A quantum-resistant security enhancement method for the Simple Authentication and Security Layer protocol

Abstract

The present application discloses a method for enhancing the anti-quantum security of a simple authentication and security layer protocol of a communication network. The method includes: receiving a startup message sent by a second network device. Obtaining a quantum key identifier from a first network node connected to a first network device. Performing post-quantum cryptographic encryption processing on the quantum key identifier according to the startup message to obtain a first encryption result, and sending the first encryption result to the second network device to encrypt the communication between the first network device and the second network device based on the first encryption result. In this way, the first network device and the second network device encrypt the communication by using post-quantum cryptographic algorithms and quantum key distribution technology, significantly enhancing the ability to resist quantum computing attacks.

Description

Technical Field

[0001] The present application relates to the field of network security, and more specifically, to a method for enhancing quantum security of a simple authentication and security layer protocol of a communication network. Background Art

[0002] The leap in computing power represented by quantum computing has a significant impact on the security of related algorithms in classical cryptography. Understandably, with the realization of large-scale quantum computers, it will have a certain impact on key negotiation, encryption, signature and other applications in classical cryptography. Therefore, providing cryptographic technology that can resist quantum computing attacks has become an urgent problem to be solved. Summary of the invention

[0003] The present application provides a method for enhancing quantum security of a simple authentication and security layer protocol of a communication network.

[0004] The embodiment of the present application provides a method for enhancing quantum security of a simple authentication and security layer protocol of a communication network, wherein the communication network includes a first network device and a second network device, and the method is used for the first network device, and the method includes:

[0005] receiving a startup message sent by the second network device;

[0006] Acquire a quantum key identifier from a first network node connected to the first network device;

[0007] The quantum key identifier is subjected to post-quantum cryptographic encryption processing according to the startup message to obtain a first encryption result, and the first encryption result is sent to the second network device, so as to encrypt the communication between the first network device and the second network device based on the first encryption result.

[0008] In this way, during the communication process between the first network device and the second network device, the first network device receives the startup message sent by the second network device. Subsequently, the first network device and the second network device apply for a quantum key identifier. The first network device encrypts the quantum key identifier according to the startup message and the post-quantum cryptographic algorithm to generate a first encryption result that can resist quantum computing attacks. The post-quantum cryptographic algorithm is a series of encryption algorithms designed to resist quantum computing attacks. And the first network device sends the first encryption result to the second network device to encrypt the communication between the first network device and the second network device based on the first encryption result. In this way, the anti-quantum computing attack capability of the network communication between the first network device and the second network device is enhanced by the post-quantum cryptographic algorithm and the quantum key distribution technology.

[0009] In certain embodiments, the method further comprises:

[0010] The signature certificate and encryption certificate of the second network device are loaded.

[0011] In this way, the first network device loads the signature certificate and encryption certificate of the second network device. In this way, the first network device obtains the encryption certificate of the second network device and can use the public key of the second network device to encrypt data during the communication process, ensuring that only the device with the corresponding private key can decrypt and read the data. And obtain the signature certificate of the second network device, and can use the public key in the signature certificate to verify the signature, ensuring that the data from the second network device has not been tampered with.

[0012] In some implementations, the startup message includes a user name and a second random number randomly generated by the second network device.

[0013] In this way, the first network device receives a startup message sent by the second network device, which includes a user name and a second random number randomly generated by the second network device. The user name and the second random number can be used to subsequently generate a quantum-resistant key.

[0014] In some embodiments, the obtaining a quantum key identifier from a first network node connected to the first network device includes:

[0015] Sending a quantum key application to a first network node connected to the first network device;

[0016] Receive a first quantum key and a quantum key identifier sent by the first network node according to the quantum key application, where the quantum key identifier is obtained by the first network node identifying the first quantum key according to an identification code of the first network node.

[0017] In this way, the first network device sends a quantum key application to the first network node connected to the first network device. Then, the second network device receives the first quantum key and quantum key identifier sent by the first network node according to the quantum key application, and the quantum key identifier is obtained by the first network node identifying the first quantum key according to the identification code of the first network node. In this way, the first network device obtains the first quantum key and the quantum key identifier, the first quantum key has good quantum resistance, the first quantum key can be used to generate a key with good quantum resistance, and the quantum key identifier helps to manage and use the quantum key.

[0018] In some embodiments, the startup message includes a user name and a second random number, and the post-quantum cryptographic encryption processing is performed on the quantum key identifier according to the startup message to obtain a first encryption result, and the first encryption result is sent to the second network device, including:

[0019] Splicing the first random number randomly generated by the first network device and the second random number to obtain a first spliced ​​body;

[0020] Encrypting the first spliced ​​body according to the first quantum key to obtain a first encrypted verification message in a first encryption result;

[0021] Performing an XOR process on the first random number and the second random number to obtain a first XOR entity;

[0022] Concatenating the quantum key identifier and the first XOR body to obtain a second concatenated body;

[0023] Performing post-quantum derivation processing on the second concatenated body to obtain a first session key;

[0024] Performing post-quantum encryption processing on the second spliced ​​body to obtain a first encrypted message in the first encryption result;

[0025] The first encryption result is sent to the second network device, where the first encryption result also includes a first network device identifier of the first network device.

[0026] In this way, the first network device performs a splicing process on the first random number and the second random number randomly generated by the first network device to obtain a first splicing body. Next, the first network device performs an encryption process on the first splicing body according to the first quantum key to obtain a first encrypted verification message in the first encryption result. Then, the first network device performs an XOR process on the first random number and the second random number to obtain a first XOR body. Thereafter, the first network device performs a splicing process on the quantum key identifier and the first XOR body to obtain a second splicing body. The first network device performs a post-quantum derivation process on the second splicing body to obtain a first session key. And the second splicing body is subjected to a post-quantum encryption process to obtain a first encrypted message in the first encryption result. Finally, the first encryption result is sent to the second network device, and the first encryption result also includes the first network device identifier of the first network device. In this way, the first network device obtains a first session key, which can be used to generate a subsequent key with good quantum resistance. A first encrypted verification message is also obtained, which enables the second network device to confirm the integrity of the first encryption result. And the data is encrypted and protected using a post-quantum cryptographic algorithm, so that the data has good quantum resistance during transmission.

[0027] In certain embodiments, it is characterized in that the method further comprises:

[0028] receiving a second encryption result sent by the second network device, where the second encryption result is obtained by performing post-quantum cryptography encryption processing on the first decryption result by the second network device, and the first decryption result is obtained by performing decryption processing on the first encryption result by the second network device;

[0029] The second encryption result is decrypted to obtain a second decryption result, where the second decryption result includes a signature message and a user name.

[0030] In this way, the first network device receives the second encryption result sent by the second network device. The second encryption result is obtained by the second network device performing post-quantum cryptographic encryption processing on the first decryption result, and the first decryption result is obtained by the second network device performing decryption processing on the first encryption result. The first network device then decrypts the second encryption result to obtain a second decryption result, and the second decryption result includes a signature message and a user name. In this way, the first network device obtains a signature message, which can be used to ensure that the data from the second network device has not been tampered with.

[0031] In certain embodiments, it is characterized in that the method further comprises:

[0032] Obtain a sixth spliced ​​body according to the signed message;

[0033] The signed message is subjected to post-quantum cryptographic signature verification processing to confirm the correctness of the sixth splice, where the sixth splice is obtained according to the quantum key identifier, the first random number, and the second random number.

[0034] In this way, the first network device obtains the sixth splice according to the signed message. Then, the first network device performs post-quantum cryptographic signature verification on the signed message to confirm the correctness of the sixth splice, which is obtained according to the quantum key identifier, the first random number and the second random number. In this way, the first network device confirms the correctness of the sixth splice and ensures that the data of the second network device received by the first network device is not accessed without authorization.

[0035] In certain embodiments, it is characterized in that the method further comprises:

[0036] XORing the first session key, the first random number, the second random number, and the first quantum key to generate a first quantum-resistant session key;

[0037] The first quantum resistant session key is derived to encrypt communication between the first network device and the second network device.

[0038] In this way, the first network device performs XOR processing on the first session key, the first random number, the second random number and the first quantum key to generate a first quantum-resistant session key. Then, the first network device performs a derivative processing on the first quantum-resistant session key to encrypt the communication between the first network device and the second network device. In this way, the first network device obtains the first quantum-resistant session key, which has good resistance to quantum computing attacks. The communication data between the first network device and the second network device is protected by the first quantum-resistant session key or its derivative key, which can greatly enhance the security of the communication data.

[0039] In certain embodiments, it is characterized in that the method further comprises:

[0040] Receiving a second encrypted verification message sent by the second network device;

[0041] Concatenate the first network device identifier and the first random number to obtain a third concatenated body;

[0042] Encrypting the third spliced ​​body according to the first quantum-resistant session key to obtain a first encrypted verification message;

[0043] The first encrypted verification message is compared with the second encrypted verification message to confirm that the second quantum resistant session key generated by the second network device is consistent with the first quantum resistant session key.

[0044] In this way, the first network device receives the second encrypted verification message sent by the second network device. Then, the first network device concatenates the first network device identifier and the first random number to obtain a third concatenation. Then, the first network device encrypts the third concatenation according to the first quantum-resistant session key to obtain the first encrypted verification message. Finally, the first network device compares the first encrypted verification message with the second encrypted verification message to confirm that the second quantum-resistant session key generated by the second network device is consistent with the first quantum-resistant session key. In this way, the first network device receives the second encrypted verification message. And the first network device generates the first encrypted verification message based on the data information it has that is the same as the data information used to generate the second encrypted verification message. By comparing whether the first encrypted verification message and the second encrypted verification message are consistent, the consistency of the first session key generated by the first network device and the second encrypted verification message generated by the second network device is determined to confirm that the second quantum-resistant session key generated by the second network device is consistent with the first quantum-resistant session key.

[0045] In certain embodiments, it is characterized in that the method further comprises:

[0046] Concatenate the user name and the second random number to obtain a fourth concatenated body;

[0047] Encrypting the fourth spliced ​​body according to the first quantum-resistant session key to obtain a first encrypted authentication message;

[0048] The first encrypted authentication message is sent to the second network device, so that the second network device confirms that the first quantum-resistant session key is consistent with the second quantum-resistant session key generated by the second network device.

[0049] In this way, the first network device concatenates the user name and the second random number to obtain a fourth concatenation. Then, the first network device encrypts the fourth concatenation according to the first quantum-resistant session key to obtain a first encrypted authentication message. Finally, the first network device sends the first encrypted authentication message to the second network device so that the second network device confirms that the first quantum-resistant session key is consistent with the second quantum-resistant session key generated by the second network device. In this way, the first network device obtains the first encrypted authentication message, and the second network device can verify whether the second quantum-resistant session key used by the second network device is the same as the first quantum-resistant session key used by the first network device according to the first encrypted authentication message, and enable the first encrypted authentication message to resist the threat of quantum computing attacks during transmission.

[0050] The embodiment of the present application provides a method for enhancing quantum security of a simple authentication and security layer protocol of a communication network, wherein the communication network includes a first network device and a second network device, and the method is used for the second network device, and the method includes:

[0051] Sending a startup message to the first network device;

[0052] Receive a first encryption result sent by the first network device, which is a result of post-quantum cryptographic encryption of a quantum key identifier according to the startup message, so as to encrypt the communication between the first network device and the second network device based on the first encryption result, wherein the quantum key identifier is obtained by the first network device from the first network node to which it is connected.

[0053] In this way, during the communication process between the first network device and the second network device, the first network device receives the startup message sent by the second network device. Subsequently, the first network device and the second network device apply for a quantum key identifier. The first network device encrypts the quantum key identifier according to the startup message and the post-quantum cryptographic algorithm to generate a first encryption result that can resist quantum computing attacks. The post-quantum cryptographic algorithm is a series of encryption algorithms designed to resist quantum computing attacks. And the first network device sends the first encryption result to the second network device to encrypt the communication between the first network device and the second network device based on the first encryption result. In this way, the anti-quantum computing attack capability of the network communication between the first network device and the second network device is enhanced by the post-quantum cryptographic algorithm and the quantum key distribution technology.

[0054] In certain embodiments, the method further comprises:

[0055] The signature certificate and encryption certificate of the second network device are obtained from the certificate system.

[0056] In this way, the second network device obtains its own signature certificate and encryption certificate from the certificate system. In this way, the second network device obtains its own signature certificate to prove its identity and allows the second network device to digitally sign the sent data to ensure the authenticity and integrity of the data. The second network device also obtains its own encryption certificate, allowing the first network device to encrypt the data using the public key in the encryption certificate, and then the second network device uses the private key corresponding to the encryption certificate to decrypt the encrypted data, thereby enhancing the confidentiality of the data between the first network device and the second network device.

[0057] In certain embodiments, the method further comprises:

[0058] Decrypting the first encryption result to obtain a first decryption result;

[0059] Processing the first decryption result and the second quantum key to generate a second quantum-resistant session key to encrypt communication between the first network device and the second network device, wherein the second quantum key is obtained from a second network node connected to the second network device according to the first decryption result;

[0060] The first decryption result is subjected to post-quantum encryption processing according to the second quantum-resistant session key to generate a second encryption result, so that the first network device can confirm that the second network device has received a correct first encryption result.

[0061] In this way, the second network device decrypts the first encryption result to obtain the first decryption result. Then, the second network device generates a second quantum-resistant session key based on the first decryption result and the second quantum key to encrypt the communication between the first network device and the second network device. The second quantum key is obtained from the second network node connected to the second network device based on the first decryption result. Then, the second network device performs post-quantum encryption processing on the first decryption result according to the second quantum-resistant session key to generate a second encryption result, so that the first network device confirms that the second network device has received the correct first encryption result. In this way, the second network device obtains the first decryption result by processing the received first encryption result, and then derives the first decryption result and the applied second quantum key to generate the second quantum-resistant session key. The second quantum-resistant session key has good quantum-resistant capability and can be used to protect the communication between the first network device and the second network device. And the second encryption result is obtained by encrypting the first decryption result, which is used to confirm that the first network device has received the correct first encryption result.

[0062] In some implementations, decrypting the first encryption result to obtain a first decryption result includes:

[0063] Decrypting the first encryption result to obtain a first network device identifier of the first network device, a first encrypted verification message, and a first encrypted message;

[0064] Performing post-quantum decryption processing on the first encrypted message to obtain a second spliced ​​body;

[0065] Obtain a quantum key identifier and a first XOR entity according to the second concatenated entity;

[0066] Obtaining a first random number randomly generated by the first network device according to the first XOR body and a second random number randomly generated by the second network device;

[0067] Performing post-quantum derivation processing on the second concatenation to obtain a second session key.

[0068] In this way, the second network device decrypts the first encryption result to obtain the first network device identification, the first encryption verification message and the first encrypted message of the first network device. Next, the second network device performs post-quantum decryption processing on the first encrypted message to obtain a second spliced ​​body. Then, the second network device obtains the quantum key identifier and the first XOR body based on the second spliced ​​body. And the first random number randomly generated by the first network device is obtained based on the first XOR body and the second random number randomly generated by the second network device. Finally, the second spliced ​​body is subjected to post-quantum derivation processing to obtain the second session key. In this way, the second network device obtains various data used to generate the first session key, and generates the second session key based on these data. The second session key is used to generate a key with good quantum resistance.

[0069] In certain embodiments, the method further comprises:

[0070] Using the service node to inject multiple keys into the cryptographic module of the second network device;

[0071] Sending a quantum key application to the service node according to the quantum key identifier, wherein the quantum key application is protected by a protection key, and the protection key is a randomly used one from a plurality of keys injected into the cryptographic module;

[0072] receiving a quantum key encryption result obtained by the service node encrypting a second quantum key according to the protection key, where the second quantum key is generated by a second network node connected to the service node and distributed to the service node;

[0073] The quantum key encryption result is decrypted to obtain the second quantum key.

[0074] In this way, the second network device uses the service node to inject multiple keys into the cryptographic module of the second network device. Next, the second network device sends a quantum key application to the service node based on the quantum key identifier. The quantum key application is protected by a protection key, which is a randomly used one of the multiple keys injected into the cryptographic module. Then, the second network device receives the quantum key encryption result obtained by the service node by encrypting the second quantum key according to the protection key. The second quantum key is generated by the second network node connected to the service node and distributed to the service node. Finally, the second network device decrypts the quantum key encryption result to obtain the second quantum key. In this way, the second network device obtains the second quantum key matching the first quantum key from the second network node through the quantum key identifier, which can be used to subsequently generate a key with good quantum resistance.

[0075] In certain embodiments, the method further comprises:

[0076] Performing splicing processing on the first random number and the second random number to obtain a fifth spliced ​​body;

[0077] Encrypting the fifth spliced ​​body according to the second quantum key to obtain a second encrypted verification message;

[0078] The second encrypted verification message is compared with the first encrypted verification message to confirm that the second network device has received the correct quantum key identifier and the first random number.

[0079] In this way, the second network device concatenates the first random number and the second random number to obtain a fifth concatenation. Then, the second network device encrypts the fifth concatenation according to the second quantum key to obtain a second encrypted verification message. And compare the second encrypted verification message with the first encrypted verification message to confirm that the second network device has received the correct quantum key identifier and the first random number. In this way, the second network device generates a second encrypted verification message through its own data information that is the same as the first encrypted verification message generated by the first network device, and compares it with the first encrypted verification message. Confirming that the second network device has received the correct quantum key identifier and the first random number ensures that the second network device can obtain the correct second quantum key and generate the correct second session key based on this information.

[0080] In some embodiments, the generating a second quantum-resistant session key by processing the first decryption result and the second quantum key to encrypt communication between the first network device and the second network device includes:

[0081] XORing the second session key, the first random number, the second random number and the second quantum key to generate a second quantum-resistant session key;

[0082] The second quantum resistant session key is derived to encrypt communication between the first network device and the second network device.

[0083] In this way, the second network device performs XOR processing on the second session key, the first random number, the second random number and the second quantum key to generate a second quantum-resistant session key. Then, the second network device performs a derivation process on the second quantum-resistant session key to encrypt the communication between the first network device and the second network device. In this way, the second network device generates a second quantum-resistant session key, which can be used to enhance the ability of the communication data between the first network device and the second network device to resist quantum computing attacks.

[0084] In some embodiments, performing post-quantum encryption processing on the first decryption result according to the second quantum-resistant session key to generate a second encryption result, so that the first network device confirms that the second network device has received a correct first encryption result, includes:

[0085] Performing an XOR process on the second quantum key and the first random number to obtain a second XOR product;

[0086] Concatenate the second XOR body and the second random number to obtain a sixth concatenation body;

[0087] Performing post-quantum signature processing on the sixth spliced ​​body to obtain a signature message in the second encryption result;

[0088] The second encryption result is sent to the first network device, where the second encryption result includes a user name.

[0089] In this way, the second network device performs an XOR process on the second quantum key and the first random number to obtain a second XOR body. Next, the second network device performs a splicing process on the second XOR body and the second random number to obtain a sixth splicing body. Then, the second network device performs a post-quantum signature process on the sixth splicing body to obtain a signature message in the second encryption result. Finally, the second network device sends the second encryption result to the first network device, and the second encryption result includes a user name. In this way, the second network device generates a signature message to protect the second encryption result from unauthorized access and tampering during transmission.

[0090] In certain embodiments, the method further comprises:

[0091] Concatenate the first random number and the first network device identifier of the first network device to obtain a seventh concatenated body;

[0092] Encrypting the seventh splice according to the second quantum-resistant session key to obtain a second encrypted verification message in a second encryption result;

[0093] The second encrypted verification message is sent to the first network device, so that the first network device confirms that the second quantum-resistant session key is consistent with the first quantum-resistant session key generated by the first network device.

[0094] In this way, the second network device concatenates the first random number and the first network device identifier of the first network device to obtain the seventh concatenation body. Then, the second network device encrypts the seventh concatenation body according to the second quantum-resistant session key to obtain the second encrypted verification message in the second encryption result. Finally, the second network device sends the second encrypted verification message to the first network device so that the first network device confirms that the second quantum-resistant session key is consistent with the first quantum-resistant session key generated by the first network device. In this way, the second network device generates a second encrypted verification message for the first network device to confirm that the second quantum-resistant session key is consistent with the first quantum-resistant session key generated by the first network device, and can use the consistent key to communicate with the second network device.

[0095] In certain embodiments, the method further comprises:

[0096] Receiving a first encrypted authentication message sent by the first network device;

[0097] Concatenate the user name and the second random number to obtain an eighth concatenation;

[0098] Encrypting the eighth spliced ​​body according to the second quantum-resistant session key to obtain a second encrypted authentication message;

[0099] The first encrypted authentication message is compared with the second encrypted authentication message to confirm that the first quantum-resistant session key generated by the first network device is consistent with the second quantum-resistant session key.

[0100] In this way, the second network device receives the first encrypted authentication message sent by the first network device. Next, the second network device concatenates the user name and the second random number to obtain an eighth concatenation body. Then, the second network device encrypts the eighth concatenation body according to the second quantum-resistant session key to obtain a second encrypted authentication message. Finally, the second network device compares the first encrypted authentication message with the second encrypted authentication message to confirm that the first quantum-resistant session key generated by the first network device is consistent with the second quantum-resistant session key. In this way, the second network device receives the first encrypted authentication message sent by the first network device, and generates a second encrypted authentication message based on relevant information, compares it with the first encrypted authentication message, confirms that the first quantum-resistant session key generated by the first network device is consistent with the second quantum-resistant session key, and can use the consistent key to communicate with the first network device.

[0101] Additional aspects and advantages of the embodiments of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the embodiments of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0102] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0103] Figure 1 It is one of the flow charts of the method of the implementation mode of the present application;

[0104] Figure 2 It is an architectural diagram of a method for implementing an embodiment of the present application;

[0105] Figure 3 This is the second flow chart of the method of the implementation mode of the present application;

[0106] Figure 4 This is the third flow chart of the method of the implementation mode of the present application;

[0107] Figure 5 This is the fourth flow chart of the method of the implementation mode of the present application;

[0108] Figure 6 This is the fifth flow chart of the method of the implementation mode of the present application;

[0109] Figure 7 This is the sixth flow chart of the method of the implementation mode of the present application;

[0110] Figure 8 This is the seventh flow chart of the method of the implementation mode of the present application;

[0111] Fig. 9 This is the eighth flow chart of the method of the implementation mode of the present application;

[0112] Fig.10 This is the ninth flow chart of the method of the implementation mode of the present application;

[0113] Fig.11 This is the tenth flowchart of the method of the implementation mode of the present application;

[0114] Fig.12 This is the eleventh flow chart of the method of the implementation mode of the present application;

[0115] Fig.13 This is the twelfth flow chart of the method of the implementation mode of the present application;

[0116] Fig.14 This is the thirteenth flow chart of the method of the implementation mode of the present application;

[0117] Fig.15 This is the fourteenth flow chart of the method of the implementation mode of the present application;

[0118] Fig.16 This is the fifteenth flowchart of the method of the implementation mode of the present application;

[0119] Fig.17 This is the sixteenth flow chart of the method of the implementation mode of the present application;

[0120] Fig.18 This is the seventeenth flow chart of the method of the implementation mode of the present application;

[0121] Fig.19 This is the eighteenth flow chart of the method of the implementation mode of the present application;

[0122] Fig. 20 This is the nineteenth flow chart of the method of the implementation mode of the present application;

[0123] Fig.21 It is a signaling diagram of the method of an implementation mode of the present application. DETAILED DESCRIPTION

[0124] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals represent the same or similar elements or elements having the same or similar functions from beginning to end. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the embodiments of the present application, and cannot be understood as limiting the embodiments of the present application.

[0125] The leap in computing power represented by quantum computing has a significant impact on the security of related algorithms in classical cryptography. In other words, quantum computing poses a more direct and urgent threat to the cracking of classical cryptography. A series of classical algorithms, such as Diffie-Hellman, RSA, and elliptic curve (ECC), face greater security risks because the number theory problems they are based on, such as large prime number decomposition and discrete logarithms, are no longer difficult in the quantum era. Understandably, with the realization of large quantum computers, it will have a certain impact on key negotiation, encryption, signature and other applications in classical cryptography.

[0126] As a result, the security of the Internet, which uses classical cryptographic algorithms to protect the communication process, is deeply threatened by quantum computing attacks. For example, Simple Authentication and Security Layer (SASL) is a standardized client / server authentication protocol. Clients and servers can exchange identity information based on this protocol and ensure that the connection is established only after successful verification. SASL is an authentication framework based on which a variety of authentication mechanisms can be implemented, such as username and password, Kerberos, NTLM, OAuth, etc. These classic authentication technologies use classic public key encryption algorithms such as RSA and ECC. However, SASL does not have the ability to resist quantum computing attacks and has a greater security risk when facing quantum computing attacks.

[0127] At present, the international technologies for dealing with the threat of quantum computing attacks are mainly divided into two categories: one is to use asymmetric algorithms for (symmetric) key negotiation and then encrypt and transmit through symmetric algorithms, and study the use of quantum key distribution (QKD) networks for symmetric key negotiation to protect the security of keys; the other is to study post-quantum cryptography (PQC) algorithms to directly replace existing asymmetric algorithms. Quantum key distribution technology uses the principles of quantum mechanics to generate keys that cannot be stolen by third parties, ensuring the security of key transmission. It is particularly suitable for key exchange scenarios and can replace existing asymmetric key negotiation algorithms, such as RSA or ECC, to improve the security of keys. However, quantum key distribution technology cannot currently completely replace all applications of asymmetric algorithms. For example, scenarios such as signature verification, integrity protection, and non-repudiation still require the use of asymmetric algorithms.

[0128] Post-quantum cryptographic algorithms are asymmetric cryptographic algorithms designed based on new mathematical problems, aiming to resist the possible threats posed by quantum computers. NIST has announced the first batch of four post-quantum cryptographic algorithms to be standardized, including Kyber, Dilithium, Falcon, and SPHINCS+. These algorithms cover a variety of technical routes to reduce the risk of a single technology being cracked. Post-quantum cryptographic algorithms can theoretically replace all asymmetric algorithms and are more general. However, the security of post-quantum cryptographic algorithms still depends on the complexity of computational problems, and may face new cracking methods in the future or become unsafe as computing power increases. In addition, the post-quantum cryptographic algorithm standard has not yet been officially announced, and the production and certification of related products also take time, so its large-scale application still requires a long period of time.

[0129] Both post-quantum cryptographic algorithms and quantum key distribution technologies have the ability to resist quantum computing attacks, but each has its limitations. Therefore, providing relatively low-cost and highly secure cryptographic technology that can resist quantum computing attacks has become an urgent problem to be solved.

[0130] Based on the above questions, please refer to Figure 1 The embodiment of the present application provides a method for enhancing quantum security of a simple authentication and security layer protocol of a communication network. The communication network includes a first network device and a second network device. The method is used for the first network device. The method includes:

[0131] 011: receiving a startup message sent by the second network device;

[0132] 012: Obtaining a quantum key identifier from a first network node connected to the first network device;

[0133] 013: Perform post-quantum cryptographic encryption processing on the quantum key identifier according to the startup message to obtain a first encryption result, and send the first encryption result to the second network device, so as to encrypt the communication between the first network device and the second network device based on the first encryption result.

[0134] The embodiment of the present application also provides a first network device, including a memory and a processor. The method of the embodiment of the present application can be implemented by the first network device of the embodiment of the present application. Specifically, a computer program is stored in the memory, and the processor is used to receive a startup message sent by the second network device. And obtain a quantum key identifier from the first network node connected to the first network device. And perform post-quantum cryptographic encryption processing on the quantum key identifier according to the startup message to obtain a first encryption result, and send the first encryption result to the second network device, so as to encrypt the communication between the first network device and the second network device based on the first encryption result.

[0135] The embodiment of the present application also provides a first network device security enhancement device. The method of the embodiment of the present application can be implemented by the first network device security enhancement device of the embodiment of the present application. Specifically, the first network device security enhancement device includes a receiving module, an acquisition module and an encryption module. The receiving module is used to receive a startup message sent by the second network device. The acquisition module is used to obtain a quantum key identifier from a first network node connected to the first network device. The encryption module is used to perform post-quantum cryptographic encryption processing on the quantum key identifier according to the startup message to obtain a first encryption result, and send the first encryption result to the second network device, so as to encrypt the communication between the first network device and the second network device based on the first encryption result.

[0136] The present application provides a communication system based on a simple authentication and security layer protocol, the communication system comprising a first network device, a second network device and a quantum key distribution network of the above-mentioned implementation mode, the quantum key distribution network being configured to distribute quantum keys to the first network device or the second network device.

[0137] Specifically, the quantum key distribution network includes network nodes and a quantum network link control center. Network nodes are used to store and distribute quantum keys in the quantum key distribution network. The quantum network link center can establish quantum key distribution and relay links between network nodes according to the names of network nodes. Quantum key distribution and relay links are used for functions such as data transfer. The quantum key distribution network is used to realize services such as quantum key generation, quantum key relay, and quantum key provision.

[0138] See also Figure 2 In some embodiments, in the SASL security layer, the first network device receives the identity authentication request sent by the second network device according to the SASL authentication protocol, and the first network device responds to the identity authentication request sent by the second network device. In addition, the second network device accesses a service node, which is a transfer station for the second network device to connect to the network node, and is used to inject keys into the second network device and transfer and store quantum keys. After the second network device sends a quantum key application, the network node sends the quantum key generated by the quantum key distribution network to the service node connected to the second network device, and the service node sends the quantum key to the second network device. The simple process of the first network device and the second network device obtaining the quantum key is as follows: First, the first network device sends a quantum key application to the first network node connected to the first network device through a trusted channel. Then, the first network node distributes the quantum key generated according to the quantum key application to the first network device through a trusted channel. At the same time, the quantum network link control center synchronizes the second network node connected to the second network device to generate a quantum key, but the quantum key will not be immediately distributed to the second network device, but will be stored in the network node first. The correspondence between the first network device, the second network device, the service node and the network node is provided by the management and control platform.

[0139] It should be noted that the implementation method of this application uses FIPS203 Module-Lattice-based Key-Encapsulation Mechanism Standard as the PQC key encapsulation algorithm and FIPS 204 Module-Lattice-Based Digital Signature Standard as the PQC digital signature algorithm for example for explanation. The following descriptions of operations related to the PQC algorithm refer to the above FIPS standards. Of course, in other implementations, other algorithms such as the NewHope algorithm, the Sidh algorithm, the HQC algorithm, etc. can also be used as PQC related algorithms. It should also be noted that the embodiments of this application are for the Simple Authentication and Security Layer (SASL), hereinafter referred to as the SASL protocol.

[0140] Specifically, the second network device sends a startup message to the first network device.

[0141] The first network device receives a startup message sent by the second network device, and the startup message includes a user name and a second random number randomly generated by the second network device. When receiving the startup message sent by the second network device, the second network device obtains a quantum key identifier from a first network node connected to the first network device. The second network device then performs post-quantum cryptographic encryption processing on the quantum key identifier according to the startup message to obtain a first encryption result, and sends the first encryption result to the second network device, so as to encrypt the communication between the first network device and the second network device based on the first encryption result.

[0142] The second network device receives a first encryption result sent by the first network device of post-quantum cryptographic encryption processing of the quantum key identifier according to the startup message, so as to encrypt the communication between the first network device and the second network device based on the first encryption result.

[0143] In summary, in the method for enhancing the anti-quantum security of the simple authentication and security layer protocol of the communication network, the communication system, the first network device and the second network device of the implementation mode of the present application, for the communication process between the first network device and the second network device, the first network device receives the startup message sent by the second network device. Subsequently, the first network device and the second network device apply for a quantum key identifier. The first network device encrypts the quantum key identifier according to the startup message and the post-quantum cryptographic algorithm to generate a first encryption result that can resist quantum computing attacks. The post-quantum cryptographic algorithm is a series of encryption algorithms designed to resist quantum computing attacks. And the first network device sends the first encryption result to the second network device to encrypt the communication between the first network device and the second network device based on the first encryption result. In this way, the anti-quantum computing attack capability of the network communication between the first network device and the second network device is enhanced by the post-quantum cryptographic algorithm and the quantum key distribution technology.

[0144] See also Figure 3 In some embodiments, the method further comprises:

[0145] 014: Load the signature certificate and encryption certificate of the second network device.

[0146] In some implementations, the loading module is used to load the signature certificate and encryption certificate of the second network device.

[0147] In some implementations, the processor is further configured to load a signature certificate and an encryption certificate of the second network device.

[0148] Specifically, the first network device loads the signature certificate and encryption certificate of the second network device.

[0149] In this way, the first network device obtains the encryption certificate of the second network device, and can use the public key of the second network device to encrypt data during the communication process, ensuring that only the device with the corresponding private key can decrypt and read the data. And obtain the signature certificate of the second network device, and can use the public key in the signature certificate to verify the signature, ensuring that the data from the second network device has not been tampered with.

[0150] See also Figure 4 In some embodiments, step 012 (obtaining a quantum key identifier from a first network node connected to a first network device) includes:

[0151] 0121: Sending a quantum key application to a first network node connected to a first network device;

[0152] 0122: Receive a first quantum key and a quantum key identifier sent by the first network node in response to a quantum key application.

[0153] In some embodiments, the sending module is used to send a quantum key application to a first network node connected to the first network device. The receiving module is used to receive a first quantum key and a quantum key identifier sent by the first network node according to the quantum key application.

[0154] In some embodiments, the processor is further configured to send a quantum key application to a first network node connected to the first network device, and receive a first quantum key and a quantum key identifier sent by the first network node in response to the quantum key application.

[0155] Specifically, the first network device sends a quantum key application to a first network node connected to the first network device. Then, the second network device receives the first quantum key and quantum key identifier sent by the first network node according to the quantum key application, and the quantum key identifier is obtained by the first network node identifying the first quantum key according to the identification code of the first network node.

[0156] In this way, the first network device obtains a first quantum key and a quantum key identifier. The first quantum key has good quantum resistance and can be used to generate a key with good quantum resistance. The quantum key identifier helps to manage and use the quantum key.

[0157] See also Figure 5 In some embodiments, the startup message includes a user name and a second random number, and step 013 (performing post-quantum cryptographic encryption processing on the quantum key identifier according to the startup message to obtain a first encryption result, and sending the first encryption result to the second network device) includes:

[0158] 0131: concatenate a first random number and a second random number randomly generated by a first network device to obtain a first concatenated body;

[0159] 0132: Encrypting the first spliced ​​body according to the first quantum key to obtain a first encrypted verification message in the first encryption result;

[0160] 0133: Perform XOR processing on the first random number and the second random number to obtain a first XOR entity;

[0161] 0134: concatenating the quantum key identifier and the first XOR body to obtain a second concatenated body;

[0162] 0135: performing post-quantum derivation processing on the second concatenated body to obtain a first session key;

[0163] 0136: Perform post-quantum encryption processing on the second spliced ​​body to obtain a first encrypted message in the first encryption result;

[0164] 0137: Send the first encryption result to the second network device.

[0165] In some embodiments, the splicing module is used to splice the first random number and the second random number randomly generated by the first network device to obtain a first spliced ​​body. The encryption module is used to encrypt the first spliced ​​body according to the first quantum key to obtain a first encrypted verification message in the first encryption result. The processing module is used to perform an XOR process on the first random number and the second random number to obtain a first XOR body. The splicing module is also used to splice the quantum key identifier and the first XOR body to obtain a second spliced ​​body. The derivation module is used to perform a post-quantum derivation process on the second spliced ​​body to obtain a first session key. The encryption module is also used to perform a post-quantum encryption process on the second spliced ​​body to obtain a first encrypted message in the first encryption result. The sending module is also used to send the first encryption result to the second network device.

[0166] In some embodiments, the processor is further used to concatenate the first random number and the second random number randomly generated by the first network device to obtain a first concatenation. And encrypt the first concatenation according to the first quantum key to obtain a first encrypted verification message in the first encryption result. And perform XOR processing on the first random number and the second random number to obtain a first XOR body. The processor is also used to concatenate the quantum key identifier and the first XOR body to obtain a second concatenation. And perform post-quantum derivation processing on the second concatenation to obtain a first session key. And perform post-quantum encryption processing on the second concatenation to obtain a first encrypted message in the first encryption result and send the first encryption result to the second network device.

[0167] Specifically, the first network device performs a splicing process on the first random number and the second random number randomly generated by the first network device to obtain a first splicing body. Next, the first network device performs an encryption process on the first splicing body according to the first quantum key to obtain a first encrypted verification message in the first encryption result. Then, the first network device performs an XOR process on the first random number and the second random number to obtain a first XOR body. Thereafter, the first network device performs a splicing process on the quantum key identifier and the first XOR body to obtain a second splicing body. The first network device performs a post-quantum derivation process on the second splicing body to obtain a first session key. And the second splicing body is subjected to a post-quantum encryption process to obtain a first encrypted message in the first encryption result. Finally, the first encryption result is sent to the second network device, and the first encryption result also includes a first network device identifier of the first network device.

[0168] In this way, the first network device obtains the first session key, which can be used to generate subsequent keys with good quantum resistance. It also obtains the first encryption verification message, which enables the second network device to confirm the integrity of the first encryption result. The post-quantum cryptographic algorithm is used to encrypt and protect the data, so that the data has good quantum resistance during transmission.

[0169] See also Figure 6 In some embodiments, the method further comprises:

[0170] 016: Receive a second encryption result sent by the second network device;

[0171] 017: Decrypt the second encryption result to obtain a second decryption result.

[0172] In some implementations, the receiving module is used to receive the second encryption result sent by the second network device, and the decryption module is used to decrypt the second encryption result to obtain a second decryption result.

[0173] In some implementations, the processor is further configured to receive a second encryption result sent by the second network device, and decrypt the second encryption result to obtain a second decryption result.

[0174] Specifically, the first network device receives the second encryption result sent by the second network device, the second encryption result is obtained by the second network device performing post-quantum cryptography encryption processing on the first decryption result, and the first decryption result is obtained by the second network device performing decryption processing on the first encryption result. The first network device then decrypts the second encryption result to obtain a second decryption result, and the second decryption result includes a signature message and a user name.

[0175] In this way, the first network device decrypts and obtains the signed message, which can be used to ensure that the data from the second network device has not been tampered with.

[0176] See also Figure 7 In some embodiments, the method further comprises:

[0177] 018: Get the sixth splice according to the signature message;

[0178] 019: Perform post-quantum cryptographic signature verification on the signed message to confirm the correctness of the sixth splice.

[0179] In some embodiments, the acquisition module is used to obtain the sixth splice according to the signed message. The signature verification module is used to perform post-quantum cryptographic signature verification on the signed message to confirm the correctness of the sixth splice.

[0180] In some embodiments, the processor is further configured to obtain a sixth splice based on the signed message, and perform post-quantum cryptographic signature verification on the signed message to confirm the correctness of the sixth splice.

[0181] Specifically, the first network device obtains the sixth splice according to the signed message. Then, the first network device performs post-quantum cryptographic signature verification on the signed message to confirm the correctness of the sixth splice, which is obtained according to the quantum key identifier, the first random number and the second random number.

[0182] In this way, the first network device confirms the correctness of the sixth splice by verifying the signature of the signed message, thereby ensuring that the second network device data received by the first network device is not accessed without authorization.

[0183] See also Figure 8 In some embodiments, the method further comprises:

[0184] 020: XOR the first session key, the first random number, the second random number and the first quantum key to generate a first quantum-resistant session key;

[0185] 021: Deriving a first quantum-resistant session key to encrypt communication between the first network device and the second network device.

[0186] In some embodiments, the generation module is used to perform an XOR process on the first session key, the first random number, the second random number, and the first quantum key to generate a first quantum-resistant session key. The derivation module is used to perform a derivation process on the first quantum-resistant session key to encrypt the communication between the first network device and the second network device.

[0187] In some embodiments, the processor is further configured to perform an XOR process on the first session key, the first random number, the second random number, and the first quantum key to generate a first quantum-resistant session key, and to perform a derivation process on the first quantum-resistant session key to encrypt communication between the first network device and the second network device.

[0188] Specifically, the first network device performs an XOR process on the first session key, the first random number, the second random number and the first quantum key to generate a first quantum-resistant session key. Then, the first network device performs a derivation process on the first quantum-resistant session key to encrypt the communication between the first network device and the second network device.

[0189] In this way, the first network device obtains the first quantum-resistant session key, which has good resistance to quantum computing attacks. The communication data between the first network device and the second network device is protected by the first quantum-resistant session key or its derived key, which can greatly enhance the security of the communication data.

[0190] See also Fig. 9 In some embodiments, the method further comprises:

[0191] 022: receiving a second encrypted verification message sent by a second network device;

[0192] 023: concatenate the first network device identifier and the first random number to obtain a third concatenated body;

[0193] 024: Encrypt the third spliced ​​body according to the first quantum-resistant session key to obtain a first encrypted verification message;

[0194] 025: Compare the first encrypted verification message with the second encrypted verification message to confirm that the second quantum-resistant session key generated by the second network device is consistent with the first quantum-resistant session key.

[0195] In some embodiments, the receiving module is used to receive a second encrypted verification message sent by the second network device. The splicing module is used to splice the first network device identifier and the first random number to obtain a third splice. The encryption module is used to encrypt the third splice according to the first quantum-resistant session key to obtain the first encrypted verification message. The comparison module is used to compare the first encrypted verification message with the second encrypted verification message to confirm that the second quantum-resistant session key generated by the second network device is consistent with the first quantum-resistant session key.

[0196] In some embodiments, the processor is further configured to receive a second encrypted verification message sent by the second network device. And concatenate the first network device identifier and the first random number to obtain a third concatenation. The processor is further configured to encrypt the third concatenation according to the first quantum-resistant session key to obtain a first encrypted verification message. And compare the first encrypted verification message with the second encrypted verification message to confirm that the second quantum-resistant session key generated by the second network device is consistent with the first quantum-resistant session key.

[0197] Specifically, the first network device receives the second encrypted verification message sent by the second network device. Then, the first network device concatenates the first network device identifier and the first random number to obtain a third concatenation. Then, the first network device encrypts the third concatenation according to the first quantum-resistant session key to obtain a first encrypted verification message. Finally, the first network device compares the first encrypted verification message with the second encrypted verification message to confirm that the second quantum-resistant session key generated by the second network device is consistent with the first quantum-resistant session key.

[0198] In this way, the first network device receives the second encrypted verification message. And the first network device generates the first encrypted verification message according to the data information it has that is the same as the data information used to generate the second encrypted verification message. By comparing whether the first encrypted verification message and the second encrypted verification message are consistent, the consistency of the first session key generated by the first network device and the second encrypted verification message generated by the second network device is determined to confirm that the second quantum-resistant session key generated by the second network device is consistent with the first quantum-resistant session key.

[0199] See also Fig.10 In some embodiments, the method further comprises:

[0200] 026: Concatenate the user name and the second random number to obtain a fourth concatenated body;

[0201] 027: Encrypt the fourth spliced ​​body according to the first quantum-resistant session key to obtain a first encrypted authentication message;

[0202] 028: Send the encrypted authentication message to the second network device, so that the second network device confirms that the first quantum-resistant session key is consistent with the second quantum-resistant session key generated by the second network device.

[0203] In some embodiments, the concatenation module is used to concatenate the user name and the second random number to obtain a fourth concatenation body. The encryption module is used to encrypt the fourth concatenation body according to the first quantum-resistant session key to obtain a first encrypted authentication message. The sending module is used to send the first encrypted authentication message to the second network device so that the second network device confirms that the first quantum-resistant session key is consistent with the second quantum-resistant session key generated by the second network device.

[0204] In some embodiments, the processor is further configured to concatenate the user name and the second random number to obtain a fourth concatenation, encrypt the fourth concatenation according to the first quantum-resistant session key to obtain a first encrypted authentication message, and send the first encrypted authentication message to the second network device so that the second network device confirms that the first quantum-resistant session key is consistent with the second quantum-resistant session key generated by the second network device.

[0205] See also Fig.11 The embodiment of the present application provides a method for enhancing quantum security of a simple authentication and security layer protocol of a communication network, wherein the communication network includes a first network device and a second network device, and the method is used for the second network device, and the method includes:

[0206] 031: Send a startup message to the first network device;

[0207] 032: Receive a first encryption result sent by the first network device, which is a result of performing post-quantum cryptographic encryption processing on the quantum key identifier according to the startup message, so as to encrypt the communication between the first network device and the second network device based on the first encryption result.

[0208] The embodiment of the present application also provides a second network device, including a memory and a processor. The method of the embodiment of the present application can be implemented by the second network device of the embodiment of the present application. Specifically, a computer program is stored in the memory, and the processor is used to send a startup message to the first network device. And receive the first encryption result sent by the first network device for post-quantum cryptographic encryption of the quantum key identifier according to the startup message, so as to encrypt the communication between the first network device and the second network device based on the first encryption result, and the quantum key identifier is obtained by the first network device from the first network node accessed.

[0209] The embodiment of the present application also provides a second network device security enhancement device. The method of the embodiment of the present application can be implemented by the second network device security enhancement device of the embodiment of the present application. Specifically, the second network device security enhancement device includes a sending module and a receiving module. The sending module is used to send a startup message to the first network device. The receiving module is also used to receive a first encryption result sent by the first network device for performing post-quantum cryptographic encryption processing on the quantum key identifier according to the startup message, so as to encrypt the communication between the first network device and the second network device based on the first encryption result.

[0210] The present application provides a communication system based on a simple authentication and security layer protocol, the communication system includes a second network device of the above-mentioned implementation mode, a first network device and a quantum key distribution network, and the quantum key distribution network is configured to distribute quantum keys to the first network device or the second network device.

[0211] Specifically, the anti-quantum security enhancement method of this embodiment is basically the same as the anti-quantum security enhancement method of the aforementioned embodiment with the first network device as the execution object. For details, please refer to the explanation of the corresponding part. The difference is that this embodiment takes the second network device as the execution object, which will not be repeated here.

[0212] In summary, in the method for enhancing the anti-quantum security of the simple authentication and security layer protocol of the communication network, the communication system, the first network device and the second network device of the implementation mode of the present application, for the communication process between the first network device and the second network device, the first network device receives the startup message sent by the second network device. Subsequently, the first network device and the second network device apply for a quantum key identifier. The first network device encrypts the quantum key identifier according to the startup message and the post-quantum cryptographic algorithm to generate a first encryption result that can resist quantum computing attacks. The post-quantum cryptographic algorithm is a series of encryption algorithms designed to resist quantum computing attacks. And the first network device sends the first encryption result to the second network device to encrypt the communication between the first network device and the second network device based on the first encryption result. In this way, the anti-quantum computing attack capability of the network communication between the first network device and the second network device is enhanced by the post-quantum cryptographic algorithm and the quantum key distribution technology.

[0213] See also Fig.12 In some embodiments, the method further comprises:

[0214] 033: Obtain the signature certificate and encryption certificate of the second network device from the certificate system.

[0215] In some implementations, the acquisition module is further configured to acquire a signature certificate and an encryption certificate of the second network device from a certificate system.

[0216] In some implementations, the processor is further configured to obtain a signature certificate and an encryption certificate of the second network device from the certificate system.

[0217] Specifically, the second network device obtains its own signature certificate and encryption certificate from the certificate system.

[0218] In this way, the second network device obtains its own signature certificate to prove its identity and allows the second network device to digitally sign the sent data to ensure the authenticity and integrity of the data. The second network device also obtains its own encryption certificate, allowing the first network device to encrypt data using the public key in the encryption certificate, and then the second network device uses the private key corresponding to the encryption certificate to decrypt the encrypted data, thereby enhancing the confidentiality of the data between the first network device and the second network device.

[0219] See also Fig.13 In some embodiments, the method further comprises:

[0220] 035: Decrypt the first encryption result to obtain a first decryption result;

[0221] 036: Generate a second quantum-resistant session key according to the first decryption result and the second quantum key to encrypt the communication between the first network device and the second network device;

[0222] 037: Perform post-quantum encryption processing on the first decryption result according to the second quantum-resistant session key to generate a second encryption result, so that the first network device can confirm that the second network device has received the correct first encryption result.

[0223] In some embodiments, the decryption module is further used to decrypt the first encryption result to obtain the first decryption result. The processing module is further used to process the first decryption result and the second quantum key to generate a second quantum-resistant session key to encrypt the communication between the first network device and the second network device. The encryption module is used to perform post-quantum encryption processing on the first decryption result according to the second quantum-resistant session key to generate a second encryption result, so that the first network device confirms that the second network device has received the correct first encryption result.

[0224] In some embodiments, the processor is further configured to perform a decryption process on the first encryption result to obtain a first decryption result, and to perform a process based on the first decryption result and the second quantum key to generate a second quantum-resistant session key to encrypt the communication between the first network device and the second network device, and to perform a post-quantum encryption process on the first decryption result based on the second quantum-resistant session key to generate a second encryption result, so that the first network device confirms that the second network device has received the correct first encryption result.

[0225] Specifically, the second network device performs decryption processing on the first encryption result to obtain the first decryption result. Then, the second network device performs processing based on the first decryption result and the second quantum key to generate a second quantum-resistant session key to encrypt the communication between the first network device and the second network device, and the second quantum key is obtained from the second network node connected to the second network device based on the first decryption result. Then, the second network device performs post-quantum encryption processing on the first decryption result based on the second quantum-resistant session key to generate a second encryption result, so that the first network device confirms that the second network device has received the correct first encryption result.

[0226] In this way, the second network device obtains the first decryption result by processing the received first encryption result, and then derives the first decryption result and the applied second quantum key to generate a second quantum-resistant session key, which has good quantum-resistant capability and can be used to protect the communication between the first network device and the second network device. The second encryption result is obtained by encrypting the first decryption result, which is used for the first network device to confirm that the second network device has received the correct first encryption result.

[0227] See also Fig.14 In some implementations, step 035 (decrypting the first encryption result to obtain the first decryption result) includes:

[0228] 0351: decrypt the first encryption result to obtain the first network device identifier of the first network device, the first encrypted verification message and the first encrypted message;

[0229] 0352: Perform post-quantum decryption processing on the first encrypted message to obtain a second spliced ​​body;

[0230] 0353: Obtaining a quantum key identifier and a first XOR body according to the second spliced ​​body;

[0231] 0354: Obtain a first random number randomly generated by the first network device according to the first XOR body and a second random number randomly generated by the second network device;

[0232] 0355: Perform post-quantum derivation processing on the second concatenated body to obtain a second session key.

[0233] In some embodiments, the decryption module is used to decrypt the first encryption result to obtain the first network device identifier, the first encrypted verification message and the first encrypted message of the first network device. The decryption module is also used to perform post-quantum decryption processing on the first encrypted message to obtain a second splice. The processing module is used to obtain a quantum key identifier and a first XOR body according to the second splice. The processing module is also used to obtain a first random number randomly generated by the first network device according to the first XOR body and a second random number randomly generated by the second network device. The derivation module is used to perform post-quantum derivation processing on the second splice to obtain a second session key.

[0234] In some embodiments, the processor is further configured to decrypt the first encryption result to obtain the first network device identifier, the first encrypted verification message, and the first encrypted message of the first network device. And perform post-quantum decryption processing on the first encrypted message to obtain a second splice. And obtain a quantum key identifier and a first XOR body according to the second splice. The processor is further configured to obtain a first random number randomly generated by the first network device according to the first XOR body and a second random number randomly generated by the second network device. And perform post-quantum derivation processing on the second splice to obtain a second session key.

[0235] Specifically, the second network device decrypts the first encryption result to obtain the first network device identifier, the first encrypted verification message and the first encrypted message of the first network device. Then, the second network device performs post-quantum decryption processing on the first encrypted message to obtain a second splice. Then, the second network device obtains the quantum key identifier and the first XOR body according to the second splice. And the first random number randomly generated by the first network device is obtained according to the first XOR body and the second random number randomly generated by the second network device. Finally, the second splice is subjected to post-quantum derivation processing to obtain a second session key.

[0236] In this way, the second network device obtains various data used to generate the first session key, and generates a second session key based on these data, where the second session key is used to generate a key with good quantum resistance.

[0237] See also Fig.15 In some embodiments, the method further comprises:

[0238] 038: Using the service node to inject multiple keys into the cryptographic module of the second network device;

[0239] 039: Send a quantum key application to the service node according to the quantum key identifier;

[0240] 040: receiving a quantum key encryption result obtained by the service node encrypting the second quantum key according to the protection key;

[0241] 041: Decrypt the quantum key encryption result to obtain a second quantum key.

[0242] In some embodiments, the charging module is further used to charge a plurality of keys to the cryptographic module of the second network device using the service node. The sending module is used to send a quantum key application to the service node according to the quantum key identifier. The receiving module is used to receive a quantum key encryption result obtained by the service node encrypting the second quantum key according to the protection key. The decryption module is used to decrypt the quantum key encryption result to obtain the second quantum key.

[0243] In some embodiments, the processor is further configured to use the service node to inject multiple keys into the cryptographic module of the second network device, and send a quantum key application to the service node according to the quantum key identifier. The processor is also configured to receive a quantum key encryption result obtained by the service node encrypting the second quantum key according to the protection key, and decrypt the quantum key encryption result to obtain the second quantum key.

[0244] Specifically, the second network device uses the service node to charge multiple keys into the cryptographic module of the second network device. Then, the second network device sends a quantum key application to the service node according to the quantum key identifier. The quantum key application is protected by a protection key, which is a randomly used one of the multiple keys charged into the cryptographic module. Then, the second network device receives the quantum key encryption result obtained by the service node encrypting the second quantum key according to the protection key. The second quantum key is generated by the second network node accessing the service node and distributed to the service node. Finally, the second network device decrypts the quantum key encryption result to obtain the second quantum key.

[0245] In this way, the second network device obtains the second quantum key matching the first quantum key from the second network node through the quantum key identifier, which can be used to subsequently generate a key with good quantum resistance.

[0246] See also Fig.16 In some embodiments, the method further comprises:

[0247] 042: concatenate the first random number and the second random number to obtain a fifth concatenated body;

[0248] 043: Encrypting the fifth spliced ​​body according to the second quantum key to obtain a second encrypted verification message;

[0249] 044: Compare the second encrypted verification message with the first encrypted verification message to confirm that the second network device has received the correct quantum key identifier and the first random number.

[0250] In some embodiments, the splicing module is used to splice the first random number and the second random number to obtain a fifth splice. The encryption module is also used to encrypt the fifth splice according to the second quantum key to obtain a second encrypted verification message. The comparison module is also used to compare the second encrypted verification message with the first encrypted verification message to confirm that the second network device has received the correct quantum key identifier and the first random number.

[0251] In some embodiments, the processor is further configured to concatenate the first random number and the second random number to obtain a fifth concatenation, encrypt the fifth concatenation according to the second quantum key to obtain a second encrypted verification message, and compare the second encrypted verification message with the first encrypted verification message to confirm that the second network device has received the correct quantum key identifier and the first random number.

[0252] Specifically, the second network device performs splicing processing on the first random number and the second random number to obtain a fifth splicing body. Then, the second network device performs encryption processing on the fifth splicing body according to the second quantum key to obtain a second encrypted verification message. The second encrypted verification message is compared with the first encrypted verification message to confirm that the second network device has received the correct quantum key identifier and the first random number.

[0253] In this way, the second network device generates a second encrypted verification message by using the same data information as the first encrypted verification message generated by the first network device, and compares it with the first encrypted verification message. It is confirmed that the second network device has received the correct quantum key identifier and the first random number, ensuring that the second network device can obtain the correct second quantum key and generate the correct second session key based on this information.

[0254] See also Fig.17 In some embodiments, step 036 (processing the first decryption result and the second quantum key to generate a second quantum-resistant session key to encrypt communication between the first network device and the second network device) includes:

[0255] 0361: XOR the second session key, the first random number, the second random number and the second quantum key to obtain a second quantum-resistant session key;

[0256] 0362: Deriving a second quantum-resistant session key to encrypt communication between the first network device and the second network device.

[0257] In some embodiments, the derivation module generates a second quantum-resistant session key by performing an XOR process on the second session key, the first random number, the second random number, and the second quantum key. The derivation module is also used to derive the second quantum-resistant session key to encrypt the communication between the first network device and the second network device.

[0258] In some embodiments, the processor is further configured to perform an XOR process on the second session key, the first random number, the second random number, and the second quantum key to generate a second quantum-resistant session key, and to perform a derivation process on the second quantum-resistant session key to encrypt the communication between the first network device and the second network device.

[0259] Specifically, the second network device performs an XOR process on the second session key, the first random number, the second random number and the second quantum key to generate a second quantum-resistant session key. Then, the second network device performs a derivation process on the second quantum-resistant session key to encrypt the communication between the first network device and the second network device.

[0260] In this way, the second network device generates a second quantum-resistant session key, which can be used to enhance the ability of communication data between the first network device and the second network device to resist quantum computing attacks.

[0261] See also Fig.18 In some embodiments, step 037 (performing post-quantum encryption processing on the first decryption result according to the second quantum-resistant session key to generate a second encryption result, so as to enable the first network device to confirm that the second network device has received the correct first encryption result) includes:

[0262] 0371: Performing XOR processing on the second quantum key and the first random number to obtain a second XOR product;

[0263] 0372: concatenate the second XOR body and the second random number to obtain a sixth concatenation body;

[0264] 0373: Perform post-quantum signature processing on the sixth spliced ​​body to obtain the signature message in the second encryption result;

[0265] 0374: Send the second encryption result to the first network device, where the second encryption result includes the user name.

[0266] In some embodiments, the processing module is used to perform an XOR process on the second quantum key and the first random number to obtain a second XOR body. The splicing module is also used to perform a splicing process on the second XOR body and the second random number to obtain a sixth splicing body. The signature module is also used to perform a post-quantum signature process on the sixth splicing body to obtain a signature message in the second encryption result. The sending module is also used to send the second encryption result to the first network device.

[0267] In some embodiments, the processor is further configured to perform an XOR process on the second quantum key and the first random number to obtain a second XOR body. And perform a splicing process on the second XOR body and the second random number to obtain a sixth splicing body. The processor is further configured to perform a post-quantum signature process on the sixth splicing body to obtain a signature message in the second encryption result. And send the second encryption result to the first network device.

[0268] See also Fig.19 In some embodiments, the method further comprises:

[0269] 045: concatenate the first random number and the first network device identifier of the first network device to obtain a seventh concatenated body;

[0270] 046: encrypting the seventh splice according to the second quantum-resistant session key to obtain a second encrypted verification message in the second encryption result;

[0271] 047: Send the second encrypted verification message to the first network device, so that the first network device confirms that the second quantum-resistant session key is consistent with the first quantum-resistant session key generated by the first network device.

[0272] In some embodiments, the splicing module is used to splice the first random number and the first network device identifier of the first network device to obtain a seventh splice. The encryption module is also used to encrypt the seventh splice according to the second quantum-resistant session key to obtain a second encrypted verification message in the second encryption result. The sending module is also used to send the second encrypted verification message to the first network device, so that the first network device confirms that the second quantum-resistant session key is consistent with the first quantum-resistant session key generated by the first network device.

[0273] In some embodiments, the processor is further configured to concatenate the first random number and the first network device identifier of the first network device to obtain a seventh concatenation, encrypt the seventh concatenation according to the second quantum-resistant session key to obtain a second encrypted verification message in the second encryption result, and send the second encrypted verification message to the first network device so that the first network device confirms that the second quantum-resistant session key is consistent with the first quantum-resistant session key generated by the first network device.

[0274] Specifically, the second network device performs splicing processing on the first random number and the first network device identifier of the first network device to obtain a seventh splicing body. Then, the second network device performs encryption processing on the seventh splicing body according to the second quantum-resistant session key to obtain a second encrypted verification message in the second encryption result. Finally, the second network device sends the second encrypted verification message to the first network device, so that the first network device confirms that the second quantum-resistant session key is consistent with the first quantum-resistant session key generated by the first network device.

[0275] In this way, the second network device generates a second encrypted verification message for the first network device to confirm that the second quantum-resistant session key is consistent with the first quantum-resistant session key generated by the first network device, and can use the consistent key to communicate with the second network device.

[0276] See also Fig. 20 In some embodiments, the method further comprises:

[0277] 048: receiving a first encrypted authentication message sent by the first network device;

[0278] 049: Concatenate the user name and the second random number to obtain an eighth concatenation;

[0279] 050: encrypting the eighth spliced ​​body according to the second quantum-resistant session key to obtain a second encrypted authentication message;

[0280] 051: Compare the first encrypted authentication message with the second encrypted authentication message to confirm that the first quantum-resistant session key generated by the first network device is consistent with the second quantum-resistant session key.

[0281] In some embodiments, the receiving module is used to receive a first encrypted authentication message sent by the first network device. The splicing module is also used to splice the user name and the second random number to obtain an eighth splice. The encryption module is also used to encrypt the eighth splice according to the second quantum-resistant session key to obtain a second encrypted authentication message. The comparison module is also used to compare the first encrypted authentication message with the second encrypted authentication message to confirm that the first quantum-resistant session key generated by the first network device is consistent with the second quantum-resistant session key.

[0282] In some embodiments, the processor is further configured to receive a first encrypted authentication message sent by the first network device. And concatenate the user name and the second random number to obtain an eighth concatenation. The processor is further configured to encrypt the eighth concatenation according to the second quantum-resistant session key to obtain a second encrypted authentication message. And compare the first encrypted authentication message with the second encrypted authentication message to confirm that the first quantum-resistant session key generated by the first network device is consistent with the second quantum-resistant session key.

[0283] Specifically, the second network device receives the first encrypted authentication message sent by the first network device. Then, the second network device concatenates the user name and the second random number to obtain an eighth concatenation. Then, the second network device encrypts the eighth concatenation according to the second quantum-resistant session key to obtain a second encrypted authentication message. Finally, the second network device compares the first encrypted authentication message with the second encrypted authentication message to confirm that the first quantum-resistant session key generated by the first network device is consistent with the second quantum-resistant session key.

[0284] In this way, the second network device receives the first encrypted authentication message sent by the first network device, and generates a second encrypted authentication message based on the relevant information, compares it with the first encrypted authentication message, confirms that the first quantum-resistant session key generated by the first network device is consistent with the second quantum-resistant session key, and can use the consistent key to communicate with the first network device.

[0285] The following is an example to illustrate the method of the implementation mode of the present application. In the embodiment of the present application, the first network device is a server, a server of the SASL protocol, which authenticates the client through the SASL authentication mechanism, obtains the key between the client and the client, and protects the integrity and confidentiality of user data of various applications using the SASL protocol. The second network device is a client, a client of the SASL protocol, which authenticates the server through the SASL authentication mechanism, obtains the key between the server and the server, and protects the integrity and confidentiality of user data of various applications using the SASL protocol.

[0286] The quantum network node is a network node that stores and provides the generated quantum key to the server through a trusted channel or provides the generated quantum key to the client through a cryptographic service node. The cryptographic service node is a service node that is used to connect quantum network nodes and provide pre-shared key injection and quantum key services to multiple clients. The certificate system is a framework that provides a method for securely generating, distributing, managing and using digital certificates.

[0287] The startup message is client_first_message, the first encryption result is SASL_QKD_PQC, and the second encryption result is SASL_QKD_PQC. The first encrypted verification message is hmac1-1, and the second encrypted verification message is hmac1-2. The first encrypted verification message is hmac2-1, and the second encrypted verification message is hmac2-2. The first encrypted authentication message is hmac3-1, and the second encrypted authentication message is hmac3-2. The first network device identifier is the server identifier serverID.

[0288] See also Fig.21First, the certificate system issues the client's PQC signature certificate and PQC encryption certificate. Subsequently, the server accesses the first quantum network node with the closest physical distance and completed authorization through a trusted channel. A trusted channel refers to a mechanism or protocol that provides a secure communication path between two communication entities. One way to establish it is that the authentication server and the second quantum network node are in the same cabinet and directly connected by a shielded network cable. This channel ensures the confidentiality, integrity and availability of data during transmission, and prevents unauthorized access, tampering or eavesdropping. The server also obtains the PQC signature certificate or PQC signature public key of the client authorized to access the server through offline methods or online methods such as downloading from the Lightweight Directory Access Protocol (LDAP) LDAP. Both the PQC signature certificate and the PQC signature public key can be used to verify the signature of the signed message from the client to ensure that the data from the client has not been tampered with. The PQC encryption certificate and the PQC encryption public key can be used to encrypt the data sent by the server to the client. Lightweight Directory Access Protocol is a network protocol for accessing and maintaining distributed directory information.

[0289] The client uses the cryptographic service node to inject the pre-shared key into the personal cryptographic module of the resource owner in the client, with a total of 1M bits of 128-bit key. The personal cryptographic module includes but is not limited to the smart cryptographic key (HSM) and the virtual security module (VSM). Then, the client sends a startup message client_first_message to the server, which includes the protocol name SASL_QKD_PQC, the user name username, and the second random number R2 randomly generated by the client, as follows:

[0290] a= SASL_QKD_PQC, n=username, r=R2;

[0291] After the server receives the startup message client_first_message sent by the client, the server sends a quantum key application to the first quantum network node connected to the server through a trusted channel. After the first quantum network node passes the quantum key application, it distributes the first quantum key QK_UUID-1 (more than 128 bits) and the quantum key identifier UUID_QK to the server. At the same time, the first quantum network node will also synchronize a second quantum key QK_UUID-2 through the quantum key distribution network and the second quantum network node of the cryptographic service node connected to the client, but will not issue it.

[0292] After obtaining the first quantum key QK_UUID-1, the server randomly generates a 128-bit first random number R1. The first random number R1 and the second random number R2 are concatenated to obtain the first concatenation P1, that is, R1|R2. The server then uses the first quantum key QK_UUID-1 and the SM3 algorithm to calculate the first encrypted verification message hmac1-1 for the first concatenation, hmac1-1=SM3_HMAC(R1|R2, QK_UUID-1). Then, the server performs an XOR process on the first random number R1 and the second random number R2 to obtain the first XOR R1⊕R2. The quantum key identifier UUID_QK and the first XOR are then concatenated to obtain the second concatenation P2, that is, (UUID_QK|(R1⊕R2)). Next, the server uses the second splice P2 as the encrypted message in the PQC key encapsulation algorithm, and runs the G function of the PQC algorithm on the second splice P2 to obtain the first session key H1. Then, the client's PQC encryption public key is used to perform PQC encryption encapsulation on the second splice P2 to obtain the first encrypted message encap. Finally, the server sends server_first_message to the client, which includes the protocol name SASL_QKD_PQC, the server identification name serverID, the first encrypted verification message hmac1-1, and the first encrypted message encap, as follows:

[0293] a=“SASL_QKD_PQC”, n=serverID, h=hmac1-1, k=encap;

[0294] The client performs PQC key decapsulation on the encap in the received server_first_message message to obtain the second splice P2. Then, the quantum key identifier UUID_QK and the first XOR body R1⊕R2 can be obtained based on the second splice P2. Then, the client uses the second random number R2 to perform XOR processing with the first XOR body R1⊕R2 to obtain the first random number R1. And the G function of the PQC algorithm is run on the obtained second splice P2 to obtain the second session key H2.

[0295] After obtaining the quantum key identifier UUID_QK, the client sends a quantum key application to the second quantum network node connected to the client according to the quantum key identifier UUID_QK. And randomly use a key in the smart password key as the protection key. The client performs a hash operation (Hash-based Message Authentication Code, HMAC) on the key ID and the application content by using the SM3 algorithm and the protection key. After that, the cryptographic service node also performs a hash operation on the key ID and the application content using the SM3 algorithm and the protection key to verify the integrity and authenticity of the data. HMAC is a method that uses hash functions and keys to provide data integrity and source authentication. After the quantum key application is confirmed to be successful, the client receives the quantum key encryption result obtained by the cryptographic service node by encrypting the second quantum key QK_UUID-2 according to the protection key. The second quantum key QK_UUID-2 is generated by the second quantum network node connected to the cryptographic service node and distributed to the cryptographic service node. The client then decrypts the quantum key encryption result according to the protection key to obtain the second quantum key QK_UUID-2.

[0296] After obtaining the second quantum key QK_UUID-2, the client concatenates the first random number R1 and the second random number R2 to obtain the fifth concatenation P5. The fifth concatenation P5 is then encrypted according to the second quantum key QK_UUID-2 to obtain the second encrypted verification message hmac1-2, hmac2-2= SM3_HMAC(R1|R2s, QK_UUID-2). Subsequently, the client compares the received first encrypted verification message hmac1-1 with the second encrypted verification message hmac1-2 generated by the client itself to confirm that the client has received the correct quantum key identifier UUID_QK and the first random number R1. Next, the client performs an XOR process on the second session key H2, the first random number R1, the second random number R2 and the second quantum key QK_UUID-2 to generate the second quantum-resistant session key K2, K2=H2⊕QK_UUID⊕R1⊕R2.

[0297] After generating the first quantum-resistant session key K2, the client performs an XOR process on the second quantum key QK_UUID-2 and the first random number R1 to obtain the second XOR body UUID_QK-2⊕R1. The second XOR body UUID_QK-2⊕R1 and the second random number R2 are then concatenated to obtain the sixth concatenation body P6, i.e., UUID_QK-2⊕R1|R2. The sixth concatenation body P6 is used as M in the PQC signature algorithm for PQC signature protection to obtain the signature information sign. In addition, the client concatenates the first random number R1 and the server identification name serverID to obtain the seventh concatenation body P7, i.e., R1|serverID. Next, the server uses the second quantum-resistant session key K2 and the SM3 encryption algorithm to calculate the seventh concatenation body P7 to obtain the second encrypted verification message hmac2-2, hmac2-2= SM3_HMAC (R1|serverID, K2). The client sends client_final_message to the server. The message includes the protocol name SASL_QKD_PQC, the username username, the signature information sign, and the second encrypted verification message hmac2-2, as follows:

[0298] a=“SASL_QKD_PQC”, n= username, v=sign, h=hmac2-2;

[0299] After receiving the client_final_message message, the server performs PQC verification on the signature information sign in the received client_final_message according to the client's PQC signature public key to confirm that the client has received the correct first random number R1, second random number R2 and quantum key identifier UUID_QK. The first session key H1, the first random number R1, the second random number R2 and the first quantum key QK_UUID-1 are XORed to generate the first quantum-resistant session key K1, K1=H1⊕QK_UUID⊕R1⊕R2. In addition, the server also concatenates the server identifier serverID and the first random number R1 to obtain a third concatenation P3, that is, R1|serverID. The third concatenation P3 is then encrypted according to the first quantum-resistant session key K1 to obtain the first encrypted verification message hmac2-1, hmac2-1=SM3_HMAC (R1|serverID, K1). Subsequently, the server compares the first encrypted verification message hmac2-1 with the second encrypted verification message hmac2-2 in the received client_final_message message to confirm that the second quantum-resistant session key K2 generated by the client is consistent with the first quantum-resistant session key K1.

[0300] The server concatenates the username username and the second random number R2 to obtain a fourth concatenation P4, that is, R2|username. The fourth concatenation p4 is then encrypted according to the first quantum-resistant session key k1 to obtain a first encrypted authentication message hmac3-1. The server sends a server_final_message message, which includes the protocol name SASL_QKD_PQC, the server identification name serverID, and the first encrypted authentication message hmac3-1, as follows:

[0301] a=“SASL_QKD_PQC”, n=serverID, h= hmac3-1;

[0302] After receiving the server_final_message message, the client concatenates the username username and the second random number R2 to obtain the eighth concatenation P8, that is, R2|username. The eighth concatenation P8 is then encrypted according to the second quantum-resistant session key K2 to obtain the second encrypted authentication message hmac3-2, hmac3-2= SM3_HMAC (R2|username, K2). Subsequently, the client compares the first encrypted authentication message hmac3-1 with the second encrypted authentication message hmac3-2 to confirm that the first quantum-resistant session key K1 generated by the server is consistent with the second quantum-resistant session key K2.

[0303] When it is confirmed that the first quantum-resistant session key K1 generated by the server is consistent with the second quantum-resistant session key K2 generated by the client, the client and server perform key derivation based on the obtained first quantum-resistant session key K1 and the second quantum-resistant session key K2 in accordance with the requirements of the SASL application layer and security layer, obtain the corresponding data encryption key and integrity protection key, and perform security protection on the transmission of application layer user data.

[0304] The present application also provides a computer-readable storage medium containing a computer program. When the computer program is executed by one or more processors, the one or more processors execute the voice interaction method of the present application.

[0305] It is understood that a computer program includes computer program code. The computer program code may be in source code form, object code form, executable file or some intermediate form. Computer readable storage media may include: any entity or device capable of carrying computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution medium.

[0306] In the description of this specification, the descriptions with reference to the terms "specifically", "further", "particularly", "understandably", etc. are intended to mean that the specific features, structures, materials or characteristics described in conjunction with the embodiments or examples are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms are not intended to refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0307] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0308] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A method for enhancing quantum security of a simple authentication and security layer protocol for a communication network, characterized in that: The communication network includes a first network device and a second network device, the method is used for the first network device, and the method includes: receiving a startup message sent by the second network device, wherein the startup message includes a second random number; Acquire a quantum key identifier and a first quantum key from a first network node connected to the first network device; Splicing the first random number randomly generated by the first network device and the second random number to obtain a first spliced ​​body; Encrypting the first spliced ​​body according to the first quantum key to obtain a first encrypted verification message in a first encryption result; Performing an XOR process on the first random number and the second random number to obtain a first XOR entity; Concatenating the quantum key identifier and the first XOR body to obtain a second concatenated body; Performing post-quantum encryption processing on the second spliced ​​body to obtain a first encrypted message in the first encryption result, and sending the first encryption result to the second network device; Performing post-quantum derivation processing on the second concatenated body to obtain a first session key; XORing the first session key, the first random number, the second random number, and the first quantum key to generate a first quantum-resistant session key; The first quantum resistant session key is derived to encrypt communication between the first network device and the second network device.

2. The method for enhancing quantum security according to claim 1, characterized in that: The method further comprises: Load the signature certificate and encryption certificate of the second network device.

3. The method for enhancing quantum security according to claim 1, characterized in that: The startup message includes a user name and the second random number randomly generated by the second network device.

4. The method for enhancing quantum security according to claim 1, characterized in that: The obtaining of a quantum key identifier and a first quantum key by a first network node connected to the first network device includes: Sending a quantum key application to a first network node connected to the first network device; Receive a first quantum key and the quantum key identifier sent by the first network node according to the quantum key application, where the quantum key identifier is obtained by the first network node identifying the first quantum key according to an identification code of the first network node.

5. The method for enhancing quantum security according to claim 1, characterized in that: The method further comprises: receiving a second encryption result sent by the second network device, where the second encryption result is obtained by performing post-quantum cryptography encryption processing on the first decryption result by the second network device, and the first decryption result is obtained by performing decryption processing on the first encryption result by the second network device; The second encryption result is decrypted to obtain a second decryption result, where the second decryption result includes a signature message and a user name.

6. The method for enhancing quantum security according to claim 5, characterized in that: The method further comprises: Obtain a sixth spliced ​​body according to the signed message; The signed message is subjected to post-quantum cryptographic signature verification processing to confirm the correctness of the sixth splice, where the sixth splice is obtained according to the quantum key identifier, the first random number, and the second random number.

7. The method for enhancing quantum security according to claim 1, characterized in that: The method further comprises: Receiving a second encrypted verification message sent by the second network device; Concatenate the first network device identifier of the first network device and the first random number to obtain a third concatenated body; Encrypting the third spliced ​​body according to the first quantum-resistant session key to obtain a first encrypted verification message; The first encrypted verification message is compared with the second encrypted verification message to confirm that the second quantum resistant session key generated by the second network device is consistent with the first quantum resistant session key.

8. The method for enhancing quantum security according to claim 1, characterized in that: The startup message also includes a user name, and the method further includes: Concatenate the user name and the second random number to obtain a fourth concatenated body; Encrypting the fourth spliced ​​body according to the first quantum-resistant session key to obtain a first encrypted authentication message; The first encrypted authentication message is sent to the second network device, so that the second network device confirms that the first quantum-resistant session key is consistent with the second quantum-resistant session key generated by the second network device.

9. A method for enhancing quantum security of a simple authentication and security layer protocol for a communication network, characterized in that: The communication network includes a first network device and a second network device, the method is used for the second network device, and the method includes: Sending a startup message to the first network device, wherein the startup message includes a second random number; Receiving a first encryption result sent by the first network device; Decrypting the first encryption result to obtain a first network device identifier of the first network device, a first encrypted verification message, and a first encrypted message; Performing post-quantum decryption processing on the first encrypted message to obtain a second spliced ​​body; Obtain a quantum key identifier and a first XOR entity according to the second concatenated entity; Obtaining a first random number randomly generated by the first network device according to the first XOR body and a second random number randomly generated by the second network device; Performing post-quantum derivation processing on the second concatenation to obtain a second session key; The second session key, the first random number, the second random number and the second quantum key are XORed to generate a second quantum-resistant session key, the second quantum key is obtained from a second network node connected to the second network device according to the first decryption result, and the first decryption result is obtained by the second network device decrypting the first encryption result; The second quantum resistant session key is derived to encrypt communication between the first network device and the second network device.

10. The method for enhancing quantum security according to claim 9, characterized in that: The method further comprises: The signature certificate and encryption certificate of the second network device are obtained from the certificate system.

11. The method for enhancing quantum security according to claim 9, characterized in that: The method further comprises: The first decryption result is subjected to post-quantum encryption processing according to the second quantum-resistant session key to generate a second encryption result, so that the first network device confirms that the second network device has received a correct first encryption result.

12. The method for enhancing quantum security according to claim 9, characterized in that: The method further comprises: Using the service node to inject multiple keys into the cryptographic module of the second network device; Sending a quantum key application to the service node according to the quantum key identifier, wherein the quantum key application is protected by a protection key, and the protection key is a randomly used one from a plurality of keys injected into the cryptographic module; receiving a quantum key encryption result obtained by the service node encrypting a second quantum key according to the protection key, where the second quantum key is generated by a second network node connected to the service node and distributed to the service node; The quantum key encryption result is decrypted to obtain the second quantum key.

13. The method for enhancing quantum security according to claim 9, characterized in that: The method further comprises: Performing splicing processing on the first random number and the second random number to obtain a fifth spliced ​​body; Encrypting the fifth spliced ​​body according to the second quantum key to obtain a second encrypted verification message; The second encrypted verification message is compared with the first encrypted verification message to confirm that the second network device has received the correct quantum key identifier and the first random number.

14. The method for enhancing quantum security according to claim 11, characterized in that: The performing post-quantum encryption processing on the first decryption result according to the second quantum-resistant session key to generate a second encryption result, so as to enable the first network device to confirm that the second network device has received a correct first encryption result, includes: Performing an XOR process on the second quantum key and the first random number to obtain a second XOR product; Concatenate the second XOR body and the second random number to obtain a sixth concatenation body; Performing post-quantum signature processing on the sixth spliced ​​body to obtain a signature message in the second encryption result; The second encryption result is sent to the first network device, where the second encryption result includes a user name.

15. The method for enhancing quantum security according to claim 14, characterized in that: The method further comprises: Concatenate the first random number and the first network device identifier to obtain a seventh concatenated body; Encrypting the seventh splice according to the second quantum-resistant session key to obtain a second encrypted verification message in a second encryption result; The second encrypted verification message is sent to the first network device, so that the first network device confirms that the second quantum-resistant session key is consistent with the first quantum-resistant session key generated by the first network device.

16. The method for enhancing quantum security according to claim 14, characterized in that: The method further comprises: Receiving a first encrypted authentication message sent by the first network device; Concatenate the user name and the second random number to obtain an eighth concatenation; Encrypting the eighth spliced ​​body according to the second quantum-resistant session key to obtain a second encrypted authentication message; The first encrypted authentication message is compared with the second encrypted authentication message to confirm that the first quantum-resistant session key generated by the first network device is consistent with the second quantum-resistant session key.

Images