requires a client certificate, this stage is executed. The client first verifies whether the server provides a valid certificate. If the conditions are met, the client sends a client certificate message and a certificate authentication message to the server. Step A4: Complete the handshake protocol. The client sends a completion message, calculates the MAC value of the plaintext data using the quantum key, and encrypts the MAC value and the Finished character field using the agreed encryption algorithm. The encrypted data is then transmitted to the server. After the server decrypts the data and identifies the Finished character field, it calculates the MAC value. If the MAC values ​​are the same, the client returns a completion message. If they are different, the client immediately terminates the session. Step B includes: Step B1: Divide the plaintext data into data segments; Step B2: Compress the data segment using the compression algorithm selected in Step A. The compressed data segment is called a compression unit. If no compression algorithm is selected, compression is not performed by default. Step B3: Extract the corresponding quantum key using the quantum key frame header information negotiated by the handshake protocol, calculate the MAC value of the quantum key and the compression unit, and then use the quantum key to encrypt the compression unit and the MAC value. The encrypted compression unit and MAC value are called the encryption unit. Step B4: Add recording information to the encryption unit, the recording information including higher-level protocol information, protocol version, and compression length information; Step B5: Transmit data to the client. After receiving the encrypted information, the client decrypts it.

2. The method for implementing a quantum-safe protocol based on the SSL protocol according to claim 1, characterized in that, The MAC algorithm works as follows: calculate the MAC value based on the plaintext data and the quantum key, and then symmetrically encrypt the calculated MAC value and the plaintext data using the quantum key to obtain the final ciphertext.

3. The method for implementing a quantum-safe protocol based on the SSL protocol according to claim 1, characterized in that, The length of the split data block is 16KB.

4. The method for implementing a quantum-safe protocol based on the SSL protocol according to claim 1, characterized in that, The length of the compressed unit does not exceed 1024 bytes.

5. A quantum-safe protocol implementation system based on the SSL protocol, characterized in that, include: Module A: Establishes a connection between the client and the server through a handshake protocol. The client authenticates the server, and then the server authenticates the client, thus completing the handshake protocol. Module B: The module segments query requests or plaintext data returned from the data center into data segments using the record layer protocol, compresses the data segments, encrypts the compressed data segments, and adds record information. The client decrypts the encrypted information upon receiving it. The handshake protocol and the record layer protocol are interdependent. When establishing an SSL connection, the handshake protocol is performed first, and the security of the communicating parties is ensured through related steps such as authentication and algorithm negotiation. The successful completion of the handshake protocol will result in the generation of a quantum key frame header and other security parameters. These parameters will be used for data encryption and integrity protection of the record layer protocol. Once the handshake is successful, the record layer protocol will use the quantum key and algorithm negotiated during the handshake phase to encrypt and protect the transmission of upper-layer application data. Module A includes: Module A1 consists of two parts: the client sending a Client Hello message to the server and the server sending back a Server Hello message. The client initiates the process by informing the server of the supported encryption algorithm combinations, the list of cipher suites, and the session ID. The server selects the encryption algorithm and compression algorithm from the list of cipher suites sent by the client and sends them back along with the session ID. Module A2: The server sends certificate messages, client certificate request messages, and certificate request completion messages to the client; Module A3: If the server requires a client certificate, this stage is executed. The client first verifies whether the server provides a valid certificate. If the conditions are met, the client sends a client certificate message and a certificate authentication message to the server. Module A4: Complete the handshake protocol. The client sends a completion message, calculates the MAC value of the plaintext data using quantum key distribution, and encrypts the MAC value and the Finished character field using the agreed encryption algorithm. The encrypted data is then transmitted to the server. After the server decrypts the data and identifies the Finished character field, it calculates the MAC value. If the MAC values ​​are the same, the server returns a completion message. If they are different, the session is terminated immediately. The MAC algorithm is as follows: calculate the MAC value based on the plaintext data and the quantum key, and then symmetrically encrypt the calculated MAC value and the plaintext data using the quantum key to obtain the final ciphertext; Module B includes: Module B1: Divides plaintext data into data segments, with each data block being 16KB in length; Module B2: Compresses the data segment using the compression algorithm selected in Module A. The compressed data segment is called a compressed unit. If no compression algorithm is selected, no compression is performed by default. The length of the compressed unit does not exceed 1024 bytes. Module B3: Extract the corresponding quantum key using the quantum key frame header information negotiated by the handshake protocol, calculate the MAC value of the quantum key and the compression unit, and then use the quantum key to encrypt the compression unit and the MAC value. The encrypted compression unit and MAC value are called the encryption unit. Module B4: Add recording information to the encryption unit, the recording information including higher-layer protocol information, protocol version, and compression length information; Module B5: Transmits data to the client. After receiving the encrypted information, the client decrypts it.

6. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the quantum-safe protocol implementation method based on the SSL protocol as described in any one of claims 1 to 4.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the computer program is executed by a processor, it implements the steps of the quantum-safe protocol implementation method based on the SSL protocol as described in any one of claims 1 to 4.

Images