Quantum-resistant security enhancement method for open licensing protocols

Abstract

The present application discloses a method for enhancing the anti-quantum security of an open authorization protocol of a communication network. The method includes: sending an authorization request to a second network device. Receiving an authorization code generated by the second network device according to the authorization request. Obtaining a first quantum key from a first network node according to the authorization code. Encrypting parameter information of an initial token request according to the first quantum key and a post-quantum cryptographic algorithm to obtain anti-quantum parameter information, and sending the anti-quantum parameter information to a second network device. Receive an anti-quantum token sent by the second network device. Sending a resource access request to the second network device according to the anti-quantum token, the second network device confirms the access rights of the resource according to the resource access request, so that the first network device can access the resource of the second network device. The first network device and the second network device encrypt communication by using a post-quantum cryptographic algorithm and quantum key distribution technology, significantly enhancing the ability to resist quantum computing attacks.

Description

Technical Field

[0001] The present application relates to the field of network security, and more specifically, to a method for enhancing the anti-quantum security of an open authorization protocol of a communication network. Background Art

[0002] The leap in computing power represented by quantum computing has a significant impact on the security of related algorithms in classical cryptography. Understandably, with the realization of large-scale quantum computers, it will have a certain impact on key negotiation, encryption, signature and other applications in classical cryptography. Therefore, providing cryptographic technology that can resist quantum computing attacks has become an urgent problem to be solved. Summary of the invention

[0003] The present application provides a method for enhancing the anti-quantum security of an open authorization protocol of a communication network.

[0004] The embodiment of the present application provides a method for enhancing the anti-quantum security of an open authorization protocol of a communication network, wherein the communication network includes a first network device and a second network device, and the method is used for the first network device, and the method includes:

[0005] Sending an authorization request to the second network device;

[0006] Receiving an authorization code generated by the second network device according to the authorization request;

[0007] Obtaining a first quantum key from a first network node connected to the first network device according to the authorization code;

[0008] Encrypting the parameter information of the initial token request according to the first quantum key and the post-quantum cryptographic algorithm to obtain quantum-resistant parameter information, and sending the quantum-resistant parameter information to the second network device, where the parameter information of the initial token request is generated by the first network device according to the authorization code;

[0009] receiving a quantum-resistant token sent by the second network device, where the quantum-resistant token is generated by the second network device according to the quantum-resistant parameter information;

[0010] A resource access request is sent to the second network device according to the quantum-resistant token, and the second network device confirms access rights to resources corresponding to the resource access request according to the resource access request, so that the first network device can access resources of the second network device.

[0011] In this way, in the communication process in which the first network device applies to access resources in the second network device, the first network device applies to obtain a quantum key, and uses the quantum key and the post-quantum cryptographic algorithm to encrypt the parameter information of the initial token request generated according to the authorization code to generate anti-quantum parameter information that can resist quantum computing attacks. The post-quantum cryptographic algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good anti-quantum computing attack capabilities. Next, the second network device generates an anti-quantum token based on the anti-quantum parameter information sent by the first network device, and sends the anti-quantum token to the first network device. Then, the first network device generates a resource access request based on the anti-quantum token for accessing resources in the second network device. Finally, the second network device determines whether the first network device can access the resources corresponding to the resource access request by verifying the validity of the anti-quantum token. In this way, the anti-quantum computing attack capability of the communication process in which the first network device applies to access the resources of the second network device is enhanced by quantum key distribution technology and post-quantum cryptographic algorithms.

[0012] In certain embodiments, the method further comprises:

[0013] Sending a registration request to the second network device, the registration request including a post-quantum public key of the first network device;

[0014] A registration response request generated according to the registration request and sent by the second network device is received, where the registration response request includes a public key of the second network device.

[0015] In this way, the first network device sends a registration request to the second network device, and the registration request includes the post-quantum public key of the first network device. Then, the first network device receives a registration response request generated by the second network device according to the registration request, and the registration response request includes the public key of the second network device. In this way, the first network device and the second network device can exchange keys securely, and the first network device obtains the public key of the second network device for subsequent signing and verification processes. The second network device obtains the post-quantum public key of the first network device. The post-quantum public key has good resistance to quantum computing attacks, which can make the transmitted data have good resistance to quantum computing attacks.

[0016] In some embodiments, obtaining a first quantum key from a first network node connected to the first network device according to the authorization code includes:

[0017] Using a service node to inject multiple keys into a cryptographic module of the first network device;

[0018] Sending a quantum key application to the service node according to the authorization code, wherein the quantum key application is protected by a protection key, and the protection key is a randomly used one of multiple keys injected into the cryptographic module;

[0019] receiving a quantum key encryption result obtained by the service node encrypting the first quantum key according to the protection key, where the first quantum key is distributed to the service node by a first network node connected to the service node;

[0020] The quantum key encryption result is decrypted to obtain the first quantum key.

[0021] In this way, the first network device uses the service node to inject multiple keys into the cryptographic module of the first network device. Then, the first network device sends a quantum key application to the service node based on the authorization code received from the second network device. The quantum key application is protected by a protection key, which is a randomly used one of the multiple keys injected into the cryptographic module. Then, the first network device receives the quantum key encryption result obtained by the service node by encrypting the first quantum key according to the protection key. The first quantum key is generated by the first network node accessing the service node and distributed to the service node. Finally, the first network device decrypts the quantum key encryption result to obtain the first quantum key. In this way, the first network device obtains the first quantum key, which has good resistance to quantum computing attacks and can protect the communication between the first network device and the second network device with good resistance to quantum computing attacks.

[0022] In some embodiments, encrypting the parameter information of the initial token request according to the first quantum key and the post-quantum cryptographic algorithm to obtain quantum-resistant parameter information, and sending the quantum-resistant parameter information to the second network device includes:

[0023] Generate an initial token request based on the authorization code;

[0024] Encrypting the parameter information of the initial token request according to the first quantum key to obtain a first encrypted message;

[0025] Performing post-quantum cryptographic signature processing on the entire splicing of the parameter information according to the post-quantum public key of the first network device to obtain a first signature message;

[0026] The quantum-resistant parameter information is constructed according to the parameter information, the first encrypted message and the first signed message.

[0027] In this way, the first network device generates an initial token request according to the authorization code. Next, the first network device encrypts the parameter information of the initial token request according to the first quantum key to obtain a first encrypted message. Then, the first network device performs post-quantum cryptographic signature processing on the spliced ​​parameter information as a whole according to the post-quantum public key of the first network device to obtain a first signed message. Finally, the first network device constructs quantum-resistant parameter information according to the parameter information, the first encrypted message and the first signed message. In this way, the first network device encrypts the parameter information of the initial token request using the first quantum key to obtain the first encrypted message, so that the parameter information of the initial token request has good resistance to quantum computing attacks. And the parameter information is signed using the post-quantum public key to ensure the integrity and authenticity of the parameter information during transmission.

[0028] In certain embodiments, the method further comprises:

[0029] The received quantum-resistant token is verified according to the public key of the second network device to determine the correctness of the quantum-resistant token, where the quantum-resistant token includes a second random number randomly generated by the second network device.

[0030] In this way, the first network device verifies the received quantum-resistant token according to the public key of the second network device to determine the correctness of the quantum-resistant token, and the quantum-resistant token includes the second random number randomly generated by the second network device. In this way, the first network device verifies the quantum-resistant token through the public key of the second network device, and the first network device can confirm that the quantum-resistant token is issued by the second network device, thereby ensuring the authenticity of the quantum-resistant token.

[0031] In certain embodiments, the method further comprises:

[0032] Splicing the first random number randomly generated by the first network device and the second random number to obtain a first spliced ​​body;

[0033] Performing post-quantum cryptographic signature processing on the first spliced ​​body to obtain a first post-quantum signature value;

[0034] The first post-quantum signature value is sent to the second network device along with the resource access request.

[0035] In this way, the first network device concatenates the first random number and the second random number randomly generated by the first network device to obtain a first concatenation. Then, the first network device performs post-quantum cryptographic signature processing on the first concatenation to obtain a first post-quantum signature value. Finally, the first network device sends the first post-quantum signature value to the second network device along with the resource access request. In this way, by concatenating the second random number and the first random number and performing post-quantum cryptographic signature processing to obtain the first post-quantum signature value, the uniqueness and unpredictability of the first post-quantum signature value are increased, which helps prevent replay attacks and improve the security of the token. The use of the post-quantum signature algorithm can ensure the integrity and authenticity of the token during transmission.

[0036] The embodiment of the present application provides a method for enhancing the anti-quantum security of an open authorization protocol of a communication network, wherein the communication network includes a first network device and a second network device, and the method is used for the second network device, and the method includes:

[0037] Receiving an authorization request sent by the first network device;

[0038] obtaining an authorization code from a second network node connected to the second network device according to the authorization request, and sending the authorization code to the first network device;

[0039] receiving quantum-resistant parameter information sent by the first network device, the quantum-resistant parameter information being obtained by the first network device encrypting parameter information of an initial token request according to a first quantum key and a post-quantum cryptographic algorithm, the first quantum key being obtained by the first network device from a first network node connected to the first network device according to the authorization code, and the parameter information being generated by the first network device according to the authorization code;

[0040] Generate a quantum-resistant token according to the quantum-resistant parameter information, and send the quantum-resistant token to the first network device;

[0041] Receive a resource access request generated by the first network device according to the quantum-resistant token request, and confirm access rights to resources corresponding to the resource access request, so that the first network device can access resources of the second network device.

[0042] In this way, in the communication process in which the first network device applies to access resources in the second network device, the first network device applies to obtain a quantum key, and uses the quantum key and the post-quantum cryptographic algorithm to encrypt the parameter information of the initial token request generated according to the authorization code to generate anti-quantum parameter information that can resist quantum computing attacks. The post-quantum cryptographic algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good anti-quantum computing attack capabilities. Next, the second network device generates an anti-quantum token based on the anti-quantum parameter information sent by the first network device, and sends the anti-quantum token to the first network device. Then, the first network device generates a resource access request based on the anti-quantum token for accessing resources in the second network device. Finally, the second network device determines whether the first network device can access the resources corresponding to the resource access request by verifying the validity of the anti-quantum token. In this way, the anti-quantum computing attack capability of the communication process in which the first network device applies to access the resources of the second network device is enhanced by quantum key distribution technology and post-quantum cryptographic algorithms.

[0043] In certain embodiments, the method further comprises:

[0044] Receiving a registration request sent by the first network device, wherein the registration request includes a post-quantum public key of the first network device;

[0045] Sending a registration response request generated according to the registration request, wherein the registration response request includes a public key of the second network device.

[0046] In this way, the second network device receives the registration request sent by the first network device, and the registration request includes the post-quantum public key of the first network device. Then, the second network device sends a registration response request generated according to the registration request, and the registration response request includes the public key of the second network device. In this way, the first network device and the second network device can exchange keys securely, and the first network device obtains the public key of the second network device for subsequent signing and verification processes. The second network device obtains the post-quantum public key of the first network device. The post-quantum public key has good resistance to quantum computing attacks, which can make the transmitted data have good resistance to quantum computing attacks.

[0047] In some implementations, obtaining an authorization code from a second network node connected to the second network device according to the authorization request, and sending the authorization code to the first network device includes:

[0048] If the second network device determines to approve the authorization request, sending a quantum key application to the second network node;

[0049] receiving a second quantum key and a quantum key identifier sent by the second network node according to the quantum key application, where the quantum key identifier is obtained by the second network node identifying the second quantum key according to an identification code of the second network node;

[0050] The quantum key identifier is used as the authorization code, and the authorization code is sent to the first network device.

[0051] In this way, when the second network device determines to approve the authorization request, the second network device sends a quantum key application to the second network node. Then, the second network device receives the second quantum key and quantum key identifier sent by the second network node according to the quantum key application. The quantum key identifier is obtained by the second network node identifying the second quantum key according to the identification code of the second network node. Finally, the second network device uses the quantum key identifier as an authorization code and sends the authorization code to the first network device. In this way, the second network device obtains the second quantum key and quantum key identifier. The second quantum key has good resistance to quantum computing attacks and can be used to make the communication between the first network device and the second network device have strong confidentiality. The quantum key identifier helps to manage and use quantum keys. Using the quantum key identifier as an authorization code has strong confidentiality.

[0052] In some embodiments, the quantum resistant token request includes a first encrypted message and a first signed message, and the method further includes:

[0053] In case of receiving the anti-quantum parameter information sent by the first network device, confirming the anti-quantum token application status of the first network device;

[0054] In the case where the first network device has not applied for a quantum-resistant token, encrypting the parameter information of the initial token request according to the second quantum key to obtain a second encrypted message, so as to determine that the second encrypted message is consistent with the first encrypted message;

[0055] When the second encrypted message is consistent with the first encrypted message, the first signed message is verified using the post-quantum public key of the first network device to confirm that the first network device can obtain the quantum-resistant token.

[0056] In this way, when receiving the anti-quantum parameter information sent by the first network device, the second network device confirms the anti-quantum token application status of the first network device. In the case that the first network device has not applied for an anti-quantum token, the second network device encrypts the parameter information of the initial token request according to the second quantum key to obtain a second encrypted message to determine that the second encrypted message is consistent with the first encrypted message. In the case that the second encrypted message is consistent with the first encrypted message, the first signature message is verified using the post-quantum public key of the first network device to confirm that the first network device can obtain the anti-quantum token. In this way, by comparing the consistency of the second encrypted message with the first encrypted message, the integrity and non-tampering of the information can be ensured. And through multiple verifications, the second network device confirms that the first network device can obtain the anti-quantum token, ensuring the security and effectiveness of the authorization process.

[0057] In some embodiments, the method of generating a quantum-resistant token according to the quantum-resistant parameter information and sending the quantum-resistant token to the first network device includes:

[0058] Generate an initial token according to the quantum-resistant parameter information;

[0059] Splicing the second random number randomly generated by the second network device and the anti-quantum parameter information to obtain a second spliced ​​body;

[0060] Signing the second spliced ​​body according to the public key of the second network device to obtain a second signed message;

[0061] Storing the second random number and the second signature message in the initial token to obtain the quantum-resistant token;

[0062] The quantum-resistant token is sent to the first network device.

[0063] In this way, the second network device generates an initial token based on the anti-quantum parameter information. And the second network device splices the second random number randomly generated by the second network device and the anti-quantum parameter information to obtain a second spliced ​​body. Then, the second network device signs the second spliced ​​body according to the public key of the second network device to obtain a second signature message. Then, the second network device stores the second random number and the second signature message in the initial token to obtain an anti-quantum token. Finally, the second network device sends the anti-quantum token to the first network device. In this way, the second network device splices the second random number and the anti-quantum parameter information to ensure the uniqueness and complexity of the anti-quantum token, which helps to prevent replay attacks and improve the security of the anti-quantum token. And the combination of random numbers, splicing processing and signature technology provides strong protection for the security and integrity of the anti-quantum token, which helps to protect the security of data and communications.

[0064] In some embodiments, the resource access request includes a first post-quantum signature value and a first signature message, the receiving the resource access request generated by the first network device according to the anti-quantum token request, and confirming the access rights of the resource corresponding to the resource access request so that the first network device performs resource access to the second network device, the method comprising:

[0065] Determining the correctness of the first post-quantum signature value according to a post-quantum cryptographic signature algorithm;

[0066] Determining the correctness of the first signed message according to the post-quantum public key of the first network device;

[0067] Determining the correctness of the second signed message according to the public key of the second network device;

[0068] When the first post-quantum signature value is correct and the second signature message is correct, the first network device is allowed to access the resource corresponding to the resource access request.

[0069] In this way, the second network device determines the correctness of the first post-quantum signature value according to the post-quantum cryptographic signature algorithm. Then, the correctness of the first signature message is determined according to the post-quantum public key of the first network device. Next, the second network device determines the correctness of the second signature message according to the public key of the second network device. When the first post-quantum signature value is correct, the first signature message is correct, and the second signature message is correct, the second network device allows the first network device to access the resources corresponding to the resource access request. In this way, by verifying the correctness of the first post-quantum signature value, the first signature message, and the second signature message, the second network device can ensure the authenticity of the identity of the first network device, provide strong security and quantum security for resource access requests, and help protect the security of data and communications.

[0070] Additional aspects and advantages of the embodiments of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the embodiments of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0072] Figure 1 It is one of the flow charts of the method of the implementation mode of the present application;

[0073] Figure 2 It is an architectural diagram of a method for implementing the present application;

[0074] Figure 3is a signaling diagram of a method according to an embodiment of the present application;

[0075] Figure 4 This is the second flow chart of the method of the implementation mode of the present application;

[0076] Figure 5 This is the third flow chart of the method of the implementation mode of the present application;

[0077] Figure 6 This is the fourth flow chart of the method of the implementation mode of the present application;

[0078] Figure 7 This is the fifth flow chart of the method of the implementation mode of the present application;

[0079] Figure 8 This is the sixth flow chart of the method of the implementation mode of the present application;

[0080] Fig. 9 This is the seventh flow chart of the method of the implementation mode of the present application;

[0081] Fig.10 This is the eighth flow chart of the method of the implementation mode of the present application;

[0082] Fig.11 This is the ninth flow chart of the method of the implementation mode of the present application;

[0083] Fig.12 This is the tenth flowchart of the method of the implementation mode of the present application;

[0084] Fig.13 This is the eleventh flow chart of the method of the implementation mode of the present application;

[0085] Fig.14 This is the twelfth flow chart of the method of the implementation mode of the present application. DETAILED DESCRIPTION

[0086] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals represent the same or similar elements or elements having the same or similar functions from beginning to end. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the embodiments of the present application, and cannot be understood as limiting the embodiments of the present application.

[0087] The leap in computing power represented by quantum computing has a significant impact on the security of related algorithms in classical cryptography. In other words, quantum computing poses a more direct and urgent threat to the cracking of classical cryptography. A series of classical algorithms, such as Diffie-Hellman, RSA, and elliptic curve (ECC), face greater security risks because the number theory problems they are based on, such as large prime number decomposition and discrete logarithms, are no longer difficult in the quantum era. Understandably, with the realization of large quantum computers, it will have a certain impact on key negotiation, encryption, signature and other applications in classical cryptography.

[0088] As a result, the security of the Internet, which uses classical cryptographic algorithms to protect the communication process, is deeply threatened by quantum computing attacks. For example, Open Authorization (OAuth), an open standard authorization protocol, is used to authorize an application or service to access the resources of a user in another application without providing a username and password. This allows users to share their data resources while maintaining control over their data. The Open Authorization Protocol is an authentication framework based on which a variety of authentication mechanisms can be implemented, such as authentication codes, security assertions, security tokens, JOSE (Json Signatures and Encrypted Objects), etc. These classic authentication technologies use classic public key encryption algorithms such as the RSA algorithm and the ECC algorithm. However, in this way, the Open Authorization Protocol does not have the ability to resist quantum computing attacks, and has a greater security risk when facing quantum computing attacks.

[0089] At present, the international technologies for dealing with the threat of quantum computing attacks are mainly divided into two categories: one is to use asymmetric algorithms for (symmetric) key negotiation and then encrypt and transmit through symmetric algorithms, and study the use of quantum key distribution (Quantum Key Distribution, QKD) networks for symmetric key negotiation to protect the security of keys; the other is to study post-quantum cryptography (Post-Quantum Cryptography, PQC) algorithms to directly replace existing asymmetric algorithms. Quantum key distribution technology uses the principles of quantum mechanics to generate keys that cannot be stolen by third parties, ensuring the security of key transmission. It is particularly suitable for key exchange scenarios and can replace existing asymmetric key negotiation algorithms, such as RSA or ECC, to improve the security of keys. However, quantum key distribution technology cannot currently completely replace all applications of asymmetric algorithms. For example, scenarios such as signature verification and integrity protection still require the use of asymmetric algorithms.

[0090] Post-quantum cryptographic algorithms are asymmetric cryptographic algorithms designed based on new mathematical problems, aiming to resist the possible threats posed by quantum computers. NIST has announced the first batch of four post-quantum cryptographic algorithms to be standardized, including Kyber, Dilithium, Falcon, and SPHINCS+. These algorithms cover a variety of technical routes to reduce the risk of a single technology being cracked. Post-quantum cryptographic algorithms can theoretically replace all asymmetric algorithms and are more general. However, the security of post-quantum cryptographic algorithms still depends on the complexity of computational problems, and may face new cracking methods in the future or become unsafe as computing power increases. In addition, the post-quantum cryptographic algorithm standard has not yet been officially announced, and the production and certification of related products also take time, so its large-scale application still requires a long period of time.

[0091] Both post-quantum cryptographic algorithms and quantum key distribution technologies have the ability to resist quantum computing attacks, but each has its limitations. Therefore, providing relatively low-cost and highly secure cryptographic technology that can resist quantum computing attacks has become an urgent problem to be solved.

[0092] Based on the above questions, please refer to Figure 1 The embodiment of the present application provides a method for enhancing the anti-quantum security of an open authorization protocol of a communication network, wherein the communication network includes a first network device and a second network device, and the method is used for the first network device, and the method includes:

[0093] 011: Send an authorization request to the second network device;

[0094] 012: Receive the authorization code generated by the second network device according to the authorization request;

[0095] 013: Obtain a first quantum key from a first network node connected to the first network device according to the authorization code;

[0096] 014: Encrypt the parameter information of the initial token request according to the first quantum key and the post-quantum cryptographic algorithm to obtain quantum-resistant parameter information, and send the quantum-resistant parameter information to the second network device;

[0097] 015: receiving the quantum-resistant token sent by the second network device;

[0098] 016: Send a resource access request to the second network device according to the quantum-resistant token.

[0099] The embodiment of the present application also provides a first network device, including a memory and a processor. The method of the embodiment of the present application can be implemented by the first network device of the embodiment of the present application. Specifically, a computer program is stored in the memory, and the processor is used to send an authorization request to the second network device. And receive the authorization code generated by the second network device according to the authorization request. And obtain the first quantum key from the first network node connected to the first network device according to the authorization code. The processor is also used to encrypt the parameter information of the initial token request according to the first quantum key and the post-quantum cryptographic algorithm to obtain anti-quantum parameter information, and send the anti-quantum parameter information to the second network device. And receive the anti-quantum token sent by the second network device. The processor is also used to send a resource access request to the second network device according to the anti-quantum token.

[0100] The embodiment of the present application also provides a first network device security enhancement device. The method of the embodiment of the present application can be implemented by the first network device security enhancement device of the embodiment of the present application. Specifically, the first network device security enhancement device includes a sending module, a receiving module, an acquisition module, an encryption module and a receiving module. The sending module is used to send an authorization request to the second network device. The receiving module is used to receive the authorization code generated by the second network device according to the authorization request. The acquisition module is used to obtain the first quantum key from the first network node connected to the first network device according to the authorization code. The encryption module is used to encrypt the parameter information of the initial token request according to the first quantum key and the post-quantum cryptographic algorithm to obtain anti-quantum parameter information, and send the anti-quantum parameter information to the second network device. The receiving module is used to receive the anti-quantum token sent by the second network device. The sending module is also used to send a resource access request to the second network device according to the anti-quantum token.

[0101] The present application provides a communication system based on an open authorization protocol, the communication system comprising a first network device, a second network device and a quantum key distribution network of the above-mentioned implementation mode, and the quantum key distribution network is configured to distribute quantum keys to the first network device or the second network device.

[0102] Specifically, the quantum key distribution network includes network nodes and a quantum network link control center. Network nodes are used to store and distribute quantum keys in the quantum key distribution network. The quantum network link center can establish quantum key distribution and relay links between network nodes according to the names of network nodes. Quantum key distribution and relay links are used for functions such as data transfer. The quantum key distribution network is used to realize services such as quantum key generation, quantum key relay, and quantum key provision.

[0103] See also Figure 2In some embodiments, the first network device sends an authorization request to the second network device, and the second network device responds to the authorization request sent by the first network device. In addition, the first network device also sends a token request to the second network device, and the second network device also responds to the token request sent by the first network device. Through multiple request sending and response, the first network device and the second network device complete the generation and distribution of tokens. The first network device accesses a service node, which is a transfer station used by the first network device to connect to the network node, and is used to inject keys into the first network device and transfer and store quantum keys. After the first network device sends a quantum key application, the network node sends the quantum key generated by the quantum key distribution network to the service node connected to the first network device, and the service node then sends the quantum key to the first network device. The simple process of the first network device and the second network device obtaining the quantum key is as follows: First, the second network device sends a quantum key application to the second network node connected to the second network device. Then, the second network node distributes the quantum key generated according to the quantum key application to the second network device. At the same time, the quantum network link control center synchronously generates a quantum key for the first network node connected to the first network device, but the quantum key will not be immediately distributed to the first network device, but will be stored in the network node first. The corresponding relationship between the first network device, the second network device, the service node and the network node is provided by the management and control platform.

[0104] It should be noted that the implementation method of this application uses FIPS203 Module-Lattice-based Key-Encapsulation Mechanism Standard as the PQC key encapsulation algorithm and FIPS 204 Module-Lattice-Based Digital Signature Standard as the PQC digital signature algorithm for example for explanation. The following descriptions of operations related to the PQC algorithm refer to the above FIPS standards. Of course, in other implementations, other algorithms such as the NewHope algorithm, Sidh algorithm, HQC algorithm, etc. can also be used as PQC related algorithms. It should also be noted that the embodiments of this application are for the Open Authorization Protocol (Open Authorization, OAuth), hereinafter referred to as the OAuth protocol.

[0105] Specifically, the parameter information of the initial token request is the parameter information required by the first network device to initiate an access token request.

[0106] The first network device sends an authorization request to the second network device for accessing resources in the second network device. When the second network device receives the authorization request sent by the first network device, the second network device receives the quantum key identifier sent by the second network node and returns the quantum key identifier to the first network device as an authorization code.

[0107] The first network device receives the authorization code generated according to the authorization request sent by the second network device, and obtains the first quantum key from the first network node connected to the first network device according to the authorization code. The first network device then encrypts the parameter information of the initial token request according to the first quantum key and the post-quantum cryptographic algorithm to obtain quantum-resistant parameter information, and sends the quantum-resistant parameter information to the second network device. The parameter information of the initial token request is generated by the first network device according to the authorization code.

[0108] The second network device receives the anti-quantum parameter information sent by the first network device, generates an anti-quantum token according to the anti-quantum parameter information, and then sends the anti-quantum token to the first network device.

[0109] The first network device receives the quantum-resistant token sent by the second network device, and then the first network device sends a resource access request to the second network device according to the quantum-resistant token. The second network device receives the resource access request generated by the first network device according to the quantum-resistant token, and confirms the access rights of the resource corresponding to the resource access request, so that the first network device can access the resource of the second network device.

[0110] The following is an example to illustrate the method of implementing the present application. In the embodiment of the present application, the first network device is a client, a client of the OAUTH protocol, and a third-party application that needs to access related resources in the OAUTH application scenario. The client includes a resource owner, and the resource owner authorizes the resource access rights owned by the third-party application that needs to access the resource in the OAUTH application scenario. The second network device is a server, and the server includes an authentication server and a resource server. The authentication server is a server used to process authentication requests and issue tokens for authorizing access to related resources in the OAUTH application scenario, and the resource server is a server that provides related resources and their services. The resource server and the authentication server can be the same server or different servers. The same or different servers have no substantial effect on the anti-quantum enhancement method of the present application. In practical applications, the choice of the same server or different servers depends on specific needs, security considerations and budgets. The resource server and the authentication server in the embodiment of the present application are the same server.

[0111] The quantum network node is a network node that stores and provides the generated quantum key to the server through a trusted channel or provides the generated quantum key to the client through a cryptographic service node. The cryptographic service node is a service node that is used to connect to the quantum network node and provide pre-shared key injection and quantum key services to multiple clients.

[0112] The authorization request is the Authorization Request message. The authorization code is the Authorization Code. The initial token request is the Access Token Request message. The initial token is Access Token-1, and the quantum-resistant token is AccessToken-2.

[0113] See also Figure 3 , the client sends an authorization request Authorization Request to the authentication server for accessing resources in the self-resource server. When the authentication server receives the authorization request AuthorizationRequest sent by the client, the authentication server receives the quantum key identifier UUID_QK sent by the second quantum network node connected to the authentication server, and returns the quantum key identifier UUID_QK as the authorization code Authorization Code to the client.

[0114] The client receives the authorization code Authorization Code generated by the authentication server according to the authorization request Authorization Code, and obtains the first quantum key QK_UUID-1 from the first quantum network node connected to the client according to the authorization code Authorization Code. The client then encrypts the parameter information of the initial token request Access Token Request message according to the first quantum key QK_UUID-1 and the post-quantum cryptographic algorithm to obtain anti-quantum parameter information, and sends the anti-quantum parameter information to the authentication server. The parameter information of the initial token request Access Token Request message is generated by the client according to the authorization code Authorization Code.

[0115] The authentication server receives the anti-quantum parameter information sent by the client, generates an anti-quantum token Access Token-2 according to the anti-quantum parameter information, and then sends the anti-quantum token Access Token-2 to the client.

[0116] The client receives the quantum-resistant token Access Token-2 sent by the authentication server, and then sends a resource access request to the resource server based on the quantum-resistant token Access Token-2. The resource server receives the resource access request generated by the client based on the quantum-resistant token Access Token-2, and confirms the access rights to the resource corresponding to the resource access request, so that the client can access the resource on the resource server.

[0117] In summary, in the anti-quantum security enhancement method, communication system, first network device and second network device of the open authorization protocol of the communication network of the implementation mode of the present application, for the communication process in which the first network device applies to access the resources in the second network device, the first network device applies to obtain a quantum key, and uses the quantum key and the post-quantum cryptographic algorithm to encrypt the parameter information of the initial token request generated according to the authorization code to generate anti-quantum parameter information that can resist quantum computing attacks. The post-quantum cryptographic algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good anti-quantum computing attack capabilities. Then, the second network device generates an anti-quantum token according to the anti-quantum parameter information sent by the first network device, and sends the anti-quantum token to the first network device. Then, the first network device generates a resource access request based on the anti-quantum token for accessing the resources in the second network device. Finally, the second network device determines whether the first network device can access the resources corresponding to the resource access request by verifying the validity of the anti-quantum token. In this way, the anti-quantum computing attack capability of the communication process in which the first network device applies to access the resources of the second network device is enhanced by quantum key distribution technology and post-quantum cryptographic algorithms.

[0118] See also Figure 4 In some embodiments, the method further comprises:

[0119] 017: Send a registration request to the second network device;

[0120] 018: Receive a registration response request generated according to the registration request and sent by the second network device.

[0121] In some implementations, the sending module is used to send a registration request to the second network device. The receiving module is used to receive a registration response request generated according to the registration request and sent by the second network device.

[0122] In some implementations, the processor is further configured to send a registration request to the second network device, and receive a registration response request generated according to the registration request and sent by the second network device.

[0123] Specifically, the first network device sends a registration request to the second network device, and the registration request includes the post-quantum public key of the first network device. Then, the first network device receives a registration response request generated by the second network device according to the registration request, and the registration response request includes the public key of the second network device. In this way, the first network device and the second network device can exchange keys securely, and the first network device obtains the public key of the second network device for subsequent signing and verification processes. The second network device obtains the post-quantum public key of the first network device. The post-quantum public key has good resistance to quantum computing attacks and can make the transmitted data quantum-resistant.

[0124] Continuing with the above example, please refer again to Figure 3 Before the client sends an authorization request to the server, the client sends a registration request to the authentication server in accordance with the standard document RFC7591 (OAuth 2.0 Dynamic Registration) published by the Internet Engineering Task Force (IETF), and submits the client's PQC public key in the registration request. Then, the client receives the registration response request generated by the authentication server based on the registration request. The successfully returned registration response request carries the ECC or RSA public key of the authentication server.

[0125] In this way, the client and the authentication server can exchange keys securely. The client obtains the ECC or RSA public key of the authentication server for subsequent signing and verification processes. The authentication server obtains the PQC public key of the client. The PQC public key has good resistance to quantum computing attacks and can make the transmitted data quantum-resistant.

[0126] See also Figure 5 In some embodiments, step 013 (obtaining a first quantum key from a first network node connected to a first network device according to an authorization code) includes:

[0127] 0131: Using the service node to inject multiple keys into the cryptographic module of the first network device;

[0128] 0132: Send quantum key application to the service node according to the authorization code;

[0129] 0133: receiving a quantum key encryption result obtained by the service node encrypting the first quantum key according to the protection key;

[0130] 0134: Decrypt the quantum key encryption result to obtain a first quantum key.

[0131] In some embodiments, the charging module is used to charge a plurality of keys into the cryptographic module of the first network device using the service node. The sending module is used to send a quantum key application to the service node according to the authorization code. The receiving module is used to receive a quantum key encryption result obtained by the service node encrypting the first quantum key according to the protection key. The decryption module is used to decrypt the quantum key encryption result to obtain the first quantum key.

[0132] In some embodiments, the processor is further configured to use the service node to inject multiple keys into the cryptographic module of the first network device, and send a quantum key application to the service node according to the authorization code, wherein the quantum key application is protected by the protection key. The processor is further configured to receive a quantum key encryption result obtained by the service node encrypting the first quantum key according to the protection key, and decrypt the quantum key encryption result to obtain the first quantum key.

[0133] Specifically, the first network device uses the service node to inject multiple keys into the cryptographic module of the first network device. Then, the first network device sends a quantum key application to the service node based on the authorization code received and sent by the second network device. The quantum key application is protected by a protection key, which is a randomly used one of the multiple keys injected into the cryptographic module. Then, the first network device receives the quantum key encryption result obtained by the service node by encrypting the first quantum key according to the protection key. The first quantum key is generated by the first network node accessing the service node and distributed to the service node. Finally, the first network device decrypts the quantum key encryption result to obtain the first quantum key. In this way, the first network device obtains the first quantum key, which has good resistance to quantum computing attacks and can protect the communication between the first network device and the second network device from having good resistance to quantum computing attacks.

[0134] Continuing with the above example, please refer again to Figure 3, the client uses the cryptographic service node to inject the pre-shared key of the personal cryptographic module of the resource owner in the client, with a total of 1M bits of 128-bit keys. The personal cryptographic module includes but is not limited to the smart cryptographic key (HSM) and the virtual security module (VSM). Then, the client sends a quantum key application to the cryptographic service node according to the authorization code Authorization Code, and randomly uses a key in the smart cryptographic key as the protection key. The client performs a hash operation (Hash-based Message Authentication Code, HMAC) on the key ID and the application content by using the SM3 algorithm and the protection key. Afterwards, the cryptographic service node also performs a hash operation on the key ID and the application content by using the SM3 algorithm and the protection key to verify the integrity and authenticity of the data. HMAC is a method that uses hash functions and keys to provide data integrity and source authentication.

[0135] After the quantum key application is confirmed successfully, the client receives the quantum key encryption result obtained by the cryptographic service node by encrypting the first quantum key QK_UUID-1 according to the protection key. The first quantum key QK_UUID-1 is generated by the first quantum network node connected to the cryptographic service node and distributed to the cryptographic service node. The client then decrypts the quantum key encryption result according to the protection key to obtain the first quantum key QK_UUID-1.

[0136] In this way, the client obtains the first quantum key QK_UUID-1, which can be used to subsequently generate keys that are more resistant to quantum computing attacks.

[0137] See also Figure 6 In some embodiments, step 014 (encrypting the parameter information of the initial token request according to the first quantum key and the post-quantum cryptographic algorithm to obtain quantum-resistant parameter information, and sending the quantum-resistant parameter information to the second network device) includes:

[0138] 0141: Generate an initial token request based on the authorization code;

[0139] 0142: Encrypting parameter information of the initial token request according to the first quantum key to obtain a first encrypted message;

[0140] 0143: Performing post-quantum cryptographic signature processing on the entire splicing of the parameter information according to the post-quantum public key of the first network device to obtain a first signature message;

[0141] 0144: Construct quantum-resistant parameter information according to the parameter information, the first encrypted message and the first signed message.

[0142] In some embodiments, the derivation module is used to generate an initial token request based on the authorization code. The encryption module is used to encrypt the parameter information of the initial token request based on the first quantum key to obtain a first encrypted message. The signature module is used to perform post-quantum cryptographic signature processing on the spliced ​​whole of the parameter information based on the post-quantum public key of the first network device to obtain a first signed message. The encapsulation module is used to form quantum-resistant parameter information based on the parameter information, the first encrypted message and the first signed message.

[0143] In some embodiments, the processor is further configured to generate an initial token request according to the authorization code, encrypt the parameter information of the initial token request according to the first quantum key to obtain a first encrypted message, and perform post-quantum cryptographic signature processing on the spliced ​​whole of the parameter information according to the post-quantum public key of the first network device to obtain a first signed message. The processor is further configured to form quantum-resistant parameter information according to the parameter information, the first encrypted message, and the first signed message.

[0144] Specifically, the first network device generates an initial token request according to the authorization code. Then, the first network device encrypts the parameter information of the initial token request according to the first quantum key to obtain a first encrypted message. Then, the first network device performs post-quantum cryptographic signature processing on the spliced ​​parameter information as a whole according to the post-quantum public key of the first network device to obtain a first signed message. Finally, the first network device constructs quantum-resistant parameter information according to the parameter information, the first encrypted message and the first signed message. In this way, the first network device encrypts the parameter information of the initial token request using the first quantum key to obtain the first encrypted message, so that the parameter information of the initial token request has good resistance to quantum computing attacks. And the parameter information is signed using the post-quantum public key to ensure the integrity and authenticity of the parameter information during transmission.

[0145] Continuing with the above example, the initial token request is an Access Token Request message, and the parameter information of the initial token request includes the client and user ID, resource ID, scope, recipient, etc.

[0146] Please refer to Figure 3After the client obtains the first quantum key QK_UUID-1 according to the authorization code UUID_QK, the client generates an initial token request Access Token Request message according to the authorization code UUID_QK. And send the Access TokenRequest message to the authentication server to request the authentication server for the initial token AccessToken-1 that can access the resource. The client generates parameter information of the Access Token Request message according to the demand for resources, such as client and user ID, resource ID, scope, recipient, etc. And use the first quantum key QK_UUID-1 as a hash key to calculate the parameter information of the Access Token Request message as a whole to obtain a first encrypted message m1 of more than 256 bits. In addition, the client also uses the PQC signature algorithm and its own PQC signature private key to calculate the splicing of the parameter information of the Access Token Request message as a whole to obtain the first signature message M1. Subsequently, the client uses the parameter information of the Access Token Request message and the first encrypted message m1 as the request content of the Access Token Request message, and uses the first signature message as the client authentication content in the Access Token Request message to obtain a new Access Token Request message, and calls the Access Token Request message quantum-resistant parameter information.

[0147] In this way, the client encrypts the parameter information of the initial token request Access Token Request message using the first quantum key QK_UUID-1 to obtain the first encrypted message m1, so that the parameter information of the Access Token Request message has good resistance to quantum computing attacks. The parameter information is signed using the post-quantum public key to ensure the integrity and authenticity of the parameter information during transmission.

[0148] See also Figure 7 In some embodiments, the method further comprises:

[0149] 019: Verify the received quantum-resistant token according to the public key of the second network device to determine the correctness of the quantum-resistant token.

[0150] In some embodiments, the verification module is used to verify the received quantum-resistant token according to the public key of the second network device to determine the correctness of the quantum-resistant token.

[0151] In some embodiments, the processor is further configured to verify the received quantum-resistant token according to the public key of the second network device to determine the correctness of the quantum-resistant token.

[0152] Specifically, the first network device verifies the received quantum-resistant token according to the public key of the second network device to determine the correctness of the quantum-resistant token, and the quantum-resistant token includes a second random number randomly generated by the second network device. In this way, the first network device verifies the quantum-resistant token through the public key of the second network device, and the first network device can confirm that the quantum-resistant token is issued by the second network device, thereby ensuring the authenticity of the quantum-resistant token.

[0153] Continuing with the above example, the public key of the authentication server is a public key in a classic algorithm, such as an ECC public key or an RSA public key. Figure 3 The client verifies the received quantum-resistant token Access Token-2 according to the public key of the authentication server to determine the correctness of the quantum-resistant token Access Token-2. The quantum-resistant token Access Token-2 includes a second random number R2 randomly generated by the authentication server.

[0154] In this way, by verifying the quantum-resistant token Access Token-2, the client can confirm that the quantum-resistant token Access Token-2 is issued by the authentication server, thereby ensuring the authenticity of the quantum-resistant token.

[0155] See also Figure 8 In some embodiments, the method further comprises:

[0156] 020: concatenate the first random number and the second random number randomly generated by the first network device to obtain a first concatenated body;

[0157] 021: Perform post-quantum cryptographic signature processing on the first spliced ​​body to obtain a first post-quantum signature value;

[0158] 022: Send the first post-quantum signature value along with the resource access request to the second network device.

[0159] In some embodiments, the splicing module is used to splice the first random number and the second random number randomly generated by the first network device to obtain a first spliced ​​body. The signature module is used to perform post-quantum cryptographic signature processing on the first spliced ​​body to obtain a first post-quantum signature value. The sending module is used to send the first post-quantum signature value to the second network device along with the resource access request.

[0160] In some embodiments, the processor is further configured to perform a splicing process on the first random number and the second random number randomly generated by the first network device to obtain a first splicing body, and perform a post-quantum cryptographic signature process on the first splicing body to obtain a first post-quantum signature value, and send the first post-quantum signature value to the second network device along with the resource access request.

[0161] Specifically, the first network device concatenates the first random number and the second random number randomly generated by the first network device to obtain a first concatenation. Then, the first network device performs post-quantum cryptographic signature processing on the first concatenation to obtain a first post-quantum signature value. Finally, the first network device sends the first post-quantum signature value to the second network device along with the resource access request. In this way, by concatenating the second random number and the first random number and performing post-quantum cryptographic signature processing to obtain the first post-quantum signature value, the uniqueness and unpredictability of the first post-quantum signature value are increased, which helps to prevent replay attacks and improve the security of the token. The use of the post-quantum signature algorithm can ensure the integrity and authenticity of the token during transmission.

[0162] Continuing with the above example, please refer again to Figure 3 After confirming the correctness of the anti-quantum token, the client sends a resource access request to the resource server with the anti-quantum token sent by the authentication server. The resource access request includes the client's authentication message, that is, the first post-quantum signature value. The first post-quantum signature value is generated as follows: the client concatenates the randomly generated 256-bit first random number R1 and the second random number R2 generated by the authentication server carried in the anti-quantum token to obtain a first concatenation. The client then performs post-quantum cryptographic signature processing on the first concatenation to obtain the first post-quantum signature value.

[0163] In this way, the client obtains the first post-quantum signature value by concatenating the second random number R2 and the first random number R1 and performing post-quantum cryptographic signature processing, which increases the uniqueness and unpredictability of the first post-quantum signature value, helps prevent replay attacks and improves the security of quantum-resistant tokens. The use of post-quantum signature algorithms can ensure the integrity and authenticity of quantum-resistant tokens during transmission.

[0164] See also Fig. 9 The embodiment of the present application provides a method for enhancing the anti-quantum security of an open authorization protocol of a communication network, wherein the communication network includes a first network device and a second network device, and the method is used for the second network device, and the method includes:

[0165] 031: receiving an authorization request sent by the first network device;

[0166] 032: Obtain an authorization code from a second network node connected to the second network device according to the authorization request, and send the authorization code to the first network device;

[0167] 033: receiving the quantum resistance parameter information sent by the first network device;

[0168] 034: Generate an anti-quantum token according to the anti-quantum parameter information, and send the anti-quantum token to the first network device;

[0169] 035: Receive a resource access request generated by the first network device according to the quantum-resistant token request, and confirm access rights to resources corresponding to the resource access request, so that the first network device can access resources of the second network device.

[0170] The embodiment of the present application also provides a second network device, including a memory and a processor. The method of the embodiment of the present application can be implemented by the second network device of the embodiment of the present application. Specifically, a computer program is stored in the memory, and the processor is used to receive an authorization request sent by the first network device. And obtain an authorization code from a second network node connected to the second network device according to the authorization request, and send the authorization code to the second network device. The processor is also used to receive anti-quantum parameter information sent by the first network device. And generate an anti-quantum token based on the anti-quantum parameter information, and send the anti-quantum token to the first network device. And receive a resource access request generated by the first network device according to the anti-quantum token request, confirm the access rights of the resources corresponding to the resource access request, so that the first network device can access the resources of the second network device.

[0171] The embodiment of the present application also provides a second network device security enhancement device. The method of the embodiment of the present application can be implemented by the second network device security enhancement device of the embodiment of the present application. Specifically, the second network device security enhancement device includes a receiving module, an acquisition module and a derivation module. The receiving module is used to receive an authorization request sent by the first network device. The acquisition module is used to obtain an authorization code from a second network node connected to the second network device according to the authorization request, and send the authorization code to the second network device. The receiving module is also used to receive anti-quantum parameter information sent by the first network device. The derivation module is used to generate an anti-quantum token based on the anti-quantum parameter information, and send the anti-quantum token to the first network device. The receiving module is also used to receive a resource access request generated by the first network device according to the anti-quantum token request, and confirm the access rights of the resources corresponding to the resource access request, so that the first network device can access the resources of the second network device.

[0172] The present application provides a communication system based on an open authorization protocol, the communication system comprising a second network device of the above-mentioned implementation mode, a first network device and a quantum key distribution network, and the quantum key distribution network is configured to distribute quantum keys to the first network device or the second network device.

[0173] Specifically, the anti-quantum security enhancement method of this embodiment is basically the same as the anti-quantum security enhancement method of the aforementioned embodiment with the first network device as the execution object. For details, please refer to the explanation of the corresponding part. The difference is that this embodiment takes the second network device as the execution object, which will not be repeated here.

[0174] In summary, in the anti-quantum security enhancement method, communication system, first network device and second network device of the open authorization protocol of the communication network of the implementation mode of the present application, for the communication process in which the first network device applies to access the resources in the second network device, the first network device applies to obtain a quantum key, and uses the quantum key and the post-quantum cryptographic algorithm to encrypt the parameter information of the initial token request generated according to the authorization code to generate anti-quantum parameter information that can resist quantum computing attacks. The post-quantum cryptographic algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good anti-quantum computing attack capabilities. Then, the second network device generates an anti-quantum token according to the anti-quantum parameter information sent by the first network device, and sends the anti-quantum token to the first network device. Then, the first network device generates a resource access request based on the anti-quantum token for accessing the resources in the second network device. Finally, the second network device determines whether the first network device can access the resources corresponding to the resource access request by verifying the validity of the anti-quantum token. In this way, the anti-quantum computing attack capability of the communication process in which the first network device applies to access the resources of the second network device is enhanced by quantum key distribution technology and post-quantum cryptographic algorithms.

[0175] See also Fig.10 In some embodiments, the method further comprises:

[0176] 036: receiving a registration request sent by the first network device;

[0177] 037: Send a registration response request generated based on the registration request.

[0178] In some implementations, the receiving module is further configured to receive a registration request sent by the first network device. The sending module is further configured to send a registration response request generated according to the registration request.

[0179] In some implementations, the processor is further configured to receive a registration request sent by the first network device, and send a registration response request generated according to the registration request.

[0180] Specifically, the second network device receives a registration request sent by the first network device, and the registration request includes the post-quantum public key of the first network device. Then, the second network device sends a registration response request generated according to the registration request, and the registration response request includes the public key of the second network device. In this way, the first network device and the second network device can exchange keys securely, and the first network device obtains the public key of the second network device for subsequent signing and verification processes, and the second network device obtains the post-quantum public key of the first network device, which has good resistance to quantum computing attacks.

[0181] Continuing with the above example, see Figure 3 The authentication server receives a registration request sent by the client according to RFC7591, and the registration request includes the post-quantum public key of the first network device. Then, the authentication server sends a registration response request generated according to the registration request, and the registration response request includes the public key of the second network device, such as an ECC public key or an RSA public key.

[0182] In this way, the client and the authentication server can exchange keys securely. The client obtains the authentication server's public key for subsequent signing and verification processes, and the authentication server obtains the client's post-quantum public key. The post-quantum public key has good resistance to quantum computing attacks, which can make the transmitted data have good resistance to quantum computing attacks.

[0183] See also Fig.11 In some implementations, step 032 (obtaining an authorization code from a second network node connected to the second network device according to the authorization request, and sending the authorization code to the first network device) includes:

[0184] 0321: When the second network device determines to approve the authorization request, send a quantum key application to the second network node;

[0185] 0322: receiving a second quantum key and a quantum key identifier sent by the second network node according to the quantum key application;

[0186] 0323: Use the quantum key identifier as an authorization code and send the authorization code to the first network device.

[0187] In some embodiments, the sending module is further used to send a quantum key application to the second network node when the second network device determines to approve the authorization request. The receiving module is further used to receive a second quantum key and a quantum key identifier sent by the second network node according to the quantum key application. The processing module is used to use the quantum key identifier as an authorization code and send the authorization code to the first network device.

[0188] In some embodiments, the processor is further configured to send a quantum key application to the second network node if the second network device determines to approve the authorization request, and receive a second quantum key and a quantum key identifier sent by the second network node according to the quantum key application, and use the quantum key identifier as an authorization code and send the authorization code to the first network device.

[0189] Specifically, when the second network device determines to approve the authorization request, the second network device sends a quantum key application to the second network node. Then, the second network device receives the second quantum key and quantum key identifier sent by the second network node according to the quantum key application. The quantum key identifier is obtained by the second network node identifying the second quantum key according to the identification code of the second network node. Finally, the second network device uses the quantum key identifier as the authorization code and sends the authorization code to the second network device. In this way, the second network device obtains the second quantum key and quantum key identifier. The second quantum key has good resistance to quantum computing attacks and can be used to make the communication between the first network device and the second network device have strong confidentiality. The quantum key identifier helps to manage and use quantum keys. Using the quantum key identifier as an authorization code has strong confidentiality.

[0190] Continuing with the above example, see Figure 3 Before communicating with the client, the authentication server accesses the second quantum network node that is physically closest and authorized through a trusted channel. A trusted channel refers to a mechanism or protocol that provides a secure communication path between two communicating entities. One way to establish it is that the authentication server and the second quantum network node are in the same cabinet and directly connected by a shielded network cable. This channel ensures the confidentiality, integrity and availability of data during transmission, preventing unauthorized access, tampering or eavesdropping.

[0191] After the authentication server receives the authorization request sent by the client, the authentication server redirects the authorization request to the resource owner. When the resource owner determines to approve the authorization request, the authentication server sends a quantum key application to the connected second quantum network node. Next, the authentication server receives the second quantum key QK_UUID-2 and quantum key identifier UUID_QK sent by the second quantum network node according to the quantum key application. The quantum key identifier UUID_QK is obtained by the second quantum network node identifying the second quantum key QK_UUID-2 according to the unique universal identification code of the second quantum network node. Finally, the authentication server uses the quantum key identifier UUID_QK as the authorization code and sends the authorization code to the client together with the authorization request response.

[0192] In this way, the authentication server obtains the second quantum key QK_UUID-2 and the quantum key identifier UUID_QK. The second quantum key QK_UUID-2 has good resistance to quantum computing attacks and can be used to make the communication between the client and the authentication server have strong confidentiality. The quantum key identifier UUID_QK helps to manage and use quantum keys. Using the quantum key identifier UUID_QK as an authorization code has strong confidentiality.

[0193] See also Fig.12 In some embodiments, the quantum resistant token request includes a first encrypted message and a first signed message, and the method further includes:

[0194] 038: upon receiving the anti-quantum parameter information sent by the first network device, confirming the anti-quantum token application status of the first network device;

[0195] 039: When the first network device has not applied for a quantum-resistant token, encrypt the parameter information of the initial token request according to the second quantum key to obtain a second encrypted message, so as to determine that the second encrypted message is consistent with the first encrypted message;

[0196] 040: When the second encrypted message is consistent with the first encrypted message, the first signed message is verified using the post-quantum public key of the first network device to confirm that the first network device can obtain the quantum-resistant token.

[0197] In some embodiments, the confirmation module is used to confirm the application status of the quantum-resistant token of the first network device when receiving the quantum-resistant parameter information sent by the first network device. The encryption module is used to encrypt the parameter information of the initial token request according to the second quantum key to obtain a second encrypted message when the first network device has not applied for a quantum-resistant token, so as to determine that the second encrypted message is consistent with the first encrypted message. The signature verification module is used to verify the first signature message using the post-quantum public key of the first network device when the second encrypted message is consistent with the first encrypted message, so as to confirm that the first network device can obtain the quantum-resistant token.

[0198] In some embodiments, the processor is further configured to confirm the application status of the quantum-resistant token of the first network device when receiving the quantum-resistant parameter information sent by the first network device. And when the first network device has not applied for a quantum-resistant token, encrypt the parameter information of the initial token request according to the second quantum key to obtain a second encrypted message to determine that the second encrypted message is consistent with the first encrypted message. And when the second encrypted message is consistent with the first encrypted message, use the post-quantum public key of the first network device to verify the first signature message to confirm that the first network device can obtain the quantum-resistant token.

[0199] Specifically, in the case of receiving the anti-quantum token sent by the first network device, the second network device confirms the anti-quantum token application status of the first network device. In the case that the first network device has not applied for an anti-quantum token, the second network device encrypts the parameter information of the initial token request according to the second quantum key to obtain a second encrypted message to determine that the second encrypted message is consistent with the first encrypted message. In the case that the second encrypted message is consistent with the first encrypted message, the first signature message is verified using the post-quantum public key of the first network device to confirm that the first network device can obtain the anti-quantum token. In this way, by comparing the consistency of the second encrypted message with the first encrypted message, the integrity and non-tampering of the information can be ensured. And through multiple verifications, the second network device confirms that the first network device can obtain the anti-quantum token, ensuring the security and effectiveness of the authorization process.

[0200] Continuing with the above example, see Figure 3 , when receiving the anti-quantum parameter information sent by the client, the authentication server confirms the client's anti-quantum token application status, that is, confirms whether the client has previously applied for the anti-quantum token. If the client has not applied for an anti-quantum token, the authentication server encrypts the parameter information of the initial token request according to the second quantum key QK_UUID-2 to obtain a second encrypted message to determine that the second encrypted message is consistent with the first encrypted message. If the second encrypted message is consistent with the first encrypted message, the first signature message is verified using the client's post-quantum public key to verify the client's identity, and then confirms that the client's token parameters can be authorized according to the corresponding access control policy, confirming that the client can obtain the anti-quantum token.

[0201] In this way, the authentication server can ensure the integrity and non-tampering of the information by comparing the consistency of the second encrypted message with the first encrypted message. And through multiple verifications, the authentication server confirms that the client can obtain the quantum-resistant token, ensuring the security and effectiveness of the authorization process.

[0202] See also Fig.13 In some embodiments, step 034 (generating a quantum-resistant token according to quantum-resistant parameter information, and sending the quantum-resistant token to the first network device) includes:

[0203] 0341: Generate initial token based on quantum-resistant parameter information;

[0204] 0342: splicing the second random number randomly generated by the second network device and the anti-quantum parameter information to obtain a second spliced ​​body;

[0205] 0343: Sign the second spliced ​​body according to the public key of the second network device to obtain a second signature message;

[0206] 0344: Storing the second random number and the second signature message in the initial token to obtain a quantum-resistant token;

[0207] 0345: Send the quantum-resistant token to the first network device.

[0208] In some embodiments, the derivation module is further used to generate an initial token based on the anti-quantum parameter information. The splicing module is used to splice the second random number randomly generated by the second network device and the anti-quantum parameter information to obtain a second spliced ​​body. The signature module is used to sign the second spliced ​​body according to the public key of the second network device to obtain a second signature message. The storage module is used to store the second random number and the second signature message in the initial token to obtain the anti-quantum token. The sending module is also used to send the anti-quantum token to the first network device.

[0209] In some embodiments, the processor is further configured to generate an initial token based on the anti-quantum parameter information, and to concatenate the second random number randomly generated by the second network device and the anti-quantum parameter information to obtain a second concatenation. The processor is further configured to sign the second concatenation based on the public key of the second network device to obtain a second signature message. The processor is further configured to store the second random number and the second signature message in the initial token to obtain an anti-quantum token. The processor is further configured to send the anti-quantum token to the first network device.

[0210] Specifically, the second network device generates an initial token based on the anti-quantum parameter information. And the second network device splices the second random number randomly generated by the second network device and the anti-quantum parameter information to obtain a second splicing body. Then, the second network device signs the second splicing body according to the public key of the second network device to obtain a second signature message. Then, the second network device stores the second random number and the second signature message in the initial token to obtain an anti-quantum token. Finally, the anti-quantum token is sent to the first network device. In this way, the second network device splices the second random number and the anti-quantum parameter information to ensure the uniqueness and complexity of the anti-quantum token, which helps to prevent replay attacks and improve the security of the anti-quantum token. And the combination of random numbers, splicing processing and signature technology provides strong protection for the security and integrity of the anti-quantum token, which helps to protect the security of data and communications.

[0211] Continuing with the above example, the token response Access Token Response is a response message to the initial token request Access TokenRequest, which is generated according to the OAUTH protocol.

[0212] Please refer to Figure 3, the authentication server generates an initial token Access Token-1 based on the anti-quantum parameter information. And the 256-bit second random number R2 randomly generated by the authentication server and the anti-quantum parameter information are spliced ​​to obtain a second spliced ​​body. Then, the authentication server signs the second spliced ​​body according to the public key of the authentication server to obtain a second signature message. If the ECC public key is used, the second signature message is an ECC signature. If the RSA public key is used, the second signature message is an RSA signature. Finally, the authentication server stores the second random number and the second signature message in the initial token Access Token-1 to obtain the anti-quantum token Access Token-2. And the anti-quantum token Access Token-2 is returned to the client together with the token response AccessToken Response.

[0213] In this way, the authentication server concatenates the second random number R2 and the quantum-resistant parameter information to ensure the uniqueness and complexity of the quantum-resistant token Access Token-2, which helps prevent replay attacks and improves the security of the quantum-resistant token Access Token-2. The combination of random number, concatenation and signature technology provides strong protection for the security and integrity of quantum-resistant tokens, helping to protect the security of data and communications.

[0214] See also Fig.14 In some embodiments, the resource access request includes a first post-quantum signature value and a first signature message, and step 035 (receiving a resource access request generated by the first network device according to the quantum-resistant token request, and confirming access rights to resources corresponding to the resource access request so that the first network device can access resources of the second network device) includes:

[0215] 0351: Determine the correctness of the first post-quantum signature value according to the post-quantum cryptographic signature algorithm;

[0216] 0352: Determine the correctness of the first signature message according to the post-quantum public key of the first network device;

[0217] 0353: Determine the correctness of the second signature message according to the public key of the second network device;

[0218] 0354: When the first post-quantum signature value is correct and the second signature message is correct, the first network device is allowed to access the resources corresponding to the resource access request.

[0219] In some embodiments, the determination module is used to determine the correctness of the first post-quantum signature value according to the post-quantum cryptographic signature algorithm. The determination module is also used to determine the correctness of the first signature message according to the post-quantum public key of the first network device. The determination module is also used to determine the correctness of the second signature message according to the public key of the second network device. The processing module is also used to allow the first network device to access the resource corresponding to the resource access request if the first post-quantum signature value is correct and the second signature message is correct.

[0220] In some embodiments, the processor is further configured to determine the correctness of the first post-quantum signature value according to the post-quantum cryptographic signature algorithm. And determine the correctness of the first signature message according to the post-quantum public key of the first network device. The processor is further configured to determine the correctness of the second signature message according to the public key of the second network device. And if the first post-quantum signature value is correct and the second signature message is correct, allow the first network device to access the resource corresponding to the resource access request.

[0221] Specifically, the second network device determines the correctness of the first post-quantum signature value according to the post-quantum cryptographic signature algorithm. Then, the correctness of the first signature message is determined according to the post-quantum public key of the first network device. Next, the second network device determines the correctness of the second signature message according to the public key of the second network device. When the first post-quantum signature value is correct, the first signature message is correct, and the second signature message is correct, the second network device allows the first network device to access the resources corresponding to the resource access request. In this way, by verifying the correctness of the first post-quantum signature value, the first signature message, and the second signature message, the second network device can ensure the authenticity of the identity of the first network device, provide strong security and quantum security for resource access requests, and help protect the security of data and communications.

[0222] Continuing with the above example, see Figure 3 After the resource server receives the resource access request sent by the client, the resource server submits the received anti-quantum token Access Token-2 and the first post-quantum signature value to the authentication server for verification. Then, the authentication server determines the correctness of the first post-quantum signature value based on the post-quantum cryptographic signature algorithm. The authentication server then determines the correctness of the first signature message based on the post-quantum public key of the first network device. Then, the authentication server determines the correctness of the second signature message based on the public key of the authentication server. When the first post-quantum signature value is correct, the first signature message is correct, and the second signature message is correct, the authentication server notifies the resource server that the resource server can access the resource corresponding to the resource access request.

[0223] In this way, by verifying the correctness of the first post-quantum signature value, the first signature message, and the second signature message, the server can ensure the authenticity of the client's identity, provide strong security and quantum security for resource access requests, and help protect the security of data and communications.

[0224] The present application also provides a computer-readable storage medium containing a computer program. When the computer program is executed by one or more processors, the one or more processors execute the voice interaction method of the present application.

[0225] It is understood that a computer program includes computer program code. The computer program code may be in source code form, object code form, executable file or some intermediate form. Computer readable storage media may include: any entity or device capable of carrying computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution medium.

[0226] In the description of this specification, the descriptions with reference to the terms "specifically", "further", "particularly", "understandably", etc. are intended to mean that the specific features, structures, materials or characteristics described in conjunction with the embodiments or examples are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms are not intended to refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0227] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0228] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A method for enhancing quantum security of an open authorization protocol of a communication network, characterized in that: The communication network includes a first network device and a second network device, the method is used for the first network device, and the method includes: Sending an authorization request to the second network device; Receiving an authorization code generated by the second network device according to the authorization request; Obtaining a first quantum key from a first network node connected to the first network device according to the authorization code; Encrypting the parameter information of the initial token request according to the first quantum key and the post-quantum cryptographic algorithm to obtain quantum-resistant parameter information, and sending the quantum-resistant parameter information to the second network device, where the parameter information of the initial token request is generated by the first network device according to the authorization code; receiving a quantum-resistant token sent by the second network device, where the quantum-resistant token is generated by the second network device according to the quantum-resistant parameter information; A resource access request is sent to the second network device according to the quantum-resistant token, and the second network device confirms access rights to resources corresponding to the resource access request according to the resource access request, so that the first network device can access resources of the second network device.

2. The method according to claim 1, characterized in that: The method further comprises: Sending a registration request to the second network device, the registration request including a post-quantum public key of the first network device; A registration response request generated according to the registration request and sent by the second network device is received, where the registration response request includes a public key of the second network device.

3. The method according to claim 1, characterized in that The obtaining a first quantum key from a first network node connected to the first network device according to the authorization code includes: Using a service node to inject multiple keys into a cryptographic module of the first network device; Sending a quantum key application to the service node according to the authorization code, wherein the quantum key application is protected by a protection key, and the protection key is a randomly used one of multiple keys injected into the cryptographic module; receiving a quantum key encryption result obtained by the service node encrypting the first quantum key according to the protection key, where the first quantum key is distributed to the service node by a first network node connected to the service node; The quantum key encryption result is decrypted to obtain the first quantum key.

4. The method according to claim 3, characterized in that The step of encrypting the parameter information of the initial token request according to the first quantum key and the post-quantum cryptographic algorithm to obtain quantum-resistant parameter information, and sending the quantum-resistant parameter information to the second network device includes: Generate an initial token request based on the authorization code; Encrypting the parameter information of the initial token request according to the first quantum key to obtain a first encrypted message; Performing post-quantum cryptographic signature processing on the entire splicing of the parameter information according to the post-quantum public key of the first network device to obtain a first signature message; The quantum-resistant parameter information is constructed according to the parameter information, the first encrypted message and the first signed message.

5. The method according to claim 2, characterized in that: The method further comprises: The received quantum-resistant token is verified according to the public key of the second network device to determine the correctness of the quantum-resistant token, where the quantum-resistant token includes a second random number randomly generated by the second network device.

6. The method according to claim 5, characterized in that The method further comprises: Splicing the first random number randomly generated by the first network device and the second random number to obtain a first spliced ​​body; Performing post-quantum cryptographic signature processing on the first spliced ​​body to obtain a first post-quantum signature value; The first post-quantum signature value is sent to the second network device along with the resource access request.

7. A method for enhancing quantum security of an open authorization protocol of a communication network, characterized in that: The communication network includes a first network device and a second network device, the method is used for the second network device, and the method includes: Receiving an authorization request sent by the first network device; obtaining an authorization code from a second network node connected to the second network device according to the authorization request, and sending the authorization code to the first network device; receiving quantum-resistant parameter information sent by the first network device, the quantum-resistant parameter information being obtained by the first network device encrypting parameter information of an initial token request according to a first quantum key and a post-quantum cryptographic algorithm, the first quantum key being obtained by the first network device from a first network node connected to the first network device according to the authorization code, and the parameter information being generated by the first network device according to the authorization code; Generate a quantum-resistant token according to the quantum-resistant parameter information, and send the quantum-resistant token to the first network device; Receive a resource access request generated by the first network device according to the quantum-resistant token request, and confirm access rights to resources corresponding to the resource access request, so that the first network device can access resources of the second network device.

8. The method according to claim 7, characterized in that The method further comprises: Receiving a registration request sent by the first network device, wherein the registration request includes a post-quantum public key of the first network device; Sending a registration response request generated according to the registration request, wherein the registration response request includes a public key of the second network device.

9. The method according to claim 8, characterized in that The obtaining an authorization code from a second network node connected to the second network device according to the authorization request, and sending the authorization code to the first network device, comprises: If the second network device determines to approve the authorization request, sending a quantum key application to the second network node; receiving a second quantum key and a quantum key identifier sent by the second network node according to the quantum key application, where the quantum key identifier is obtained by the second network node identifying the second quantum key according to an identification code of the second network node; The quantum key identifier is used as the authorization code, and the authorization code is sent to the first network device.

10. The method according to claim 9, characterized in that The quantum-resistant token request includes a first encrypted message and a first signed message, and the method further includes: In case of receiving the quantum resistance parameter information sent by the first network device, confirming the quantum resistance token application status of the first network device; In the case where the first network device has not applied for a quantum-resistant token, encrypting the parameter information of the initial token request according to the second quantum key to obtain a second encrypted message, so as to determine that the second encrypted message is consistent with the first encrypted message; When the second encrypted message is consistent with the first encrypted message, the first signed message is verified using the post-quantum public key of the first network device to confirm that the first network device can obtain the quantum-resistant token.

11. The method according to claim 7, characterized in that The method of generating a quantum-resistant token according to the quantum-resistant parameter information and sending the quantum-resistant token to the first network device includes: Generate an initial token according to the quantum-resistant parameter information; Splicing the second random number randomly generated by the second network device and the anti-quantum parameter information to obtain a second spliced ​​body; Signing the second spliced ​​body according to the public key of the second network device to obtain a second signed message; Storing the second random number and the second signature message in the initial token to obtain the quantum-resistant token; The quantum-resistant token is sent to the first network device.

12. The method according to claim 11, characterized in that The resource access request includes a first post-quantum signature value and a first signature message, the receiving the resource access request generated by the first network device according to the anti-quantum token request, confirming the access rights of the resource corresponding to the resource access request, so that the first network device performs resource access to the second network device, and the method includes: Determining the correctness of the first post-quantum signature value according to a post-quantum cryptographic signature algorithm; Determining the correctness of the first signed message according to the post-quantum public key of the first network device; Determining the correctness of the second signed message according to the public key of the second network device; When the first post-quantum signature value is correct and the second signature message is correct, the first network device is allowed to access the resource corresponding to the resource access request.

Images