Quantum-resistant security enhancement method for online certificate issuance and key pair distribution

Abstract

The present application discloses a method for enhancing the anti-quantum security of online certificate issuance and key pair distribution of a communication network. The method includes: obtaining a first quantum key and a quantum key identifier from a first network node of an access terminal. Encrypting the quantum key identifier and the randomly generated terminal key pair according to the first quantum key to obtain a first encrypted message. Generate an application message according to the first encrypted message, the terminal key pair and the quantum key identifier, and send the application message to a certificate authentication center. Receive a response message sent by the certificate authentication center so that the terminal can use the response message to communicate with other terminals in the communication network except the terminal. By using post-quantum cryptographic algorithms and quantum key distribution technology to encrypt communications, the terminal's ability to obtain security certificates from a certificate authentication center and obtain key pairs from a key management system to resist quantum computing attacks during the communication process is significantly enhanced.

Description

Technical Field

[0001] The present application relates to the field of network security, and more specifically, to a method for enhancing quantum security for online certificate issuance and key pair distribution in communication networks. Background Art

[0002] The leap in computing power, exemplified by quantum computing, has had a significant impact on the security of classical cryptographic algorithms. Understandably, the realization of large-scale quantum computers will have a certain impact on classical cryptographic applications such as key agreement, encryption, and signatures. Therefore, developing cryptographic technologies that are resistant to quantum computing attacks has become an urgent challenge. Summary of the Invention

[0003] This application provides a method for enhancing quantum security for online certificate issuance and key pair distribution in a communication network.

[0004] The present application provides a method for enhancing quantum security of online certificate issuance and key pair distribution in a communication network, wherein the communication network includes a terminal, a certificate authentication center, and a key management system. The method is applied to the terminal and includes:

[0005] Obtaining a first quantum key and a quantum key identifier from a first network node connected to the terminal;

[0006] encrypting the quantum key identifier and the randomly generated terminal key pair according to the first quantum key to obtain a first encrypted message;

[0007] generating an application message according to the first encrypted message, the terminal key pair, and the quantum key identifier, and sending the application message to the certificate authentication center;

[0008] Receive a response message sent by the certificate authentication center so that the terminal can use the response message to communicate with other terminals in the communication network except the terminal, wherein the response message includes a key response package and a security certificate, the key response package is generated by the key management system according to the key application package sent by the certificate authentication center, the key application package is generated by the certificate authentication center according to the application message, and the security certificate is generated by the certificate authentication center according to the application message and the key response package sent by the key management system.

[0009] In this way, during the communication process in which a terminal obtains a security certificate from a certificate authentication center and a key pair from a key management system, the terminal applies for a first quantum key and uses the first quantum key to encrypt the quantum key identifier and the terminal key pair to generate a first encrypted message that is resistant to quantum computing attacks. This first quantum key has strong quantum resistance. Next, the terminal generates a request message based on the first encrypted message, the terminal key pair, and the quantum key identifier, and sends this request message to the certificate authentication center. The certificate authentication center generates a key request package based on the request message and sends it to the key management system. The key management system processes the key request package using a post-quantum cryptographic algorithm, a series of cryptographic algorithms designed to resist quantum computing attacks, to generate a key response package, which it then returns to the certificate authentication center. The certificate authentication center generates a security certificate based on the request message and the key response package sent by the key management system. Based on the security certificate and key response package, it generates a response message and sends it to the terminal. In this way, quantum key distribution technology and post-quantum cryptographic algorithms enhance the resistance to quantum computing attacks in the communication process in which a terminal obtains a security certificate from a certificate authentication center and a key pair from a key management system.

[0010] In certain embodiments, obtaining the first quantum key and the quantum key identifier from a service node connected to the terminal includes:

[0011] Using a service node to inject multiple keys into a cryptographic module of the terminal;

[0012] Sending a quantum key request to the service node, where the quantum key request is protected by a protection key, where the protection key is a randomly used one of a plurality of keys injected into the cryptographic module;

[0013] receiving a quantum key encryption result obtained by the service node encrypting the first quantum key and the quantum key identifier according to the protection key, where the first quantum key is generated by a first network node connected to the service node and distributed to the service node, and the quantum key identifier is obtained by the first network node identifying the first quantum key according to an identification code of the first network node;

[0014] Decrypting the quantum key encryption result to obtain the first quantum key and the quantum key identifier.

[0015] In this way, the terminal uses the service node to inject multiple keys into its cryptographic module. Next, based on the authorization code received from the certificate authority, the terminal sends a quantum key request to the service node. This quantum key request is protected by a protection key, which is a randomly selected key from the multiple keys injected into the cryptographic module. The terminal then receives the quantum key encryption result, obtained by encrypting the first quantum key using the protection key. The first quantum key was generated and distributed to the service node by the first network node connected to the service node. Finally, the terminal decrypts the quantum key encryption result to obtain the first quantum key. The terminal obtains the first quantum key and quantum key identifier, which can be used to subsequently generate keys that are more resistant to quantum computing attacks.

[0016] In some embodiments, encrypting the quantum key identifier and the randomly generated terminal key pair according to the first quantum key to obtain a first encrypted message includes:

[0017] Randomly generate a terminal key pair according to the cryptographic module of the terminal, the terminal key pair including a terminal classical signature key pair, a terminal post-quantum signature key pair, and a terminal post-quantum encryption key pair;

[0018] Concatenating a terminal public key and the quantum key identifier to obtain a first concatenation, wherein the terminal public key includes the terminal classical signature public key of the terminal classical signature key pair, the terminal post-quantum signature public key of the terminal post-quantum signature key pair, and the terminal temporary post-quantum encryption public key of the terminal post-quantum encryption key pair;

[0019] The first spliced ​​body is encrypted according to the first quantum key to obtain a first encrypted message.

[0020] In this way, the terminal randomly generates a terminal key pair based on the terminal's cryptographic module. The terminal key pair includes a terminal classical signature key pair, a terminal post-quantum signature key pair, and a terminal post-quantum encryption key pair. Next, the terminal concatenates the terminal public key and the quantum key identifier to obtain a first concatenation. The terminal public key includes the terminal classical signature public key of the terminal classical signature key pair, the terminal post-quantum signature public key of the terminal post-quantum signature key pair, and the terminal temporary post-quantum encryption public key of the terminal post-quantum encryption key pair. Finally, the terminal encrypts the first concatenation using the first quantum key to obtain a first encrypted message.

[0021] In some embodiments, the security certificate includes a classic encryption certificate, a first classic encryption certificate signature, and a second classic encryption certificate signature, and the method further includes:

[0022] Verifying the signature of the first classic encryption certificate according to the terminal classic signature public key to obtain a first classic encryption certificate verification result;

[0023] Verifying the signature of the second classical encryption certificate according to the terminal post-quantum signature public key to obtain a second classical encryption certificate verification result;

[0024] When the signature verification result of the first classic encryption certificate and the signature verification result of the second classic encryption certificate are correct, confirming that the classic encryption certificate is correct.

[0025] In this way, the terminal verifies the signature of the first classical encryption certificate using the terminal's classical signature public key to obtain a first classical encryption certificate verification result. Next, the terminal verifies the signature of the second classical encryption certificate using the terminal's post-quantum signature public key to obtain a second classical encryption certificate verification result. Finally, if the verification results of the first and second classical encryption certificates are correct, the terminal confirms that the classical encryption certificates are correct. In this way, the terminal verifies the signatures of the first and second classical encryption certificates, respectively, and determines the correctness of the classical encryption certificates based on the verification results, ensuring that the correct classical encryption certificates are obtained and capable of encrypting terminal communications.

[0026] In some embodiments, the security certificate includes a classic signing certificate, a first classic signing certificate signature, and a second classic signing certificate signature, and the method further includes:

[0027] Verifying the signature of the first classic signature certificate according to the terminal classic signature public key to obtain a first classic signature certificate verification result;

[0028] Verifying the signature of the second classical signature certificate according to the terminal post-quantum signature public key to obtain a second classical signature certificate verification result;

[0029] When the verification results of the first classic signature certificate and the second classic signature certificate are correct, confirm that the classic signature certificate is correct.

[0030] In this way, the terminal verifies the signature of the first classic signature certificate using the terminal's classic signature public key to obtain a first classic signature certificate verification result. Next, the terminal verifies the signature of the second classic signature certificate using the terminal's post-quantum signature public key to obtain a second classic signature certificate verification result. Finally, if the verification results of the first and second classic signature certificates are correct, the terminal confirms that the classic signature certificate is correct. In this way, the terminal verifies the signatures of the first and second classic signature certificates, respectively, and determines the correctness of the classic signature certificates based on the verification results, ensuring that the correct classic signature certificates are obtained and enabling encryption of terminal communications.

[0031] In some embodiments, the security certificate includes a post-quantum encryption certificate, a first post-quantum encryption certificate signature, and a second post-quantum encryption certificate signature, and the method further includes:

[0032] Performing signature verification processing on the first post-quantum encryption certificate signature according to the terminal classic signature public key to obtain a first post-quantum encryption certificate signature verification result;

[0033] Verify the signature of the second post-quantum encryption certificate according to the terminal post-quantum signature public key to obtain a second post-quantum encryption certificate verification result;

[0034] When the first post-quantum encryption certificate verification result and the second post-quantum encryption certificate verification result are correct, confirm that the post-quantum encryption certificate is correct.

[0035] In this way, the terminal verifies the signature of the first post-quantum encryption certificate using the terminal's classical signature public key to obtain a first post-quantum encryption certificate verification result. Next, the terminal verifies the signature of the second post-quantum encryption certificate using the terminal's post-quantum signature public key to obtain a second post-quantum encryption certificate verification result. Finally, if the verification results of the first and second post-quantum encryption certificates are correct, the post-quantum encryption certificates are confirmed to be correct. In this way, the terminal verifies the signatures of the first and second post-quantum encryption certificates respectively, and determines the correctness of the post-quantum encryption certificates based on the verification results, ensuring that the correct post-quantum encryption certificates are obtained and capable of encrypting the terminal's communications.

[0036] In some embodiments, the security certificate includes a post-quantum signature certificate, a first post-quantum signature certificate signature, and a second post-quantum signature certificate signature, and the method further includes:

[0037] Verify the signature of the first post-quantum signature certificate according to the terminal classical signature public key to obtain a first post-quantum signature certificate verification result;

[0038] Verify the signature of the second post-quantum signature certificate according to the terminal post-quantum signature public key to obtain a second post-quantum signature certificate verification result;

[0039] When the verification result of the first post-quantum signature certificate and the verification result of the second post-quantum signature certificate are correct, confirm that the post-quantum signature certificate is correct.

[0040] In this way, the terminal verifies the signature of the first post-quantum signature certificate using the terminal's classical signature public key to obtain a first post-quantum signature certificate verification result. Next, the terminal verifies the signature of the second post-quantum signature certificate using the terminal's post-quantum signature public key to obtain a second post-quantum signature certificate verification result. Finally, if the verification results of the first and second post-quantum signature certificates are correct, the post-quantum signature certificates are confirmed to be correct. In this way, the terminal verifies the signatures of the first and second post-quantum signature certificates, respectively, and determines the correctness of the post-quantum signature certificates based on the verification results, ensuring that the correct post-quantum signature certificates are obtained and enabling encryption of terminal communications.

[0041] In some embodiments, the response message includes a first classical cryptographic envelope signature, a first classical cryptographic envelope post-quantum signature, a first post-quantum cryptographic envelope signature, a first post-quantum cryptographic envelope post-quantum signature, an encrypted classical cryptographic envelope, and an encrypted post-quantum cryptographic envelope, and the method further includes:

[0042] Performing signature verification on the first classic cryptographic envelope signature to obtain a first terminal signature verification result;

[0043] Performing signature verification on the first classical cryptographic envelope post-quantum signature to obtain a second terminal signature verification result;

[0044] Performing signature verification on the first post-quantum cryptographic envelope signature to obtain a third terminal signature verification result;

[0045] Performing signature verification processing on the post-quantum signature of the first post-quantum cryptographic envelope to obtain a fourth terminal signature verification result;

[0046] If the signature verification result of the first terminal, the signature verification result of the second terminal, the signature verification result of the third terminal, and the signature verification result of the fourth terminal are all correct, decrypting the encrypted classical cryptographic envelope according to the first quantum key to obtain a classical cryptographic envelope;

[0047] The encrypted post-quantum cryptographic envelope is decrypted according to the first quantum key to obtain a post-quantum cryptographic envelope.

[0048] In this way, the terminal verifies the signature of the first classical cryptographic envelope and obtains a first terminal verification result. Next, the terminal verifies the signature of the first classical cryptographic envelope and obtains a second terminal verification result. The terminal further verifies the signature of the first post-quantum cryptographic envelope and obtains a third terminal verification result. It also verifies the signature of the first post-quantum cryptographic envelope and obtains a fourth terminal verification result. Then, if the first, second, third, and fourth terminal verification results are all correct, the terminal decrypts the encrypted classical cryptographic envelope using the first quantum key to obtain a classical cryptographic envelope. Finally, the terminal decrypts the encrypted post-quantum cryptographic envelope using the first quantum key to obtain a post-quantum cryptographic envelope. In this way, after multiple verifications, the terminal determines that the encrypted classical cryptographic envelope and the encrypted post-quantum cryptographic envelope are correct. Then, according to the first quantum key, the encrypted classical cryptographic envelope and the encrypted post-quantum cryptographic envelope are decrypted to obtain the classical cryptographic envelope and the post-quantum cryptographic envelope respectively. According to the classical cryptographic envelope and the post-quantum cryptographic envelope, multiple private keys generated by the key management system for the terminal can be obtained in subsequent processes.

[0049] In certain embodiments, the method further comprises:

[0050] Decrypting the encrypted temporary symmetric key in the classic cryptographic envelope according to the private key in the terminal classic signature key pair to obtain a temporary symmetric key;

[0051] The classic encryption private key in the classic cryptographic envelope is decrypted according to the temporary symmetric key to obtain the private key in the classic encryption key pair.

[0052] In this way, the terminal uses the private key in the terminal's classic signature key pair to decrypt the encrypted temporary symmetric key in the classic cryptographic envelope, obtaining a temporary symmetric key. Next, the terminal uses the temporary symmetric key to decrypt the classic encryption private key in the classic cryptographic envelope, obtaining the private key in the classic encryption key pair. The terminal now has the private key in the classic encryption key pair and can use it to encrypt and decrypt data during communication.

[0053] In certain embodiments, the method further comprises:

[0054] Decapsulating the first encapsulated message in the post-quantum cryptographic envelope to obtain a second spliced ​​body;

[0055] Obtaining a fixed string according to the second concatenated body to confirm the correctness of the post-quantum cryptographic envelope;

[0056] If the post-quantum cryptographic envelope is correct, performing post-quantum encryption on the first spliced ​​body to obtain a first encryption key;

[0057] The post-quantum encryption private key in the post-quantum cryptographic envelope is decrypted according to the first encryption key to obtain the private key in the post-quantum encryption key pair.

[0058] In this way, the terminal decrypts the first encapsulated message in the post-quantum cryptographic envelope to obtain the second concatenation. Next, the terminal obtains a fixed string from the second concatenation to confirm the correctness of the post-quantum cryptographic envelope. If the post-quantum cryptographic envelope is correct, the terminal performs post-quantum encryption on the first concatenation to obtain the first encryption key. Using the first encryption key, the terminal decrypts the post-quantum encryption private key in the post-quantum cryptographic envelope to obtain the private key of the post-quantum encryption key pair. The terminal now obtains the private key of the quantum encryption key pair, which can be used to encrypt and decrypt data during communication.

[0059] The present application provides a method for enhancing quantum security of online certificate issuance and key pair distribution in a communication network, wherein the communication network includes a terminal, a certificate authentication center, and a key management system. The method is applied to the certificate authentication center and includes:

[0060] receiving an application message sent by the terminal, wherein the application message is generated by the terminal based on a terminal key pair, a quantum key identifier, and a first encrypted message, the terminal key pair is randomly generated by the terminal, the quantum key identifier is obtained by the first network node to which the terminal has accessed, and the first encrypted message is obtained by encrypting the quantum key identifier and the terminal key pair with a first quantum key, and the first quantum key is obtained by the first network node to which the terminal has accessed;

[0061] Generate a key application package according to the application message, and send the key application package to the key management system;

[0062] receiving a key response packet sent by the key management system, wherein the key response packet is generated by the key management system according to the key application packet;

[0063] Generate a security certificate according to the application message and the key response packet;

[0064] A response message is generated according to the key response package and the security certificate, and the response message is sent to the terminal, so that the terminal can use the response message to communicate with other terminals in the communication network except the terminal.

[0065] In this way, during the communication process in which a terminal obtains a security certificate from a certificate authentication center and a key pair from a key management system, the terminal applies for a first quantum key and uses the first quantum key to encrypt the quantum key identifier and the terminal key pair to generate a first encrypted message that is resistant to quantum computing attacks. This first quantum key has strong quantum resistance. Next, the terminal generates a request message based on the first encrypted message, the terminal key pair, and the quantum key identifier, and sends this request message to the certificate authentication center. The certificate authentication center generates a key request package based on the request message and sends it to the key management system. The key management system processes the key request package using a post-quantum cryptographic algorithm, a series of cryptographic algorithms designed to resist quantum computing attacks, to generate a key response package, which it then returns to the certificate authentication center. The certificate authentication center generates a security certificate based on the request message and the key response package sent by the key management system. Based on the security certificate and key response package, it generates a response message and sends it to the terminal. In this way, quantum key distribution technology and post-quantum cryptographic algorithms enhance the resistance to quantum computing attacks in the communication process in which a terminal obtains a security certificate from a certificate authentication center and a key pair from a key management system.

[0066] In certain embodiments, the method further comprises:

[0067] accessing a second network node through a pre-established channel;

[0068] Issue the security certificate of the certificate authority.

[0069] In this way, the certificate authentication center accesses the second network node through a pre-established channel. The certificate authentication center then issues its own security certificate. This allows the certificate authentication center to access the network node through the channel and obtain the second quantum key. Furthermore, the certificate authentication center issues its own security certificate, which can be used for encryption and decryption in subsequent processes.

[0070] In certain embodiments, the method further comprises:

[0071] Sending a quantum key application to a second network node connected to the certificate authentication center according to the quantum key identifier;

[0072] Receive a second quantum key distributed by the second network node according to the quantum key application.

[0073] In this way, the certificate authentication center sends a quantum key request based on the quantum key identifier to a second network node connected to the certificate authentication center. The certificate authentication center then receives the second quantum key distributed by the second network node based on the quantum key request. This way, the certificate authentication center obtains the second quantum key, which has strong quantum resistance and can be used in subsequent processes, ensuring strong quantum resistance.

[0074] In some embodiments, the application message includes the first encrypted message, a terminal classical signature key pair, a terminal post-quantum signature key pair, a terminal post-quantum encryption key pair, and the quantum key identifier, and the method further includes:

[0075] Concatenating the terminal classical signature public key in the terminal classical signature key pair, the terminal post-quantum signature public key in the terminal post-quantum signature key pair, the terminal temporary post-quantum encryption public key in the terminal post-quantum encryption key pair, and the quantum key identifier to obtain a second concatenation;

[0076] encrypting the second spliced ​​body according to the second quantum key to obtain a second encrypted message;

[0077] Confirm the correctness of the received terminal classical signature public key, the terminal post-quantum signature public key, the terminal temporary post-quantum encryption public key and the quantum key identifier according to the second encrypted message and the first encrypted message.

[0078] In this way, the certificate authentication center concatenates the terminal classic signature public key in the terminal classic signature key pair, the terminal post-quantum signature public key in the terminal post-quantum signature key pair, the terminal temporary post-quantum encryption public key in the terminal post-quantum encryption key pair, and the quantum key identifier to obtain a second concatenation. Then, the certificate authentication center encrypts the second concatenation according to the second quantum key to obtain a second encrypted message. Finally, the certificate authentication center confirms the correctness of the received terminal classic signature public key, terminal post-quantum signature public key, terminal temporary post-quantum encryption public key, and quantum key identifier based on the second encrypted message and the first encrypted message. In this way, the certificate authentication center can confirm the accuracy of the message received by the certificate authentication center based on the second concatenation generated by the certificate authentication center and the first concatenation generated by the terminal.

[0079] In some embodiments, generating a key application package according to the application message and sending the key application package to the key management system includes:

[0080] Generate a first temporary key application package;

[0081] Storing the terminal classical signature public key and the terminal temporary post-quantum encryption public key in the first temporary key application package to obtain a second temporary key application package;

[0082] Storing the classic signature identifier associated with the terminal classic signature public key and the post-quantum signature identifier associated with the terminal post-quantum signature public key in the second temporary key application package to obtain a third temporary key application package;

[0083] Signing the third temporary key application package according to a classic signature algorithm associated with the terminal classic signature public key to obtain a first classic signature value;

[0084] Signing the third temporary key application package according to a post-quantum signature algorithm associated with the terminal post-quantum signature public key to obtain a first post-quantum signature value;

[0085] Storing the first classical signature value and the first post-quantum signature value in the third temporary key application package to obtain a key application package;

[0086] Send the key application package to the key management system.

[0087] In this way, the certificate authentication center generates a first temporary key application package. Then, the certificate authentication center stores the terminal classic signature public key and the terminal temporary post-quantum encryption public key in the first temporary key application package to obtain a second temporary key application package. Then, the certificate authentication center stores the classic signature identifier associated with the terminal classic signature public key and the post-quantum signature identifier associated with the terminal post-quantum signature public key in the second temporary key application package to obtain a third temporary key application package. Subsequently, the certificate authentication center signs the third temporary key application package according to the classic signature algorithm associated with the terminal classic signature public key to obtain a first classic signature value. And signs the third temporary key application package according to the post-quantum signature algorithm associated with the terminal post-quantum signature public key to obtain a first post-quantum signature value. Finally, the certificate authentication center stores the first classic signature value and the first post-quantum signature value in the third temporary key application package to obtain a key application package. And sends the key application package to the key management system. In this way, the first temporary key application package storing the terminal classical signature public key and the terminal temporary post-quantum encryption public key is processed layer by layer by the post-quantum cryptography algorithm to obtain a key application package. The key application package has good quantum resistance, and the key management system can ensure that the key application package is not unauthorizedly accessed during transmission based on the first classical signature value and the first post-quantum signature value on the key application package.

[0088] In some embodiments, the key application package includes a second classical signature message and a second post-quantum signature message, and generating a security certificate based on the application message and the key response package includes:

[0089] Upon receiving the key response packet sent by the key management system, performing signature verification on the second classic signature message according to the classic signature algorithm to obtain a second classic signature verification result;

[0090] Performing signature verification on the second post-quantum signature message according to the post-quantum signature algorithm to obtain a second post-quantum signature verification result;

[0091] When both the second classical signature verification result and the second post-quantum signature verification result are correct, obtaining the public key in the classical encryption key pair and the public key in the post-quantum encryption key pair from the key response packet;

[0092] Generate a classic signature certificate in the security certificate for the terminal according to the terminal classic signature public key;

[0093] generating a classic encryption certificate in the security certificate for the terminal according to the public key in the classic encryption key pair;

[0094] Generate a post-quantum signature certificate in the security certificate for the terminal according to the terminal post-quantum signature public key;

[0095] A post-quantum encryption certificate in the security certificate is generated for the terminal according to the public key in the post-quantum encryption key pair.

[0096] In this way, upon receiving a key response packet from the key management system, the certificate authentication center verifies the second classical signature message using the classical signature algorithm to obtain a second classical signature verification result. It also verifies the second post-quantum signature message using the post-quantum signature algorithm to obtain a second post-quantum signature verification result. If both the second classical signature verification result and the second post-quantum signature verification result are correct, the certificate authentication center obtains the public key from the classical encryption key pair and the public key from the post-quantum encryption key pair from the key response packet. The certificate authentication center then generates a classical signature certificate for the terminal in the security certificate based on the terminal's classical signature public key. It also generates a classical encryption certificate for the terminal in the security certificate based on the public key from the classical encryption key pair. It also generates a post-quantum signature certificate for the terminal in the security certificate based on the terminal's post-quantum signature public key. Finally, it generates a post-quantum encryption certificate for the terminal in the security certificate based on the public key from the post-quantum encryption key pair. In this way, after confirming that multiple verification results are correct, the certificate authentication center obtains the terminal's signature certificate, encryption certificate, post-quantum signature certificate, and post-quantum encryption certificate. These certificates can be used for terminal communications to protect data during terminal communications.

[0097] In certain embodiments, the method further comprises:

[0098] Signing the classic encryption certificate according to the private key in the terminal classic signature key pair to obtain a first classic encryption certificate signature in the security certificate;

[0099] The classical encryption certificate is signed according to the private key in the terminal post-quantum signature key pair to obtain a second classical encryption certificate signature in the security certificate.

[0100] In this way, the certificate authentication center signs the classical encryption certificate using the private key in the terminal's classical signature key pair, obtaining the first classical encryption certificate signature in the security certificate. Next, the certificate authentication center signs the classical encryption certificate using the private key in the terminal's post-quantum signature key pair, obtaining the second classical encryption certificate signature in the security certificate. In this way, the certificate authentication center obtains the first and second classical encryption certificate signatures, which can be used to verify the accuracy of the classical encryption certificate and confirm that the classical encryption certificate has not been accessed unauthorized during transmission. Furthermore, the second classical encryption certificate signature in the security certificate obtained by signing the classical encryption certificate using the private key in the terminal's post-quantum signature key pair also has strong quantum resistance.

[0101] In certain embodiments, the method further comprises:

[0102] Signing the classic signature certificate according to the private key in the terminal classic signature key pair to obtain a first classic signature certificate signature in the security certificate;

[0103] The classic signature certificate is signed according to the private key in the terminal post-quantum signature key pair to obtain a second classic signature certificate signature in the security certificate.

[0104] In this way, the certificate authentication center signs the classic signature certificate using the private key in the terminal's classic signature key pair, obtaining the first classic signature certificate signature in the security certificate. Next, the certificate authentication center signs the classic signature certificate using the private key in the terminal's post-quantum signature key pair, obtaining the second classic signature certificate signature in the security certificate. In this way, the certificate authentication center obtains the first and second classic signature certificate signatures, which can be used to verify the accuracy of the classic signature certificate and confirm that the classic signature certificate has not been accessed by unauthorized persons during transmission. Furthermore, the second classic signature certificate signature in the security certificate obtained by signing the classic signature certificate using the private key in the terminal's post-quantum signature key pair also has good quantum resistance.

[0105] In certain embodiments, the method further comprises:

[0106] Signing the post-quantum encryption certificate according to the private key in the terminal classical signature key pair to obtain a first post-quantum encryption certificate signature in the security certificate;

[0107] The post-quantum encryption certificate is signed according to the private key in the terminal post-quantum signature key pair to obtain a second post-quantum encryption certificate signature in the security certificate.

[0108] In this way, the certificate authentication center signs the post-quantum encryption certificate using the private key in the terminal's classical signature key pair to obtain the first post-quantum encryption certificate signature in the security certificate. Next, the certificate authentication center signs the post-quantum encryption certificate using the private key in the terminal's post-quantum signature key pair to obtain the second post-quantum encryption certificate signature in the security certificate. In this way, the certificate authentication center obtains the first and second post-quantum encryption certificate signatures, which can be used to verify the accuracy of the post-quantum encryption certificate and confirm that the post-quantum encryption certificate has not been unauthorizedly accessed during transmission. Furthermore, the second post-quantum encryption certificate signature in the security certificate obtained by signing the post-quantum encryption certificate using the private key in the terminal's post-quantum signature key pair also has good quantum resistance.

[0109] In certain embodiments, the method further comprises:

[0110] Signing the post-quantum signature certificate according to the private key in the terminal classical signature key pair to obtain a first post-quantum signature certificate signature in the security certificate;

[0111] The post-quantum signature certificate is signed according to the private key in the terminal post-quantum signature key pair to obtain a second post-quantum signature certificate signature in the security certificate.

[0112] In this way, the certificate authentication center signs the post-quantum signature certificate using the private key in the terminal's classical signature key pair, obtaining the first post-quantum signature certificate signature in the security certificate. Next, the certificate authentication center signs the post-quantum signature certificate using the private key in the terminal's post-quantum signature key pair, obtaining the second post-quantum signature certificate signature in the security certificate. In this way, the certificate authentication center obtains the first and second post-quantum signature certificate signatures, which can be used to verify the accuracy of the post-quantum signature certificate and confirm that the post-quantum signature certificate has not been accessed unauthorized during transmission. Furthermore, the second post-quantum signature certificate signature in the security certificate obtained by signing the post-quantum signature certificate using the private key in the terminal's post-quantum signature key pair also exhibits strong quantum resistance.

[0113] In some embodiments, the key response package includes a classical cryptographic envelope and a post-quantum cryptographic envelope, and generating a response message according to the key response package and the security certificate, and sending the response message to the terminal, includes:

[0114] Signing the classic cryptographic envelope according to the classic signature algorithm to obtain a first classic cryptographic envelope signature;

[0115] Signing the classical cryptographic envelope according to the post-quantum signature algorithm to obtain a first classical cryptographic envelope post-quantum signature;

[0116] Signing the post-quantum cryptographic envelope according to the classical signature algorithm to obtain a first post-quantum cryptographic envelope signature;

[0117] Signing the post-quantum cryptographic envelope according to the post-quantum signature algorithm to obtain a first post-quantum cryptographic envelope post-quantum signature;

[0118] encrypting the classical cryptographic envelope according to the second quantum key to obtain an encrypted classical cryptographic envelope;

[0119] Encrypting the post-quantum cryptographic envelope according to the second quantum key to obtain an encrypted post-quantum cryptographic envelope;

[0120] The security certificate, the first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, the first post-quantum cryptographic envelope post-quantum signature, the encrypted classical cryptographic envelope and the encrypted post-quantum cryptographic envelope are sent to the terminal as response messages.

[0121] In this way, the certificate authentication center signs the classical cryptographic envelope using the classical signature algorithm to obtain a first classical cryptographic envelope signature. Next, the certificate authentication center signs the classical cryptographic envelope using the post-quantum signature algorithm to obtain a first classical cryptographic envelope post-quantum signature. Then, the certificate authentication center signs the post-quantum cryptographic envelope using the classical signature algorithm to obtain a first post-quantum cryptographic envelope signature. The certificate authentication center then signs the post-quantum cryptographic envelope using the post-quantum signature algorithm to obtain a first post-quantum cryptographic envelope post-quantum signature. Subsequently, the certificate authentication center encrypts the classical cryptographic envelope using the second quantum key to obtain an encrypted classical cryptographic envelope. Furthermore, the certificate authentication center encrypts the post-quantum cryptographic envelope using the second quantum key to obtain an encrypted post-quantum cryptographic envelope. Finally, the certificate authentication center sends the security certificate, the first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, the first post-quantum cryptographic envelope post-quantum signature, the encrypted classical cryptographic envelope, and the encrypted post-quantum cryptographic envelope as a response message to the terminal. In this way, the certificate authentication center sends the corresponding message to the terminal, allowing the terminal to protect its communication data based on the security certificate in the response message. The first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, and the first post-quantum cryptographic envelope post-quantum signature in the response message can confirm that the response message has not been unauthorizedly accessed during transmission. The encrypted classical cryptographic envelope and encrypted post-quantum cryptographic envelope in the response message can protect the classical cryptographic envelope and the post-quantum cryptographic envelope.

[0122] The present application provides a method for enhancing quantum security of online certificate issuance and key pair distribution in a communication network, wherein the communication network includes a terminal, a certificate authentication center, and a key management system. The method is used in the key management system, and includes:

[0123] Receiving a key application package sent by the certificate authentication center, wherein the key application package is generated by the certificate authentication center according to an application message, the application message is generated by the terminal according to a terminal key pair, a quantum key identifier, and a first encrypted message, the terminal key pair is randomly generated by the terminal, the quantum key identifier is obtained by the first network node connected by the terminal, the first encrypted message is obtained by encrypting the quantum key identifier and the terminal key pair with a first quantum key, and the first quantum key is obtained by the first network node connected by the terminal;

[0124] A key response package is generated based on the key application package, and the key response package is sent to the certificate authentication center, wherein the certificate authentication center generates a security certificate based on the application message and the key response package, and sends a response message generated based on the security certificate and the key response package to the terminal, so that the terminal can use the response message to communicate with other terminals in the communication network except the terminal.

[0125] In this way, during the communication process in which a terminal obtains a security certificate from a certificate authentication center and a key pair from a key management system, the terminal applies for a first quantum key and uses the first quantum key to encrypt the quantum key identifier and the terminal key pair to generate a first encrypted message that is resistant to quantum computing attacks. This first quantum key has strong quantum resistance. Next, the terminal generates a request message based on the first encrypted message, the terminal key pair, and the quantum key identifier, and sends this request message to the certificate authentication center. The certificate authentication center generates a key request package based on the request message and sends it to the key management system. The key management system processes the key request package using a post-quantum cryptographic algorithm, a series of cryptographic algorithms designed to resist quantum computing attacks, to generate a key response package, which it then returns to the certificate authentication center. The certificate authentication center generates a security certificate based on the request message and the key response package sent by the key management system. Based on the security certificate and key response package, it generates a response message and sends it to the terminal. In this way, quantum key distribution technology and post-quantum cryptographic algorithms enhance the resistance to quantum computing attacks in the communication process in which a terminal obtains a security certificate from a certificate authentication center and a key pair from a key management system.

[0126] In certain embodiments, the method further comprises:

[0127] Obtain the management security certificate of the key management system from the certificate authentication center.

[0128] In this way, the key management system obtains the management security certificate of the key management system from the certificate authentication center. In this way, the key management system obtains its own management security certificate, which can be used for encryption and decryption of subsequent processes.

[0129] In some embodiments, receiving a key application package sent by the certificate authentication center includes:

[0130] Receive a key application package sent by the certificate authentication center, where the key application package includes a terminal classical signature public key, a terminal temporary post-quantum encryption public key, a classical signature identifier associated with the terminal classical signature public key, a post-quantum signature identifier associated with the terminal post-quantum signature public key, a first classical signature value, and a first post-quantum signature value.

[0131] In this way, the key management system receives a key application package sent by the certificate authentication center. The key application package includes the terminal's classical signature public key, the terminal's temporary post-quantum encryption public key, the classical signature identifier associated with the terminal's classical signature public key, the post-quantum signature identifier associated with the terminal's post-quantum signature public key, the first classical signature value, and the first post-quantum signature value. In this way, the key management system receives the terminal's classical signature public key, the terminal's temporary post-quantum encryption public key, the classical signature identifier associated with the terminal's classical signature public key, the post-quantum signature identifier associated with the terminal's post-quantum signature public key, the first classical signature value, and the first post-quantum signature value, which can be used in subsequent processes.

[0132] In certain embodiments, the method further comprises:

[0133] Performing signature verification on the first classic signature value according to a classic signature algorithm associated with the terminal classic signature public key to obtain a first signature verification result;

[0134] Performing signature verification on the first post-quantum signature value according to a post-quantum signature algorithm associated with the terminal post-quantum signature public key to obtain a second signature verification result;

[0135] When both the first signature verification result and the second signature verification result are correct, a classical encryption key pair and a post-quantum encryption key pair are generated for the terminal.

[0136] In this way, the key management system verifies the first classic signature value according to the classic signature algorithm associated with the terminal's classic signature public key, and obtains a first verification result. Next, the key management system verifies the first post-quantum signature value according to the post-quantum signature algorithm associated with the terminal's post-quantum signature public key, and obtains a second verification result. Finally, if both the first verification result and the second verification result are correct, the key management system generates a classic encryption key pair and a post-quantum encryption key pair for the terminal. In this way, after multiple verification processes, the key management system confirms that the received key application package is correct, and then generates a classic encryption key pair and a post-quantum encryption key pair for the terminal, which can be used by the subsequent certificate authentication center to generate a security certificate based on the classic encryption key pair and the post-quantum encryption key pair.

[0137] In some embodiments, generating a key response package based on the key request package and sending the key response package to the certificate authentication center includes:

[0138] Generate a first temporary key response packet according to the key request packet;

[0139] Generate a second temporary key response packet based on the first temporary key response packet, the temporary symmetric key randomly generated by the key management system, and the classic encryption key pair;

[0140] Generate a third temporary key response packet based on the second temporary key response packet and the post-quantum encryption key pair;

[0141] Storing the classical signature identifier and the post-quantum signature identifier in the third temporary key response packet to obtain a fourth temporary key response packet;

[0142] Processing the fourth temporary key response packet according to the classical signature algorithm and the post-quantum signature algorithm to obtain the key response packet;

[0143] The key response packet is sent to the certificate authentication center.

[0144] In this way, the key management system generates a first temporary key response package based on the key application package. Next, the key management system generates a second temporary key response package based on the first temporary key response package, the temporary symmetric key randomly generated by the key management system, and the classical encryption key pair. Then, the key management system generates a third temporary key response package based on the second temporary key response package and the post-quantum encryption key pair. The key management system then stores the classical signature identifier and the post-quantum signature identifier in the third temporary key response package to obtain a fourth temporary key response package. Subsequently, the key management system processes the fourth temporary key response package based on the classical signature algorithm and the post-quantum signature algorithm to obtain a key response package. Finally, the key management system sends the key response package to the certificate authentication center. In this way, the key management system performs multiple operations based on the post-quantum cryptographic algorithm, the classical cryptographic algorithm, and other data information to generate a key response package, and the certificate authentication system can generate a security certificate based on the key response package.

[0145] In some embodiments, generating a second temporary key response package based on the first temporary key response package, the temporary symmetric key randomly generated by the key management system, and the classic encryption key pair includes:

[0146] Encrypting the private key in the classic encryption key pair according to the temporary symmetric key to obtain the classic encryption private key in the classic cryptographic envelope;

[0147] Signing the temporary symmetric key according to the terminal classic signature public key to obtain the encrypted temporary symmetric key in the classic cryptographic envelope;

[0148] The public key in the classic encryption key pair and the classic cryptographic envelope are stored in the first temporary key response package to obtain the second temporary key response package.

[0149] In this way, the key management system encrypts the private key in the classic encryption key pair using the temporary symmetric key, obtaining the classic encryption private key in the classic cryptographic envelope. Next, the key management system signs the temporary symmetric key using the terminal's classic signature public key, obtaining the encrypted temporary symmetric key in the classic cryptographic envelope. Finally, the key management system stores the public key in the classic encryption key pair and the classic cryptographic envelope in the first temporary key response package, obtaining the second temporary key response package. In this way, the key management system ensures the security of the private key in the classic encryption key pair during transmission and ensures that only the terminal holding the corresponding private key can decrypt and use the temporary symmetric key.

[0150] In some embodiments, generating a third temporary key response packet based on the second temporary key response packet and the post-quantum encryption key pair includes:

[0151] Concatenate the random number randomly generated by the key management system and the fixed string to obtain a third concatenated body;

[0152] Performing post-quantum encryption on the third spliced ​​body to obtain a first encryption key;

[0153] Performing post-quantum cryptographic encapsulation processing on the third spliced ​​body to obtain a first encapsulated message in a post-quantum cryptographic envelope;

[0154] Encrypting the private key in the post-quantum encryption key pair according to the first encryption key to obtain the post-quantum encryption private key in the post-quantum cryptographic envelope;

[0155] The public key in the post-quantum encryption key pair and the post-quantum cryptographic envelope are stored in the second temporary key response packet to obtain a third temporary key response packet.

[0156] In this way, the key management system concatenates the random number randomly generated by the key management system and the fixed string to obtain a third concatenation. Next, the key management system performs post-quantum encryption processing on the third concatenation to obtain the first encryption key. The key management system then performs post-quantum encryption encapsulation processing on the third concatenation to obtain the first encapsulated message in the post-quantum cryptographic envelope. Then, the key management system encrypts the private key in the post-quantum encryption key pair according to the first encryption key to obtain the post-quantum encryption private key in the post-quantum cryptographic envelope. Finally, the key management system stores the public key and the post-quantum cryptographic envelope in the post-quantum encryption key pair in the second temporary key response package to obtain a third temporary key response package. In this way, the key management system uses the first encryption key generated by the post-quantum encryption algorithm to encrypt the private key in the post-quantum encryption key pair, ensuring the security of the private key in the post-quantum encryption key pair during transmission.

[0157] In some embodiments, processing the fourth temporary key response packet according to the classical signature algorithm and the post-quantum signature algorithm to obtain the key response packet includes:

[0158] Signing the fourth temporary key response packet according to the classic signature algorithm to obtain a second classic signature message;

[0159] Performing post-quantum signature processing on the fourth temporary key response packet according to the post-quantum signature algorithm to obtain a second post-quantum signature message;

[0160] The second classical signature message and the second post-quantum signature message are stored in the fourth temporary key response package to obtain the key response package.

[0161] In this way, the KMC signs the fourth temporary key response package using the classical signature algorithm to obtain a second classical signature message. Next, the KMC performs a post-quantum signature on the fourth temporary key response package using the post-quantum signature algorithm to obtain a second post-quantum signature message. Finally, the KMC stores the second classical signature message and the second post-quantum signature message in the fourth temporary key response package to obtain a key response package. In this way, the KMC processes the fourth temporary key response package using both the post-quantum cryptography algorithm and the classical algorithm to obtain a key response package, ensuring that the key request package is protected from unauthorized access during transmission.

[0162] Additional aspects and advantages of the embodiments of the present application will be given in part in the description below, and in part will become obvious from the description below, or will be learned through practice of the embodiments of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0163] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0164] Figure 1 This is one of the flow charts of the method of the embodiment of the present application;

[0165] Figure 2 It is an architectural diagram of a method for implementing an embodiment of the present application;

[0166] Figure 3 This is the second flow chart of the method of the embodiment of the present application;

[0167] Figure 4 This is the third flow chart of the method of the embodiment of the present application;

[0168] Figure 5 This is the fourth flow chart of the method of the embodiment of the present application;

[0169] Figure 6 This is the fifth flow chart of the method of the embodiment of the present application;

[0170] Figure 7 This is the sixth flow chart of the method of the embodiment of the present application;

[0171] Figure 8 This is the seventh flow chart of the method of the embodiment of the present application;

[0172] Figure 9 This is the eighth flow chart of the method of the embodiment of the present application;

[0173] Figure 10 This is the ninth flow chart of the method according to the embodiment of the present application;

[0174] Figure 11 This is the tenth flowchart of the method of the embodiment of the present application;

[0175] Figure 12 This is the eleventh flow chart of the method of the embodiment of the present application;

[0176] Figure 13 This is the twelfth flow chart of the method of the embodiment of the present application;

[0177] Figure 14 This is the thirteenth flow chart of the method of the embodiment of the present application;

[0178] Figure 15 This is the fourteenth flow chart of the method according to the embodiment of the present application;

[0179] Figure 16 This is the fifteenth flowchart of the method of the embodiment of the present application;

[0180] Figure 17 This is the sixteenth flow chart of the method according to the embodiment of the present application;

[0181] Figure 18 This is the seventeenth flow chart of the method according to the embodiment of the present application;

[0182] Figure 19 This is the eighteenth flow chart of the method of the embodiment of the present application;

[0183] Figure 20 This is the nineteenth flow chart of the method of the embodiment of the present application;

[0184] Figure 21 This is the twentieth flowchart of the method of the embodiment of the present application;

[0185] Figure 22 This is the twenty-first flowchart of the method according to the embodiment of the present application;

[0186] Figure 23 This is the twenty-second flowchart of the method according to the embodiment of the present application;

[0187] Figure 24 This is the twenty-third flow chart of the method according to the embodiment of the present application;

[0188] Figure 25 This is the twenty-fourth flow chart of the method according to the embodiment of the present application;

[0189] Figure 26 This is the twenty-fifth flow chart of the method of the embodiment of the present application;

[0190] Figure 27 This is the twenty-sixth flow chart of the method according to the embodiment of the present application;

[0191] Figure 28 This is the twenty-seventh flow chart of the method according to the embodiment of the present application;

[0192] Figure 29 This is the twenty-eighth flowchart of the method according to the embodiment of the present application;

[0193] Figure 30 This is the twenty-ninth flow chart of the method of the embodiment of the present application;

[0194] Figure 31 It is a signaling diagram of the method of an implementation method of the present application. DETAILED DESCRIPTION

[0195] The embodiments of the present application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the embodiments of the present application, and should not be understood as limiting the embodiments of the present application.

[0196] The leap in computing power, exemplified by quantum computing, has had a significant impact on the security of classical cryptographic algorithms. This means that quantum computing poses a more direct and pressing threat to classical cryptography. For example, Shor's quantum algorithm can solve complex mathematical problems such as large integer factorization and discrete logarithm calculations in polynomial time, enabling rapid cracking of widely used public-key cryptography algorithms such as RSA, ECC, DSA, and ElGamal. Understandably, the realization of large-scale quantum computers will have a certain impact on classical cryptographic applications such as key agreement, encryption, and signatures.

[0197] As a result, the security of the internet, which uses classical cryptographic algorithms to protect communications, is deeply threatened by quantum computing attacks. For example, GM / T0014, "Cryptographic Protocol Specification for Digital Certificate Authentication Systems," defines the cryptographic security protocols involved in digital certificate authentication systems. These protocols include the security protocol between user terminals and registration authorities (RAs); the security protocol between registration authorities (RAs) and certificate authorities (CAs); the security protocol between certificate authorities (CAs) and key management centers (KMs); the security protocol between certificate authorities (CAs) and Lightweight Directory Access Protocol (LDAP); the security protocol between certificate authorities (CAs) and online certificate status protocols (OCSP); the security protocol between user terminals and LDAP services; and the security protocol between user terminals and OCSP services. The security protocol between certificate authorities (CAs) and key management centers (KMs) is particularly important because it protects the transmission of encryption key pairs. The current security protocol defined by GM / T0014 between the Certificate Authority (CA) and the Key Management Center (KM) can only distribute encryption key pairs based on the SM2 algorithm, an ECC elliptic curve algorithm. The protocol interaction process is also based solely on digital signatures and asymmetric encryption and decryption protection based on the SM2 algorithm, lacking quantum computing resistance. If the ECC elliptic curve algorithm is used to distribute encryption key pairs, the signature algorithm itself must also be used for key encapsulation based on asymmetric encryption and decryption, that is, the signature public key is used to protect the private key in the encryption key pair. The commonly used method is to generate a temporary symmetric key to encrypt the private key, and then the signature public key to encrypt the temporary symmetric key. This method is not applicable to post-quantum cryptographic algorithm cryptographic systems with completely different signature and key encapsulation algorithms.

[0198] Currently, international technologies addressing the threat of quantum computing attacks fall into two main categories: one focuses on scenarios where asymmetric algorithms are used for (symmetric) key negotiation and then encrypted via symmetric algorithms for transmission. Research is underway to use quantum key distribution (QKD) networks for symmetric key negotiation and key security. The other focuses on post-quantum cryptography (PQC) algorithms, which are intended to directly replace existing asymmetric algorithms. Quantum key distribution (QKD) leverages the principles of quantum mechanics to generate keys that cannot be eavesdropped by third parties, ensuring secure key transmission. It is particularly well-suited for key exchange scenarios and can replace existing asymmetric key agreement algorithms, such as RSA or ECC, to enhance key security. However, QKD cannot currently completely replace all asymmetric algorithms. For example, scenarios such as signature verification, integrity protection, and non-repudiation still require the use of asymmetric algorithms.

[0199] Post-quantum cryptography is asymmetric cryptographic algorithms designed based on new mathematical problems, intended to mitigate the potential threat posed by quantum computers. NIST has announced the first four proposed standardization algorithms: Kyber, Dilithium, Falcon, and SPHINCS+. These algorithms cover a variety of technical approaches to reduce the risk of a single technology being cracked. In theory, post-quantum cryptography can replace all asymmetric algorithms and be more versatile. However, the security of post-quantum cryptography still depends on the complexity of the computational problems. In the future, they may face new cracking methods or become less secure as computing power increases. Furthermore, the standards for post-quantum cryptography have not yet been officially announced, and the production and certification of related products will take time, so their large-scale application will take a long time.

[0200] Both post-quantum cryptographic algorithms and quantum key distribution technologies have the ability to resist quantum computing attacks, but each has its limitations. Therefore, providing relatively low-cost and highly secure cryptographic technologies that can resist quantum computing attacks has become an urgent problem to be solved.

[0201] Based on the above questions, please refer to Figure 1 The embodiments of the present application provide a method for enhancing quantum security of online certificate issuance and key pair distribution in a communication network. The communication network includes a terminal, a certificate authentication center, and a key management system. The method is applied to the terminal and includes:

[0202] 011: Obtain a first quantum key and a quantum key identifier from a first network node of the access terminal;

[0203] 012: Encrypting the quantum key identifier and the randomly generated terminal key pair according to the first quantum key to obtain a first encrypted message;

[0204] 013: Generate an application message based on the first encrypted message, the terminal key pair, and the quantum key identifier, and send the application message to the certificate authentication center;

[0205] 014: Receive a response message sent by the certificate authentication center, so that the terminal can use the response message to communicate with other terminals in the communication network except the terminal.

[0206] The embodiment of the present application also provides a terminal, including a memory and a processor. The method of the embodiment of the present application can be implemented by the terminal of the embodiment of the present application. Specifically, a computer program is stored in the memory, and the processor is used to obtain a first quantum key and a quantum key identifier from a first network node of the access terminal. And according to the first quantum key, the quantum key identifier and the randomly generated terminal key pair are encrypted to obtain a first encrypted message. And an application message is generated according to the first encrypted message, the terminal key pair and the quantum key identifier, and the application message is sent to a certificate authentication center. The processor is also used to receive a response message sent by the certificate authentication center, so that the terminal can use the response message to communicate with other terminals in the communication network except the terminal.

[0207] The embodiment of the present application also provides a terminal anti-quantum security enhancement device. The method of the embodiment of the present application can be implemented by the terminal anti-quantum security enhancement device of the embodiment of the present application. Specifically, the terminal anti-quantum security enhancement device includes an acquisition module, an encryption module, a derivation module and a receiving module. The acquisition module is used to obtain a first quantum key and a quantum key identifier from the first network node of the access terminal. The encryption module is used to encrypt the quantum key identifier and the randomly generated terminal key pair according to the first quantum key to obtain a first encrypted message. The derivation module is used to generate an application message based on the first encrypted message, the terminal key pair and the quantum key identifier, and send the application message to the certificate authentication center. The receiving module is used to receive a response message sent by the certificate authentication center, so that the terminal can use the response message to communicate with other terminals in the communication network except the terminal.

[0208] The present application provides a communication system based on online certificate issuance and key pair distribution. The communication system includes a terminal, a certificate authentication center, a key management system and a quantum key distribution network according to the above-mentioned embodiment. The quantum key distribution network is configured to distribute quantum keys to the terminal or the certificate authentication center.

[0209] Specifically, a quantum key distribution network (QKD) consists of network nodes and a quantum network link control center. Network nodes are used to store and distribute quantum keys within the QKD network. The QKC can establish quantum key distribution and relay links between network nodes based on their names. These links are used for data transfer and other functions. The QKD network is used to provide services such as quantum key generation, quantum key relay, and quantum key provision.

[0210] See also Figure 2 In some embodiments, a terminal and a certificate authentication center communicate via a secure channel, an encrypted communication path used to securely transmit data, commands, and control information between the terminal and the certificate authentication center. This channel ensures the confidentiality, integrity, and authenticity of data during transmission, preventing unauthorized access and data leakage. The terminal accesses a service node, which acts as a transit station for the terminal to connect to network nodes. This service node is used to inject keys into the terminal and transfer and store quantum keys. When the terminal sends a quantum key request, the network node sends the quantum key generated by the quantum key distribution network to the service node connected to the terminal, which then sends the quantum key to the terminal. The simple process for the terminal and the certificate authentication center to obtain the quantum key is as follows: First, the terminal sends a quantum key request to the service node connected to the terminal. The service node then requests a quantum key from the first network node connected to the service node. The first network node then distributes the quantum key generated based on the quantum key request to the service node, which then distributes the quantum key to the terminal. At the same time, the quantum network link control center synchronizes the second network node of the access certificate authentication center to generate a quantum key. However, this quantum key is not immediately distributed to the access certificate authentication center but is first stored in the network node. The corresponding relationship between the terminal, certificate authentication center, service node, and network node is provided by the control platform.

[0211] It should be noted that the implementation method of this application uses FIPS203 Module-Lattice-based Key-Encapsulation Mechanism Standard as the PQC key encapsulation algorithm and FIPS 204 Module-Lattice-Based Digital Signature Standard as the PQC digital signature algorithm for explanation. The following descriptions of operations related to the PQC algorithm refer to the above FIPS standards. Of course, in other implementations, other algorithms such as the NewHope algorithm, Sidh algorithm, HQC algorithm, etc. can also be used as PQC related algorithms. It should also be noted that the embodiments of this application are aimed at the process of a terminal obtaining a security certificate from a certificate authentication center, and the security protocol between the certificate authentication center CA and the key management system KM defined in GM / T0050 "Technical Specifications for Cryptographic Device Management", hereinafter referred to as the KM security protocol.

[0212] Specifically, the terminal obtains a first quantum key and quantum key identifier from a first network node connected to the terminal. The terminal then encrypts the quantum key identifier and a randomly generated terminal key pair using the first quantum key to obtain a first encrypted message. The terminal then generates a request message based on the first encrypted message, the terminal key pair, and the quantum key identifier, and sends the request message to a certificate authentication authority.

[0213] After receiving the application message sent by the terminal, the certificate authentication center performs a series of processing on the application message, generates a key application package based on the application message, and sends the key application package to the key management system.

[0214] After receiving the key application package sent by the certificate authentication center, the management system generates a key response package based on the key application package and sends the key response package to the certificate authentication center.

[0215] After receiving the key response package from the key management system, the certificate authentication center generates a security certificate based on the application message sent by the terminal and the key response package sent by the key management system. It then generates a response message based on the key response package and the security certificate generated by the certificate authentication center in the above process and sends the response message to the terminal, allowing the terminal to use the response message to communicate with other terminals in the communication network.

[0216] Subsequently, the terminal receives a response message sent by the certificate authentication center, so that the terminal can communicate with other terminals in the communication network except the terminal using the response message.

[0217] In summary, in the quantum security enhancement method for online certificate issuance and key pair distribution in a communication network, the communication system, terminal, certificate authentication center, and key management system of the embodiments of the present application, during the communication process in which a terminal obtains a security certificate from a certificate authentication center and a key pair from a key management system, the terminal applies for a first quantum key and uses the first quantum key to encrypt a quantum key identifier and a terminal key pair to generate a first encrypted message that is resistant to quantum computing attacks. The first quantum key has good quantum resistance. Next, the terminal generates a request message based on the first encrypted message, the terminal key pair, and the quantum key identifier, and sends the request message to the certificate authentication center. The certificate authentication center generates a key request package based on the request message and sends the key request package to the key management system. The key management system processes the key request package using a post-quantum cryptographic algorithm, a series of encryption algorithms designed to resist quantum computing attacks, to obtain a key response package, which it then returns to the certificate authentication center. The certificate authentication center generates a security certificate based on the request message and the key response package sent by the key management system. It then generates a response message based on the security certificate and the key response package and sends it to the terminal. In this way, quantum key distribution technology and post-quantum cryptographic algorithms enhance the terminal's ability to resist quantum computing attacks in the communication process of obtaining security certificates from the certificate authentication center and obtaining key pairs from the key management system.

[0218] See also Figure 3 In some embodiments, step 011 (obtaining a first quantum key and a quantum key identifier from a first network node of an access terminal) includes:

[0219] 0111: Use the service node to inject multiple keys into the terminal's cryptographic module;

[0220] 0112: Send quantum key request to the service node;

[0221] 0113: receiving a quantum key encryption result obtained by the service node encrypting the first quantum key and the quantum key identifier according to the protection key;

[0222] 0114: Decrypt the quantum key encryption result to obtain a first quantum key and a quantum key identifier.

[0223] In certain embodiments, the charging module is configured to charge a plurality of keys into a cryptographic module of a terminal using a service node. The sending module is configured to send a quantum key request to the service node. The receiving module is configured to receive a quantum key encryption result obtained by the service node encrypting a first quantum key and a quantum key identifier using a protection key. The decryption module is configured to decrypt the quantum key encryption result to obtain the first quantum key and the quantum key identifier.

[0224] In certain embodiments, the processor is further configured to use the service node to inject multiple keys into the terminal's cryptographic module, and to send a quantum key request to the service node. The processor is further configured to receive a quantum key encryption result obtained by the service node encrypting the first quantum key and the quantum key identifier using the protection key, and to decrypt the quantum key encryption result to obtain the first quantum key and the quantum key identifier.

[0225] Specifically, the terminal uses the service node to inject multiple keys into its cryptographic module. Next, based on the authorization code received from the certificate authority, the terminal sends a quantum key request to the service node. This quantum key request is protected by a protection key, which is a randomly selected key from the multiple keys injected into the cryptographic module. The terminal then receives the quantum key encryption result, obtained by encrypting the first quantum key generated and distributed to the service node by the first network node connected to the service node using the protection key. Finally, the terminal decrypts the quantum key encryption result to obtain the first quantum key.

[0226] In this way, the terminal obtains the first quantum key and quantum key identifier, which can be used to subsequently generate keys that are more resistant to quantum computing attacks.

[0227] See also Figure 4 In some embodiments, step 012 (encrypting the quantum key identifier and the randomly generated terminal key pair according to the first quantum key to obtain a first encrypted message) includes:

[0228] 0121: Randomly generate a terminal key pair based on the terminal's cryptographic module;

[0229] 0122: Concatenate the terminal public key and the quantum key identifier to obtain a first concatenation;

[0230] 0123: Encrypt the first spliced ​​body according to the first quantum key to obtain a first encrypted message.

[0231] In certain embodiments, the derivation module is configured to randomly generate a terminal key pair based on a cryptographic module of the terminal. The concatenation module is configured to concatenate the terminal public key and the quantum key identifier to obtain a first concatenation. The encryption module is configured to encrypt the first concatenation based on the first quantum key to obtain a first encrypted message.

[0232] In some embodiments, the processor is further configured to randomly generate a terminal key pair based on a cryptographic module of the terminal, concatenate the terminal public key and the quantum key identifier to obtain a first concatenation, and encrypt the first concatenation based on the first quantum key to obtain a first encrypted message.

[0233] Specifically, the terminal randomly generates a terminal key pair based on its cryptographic module. The terminal key pair includes a terminal classical signature key pair, a terminal post-quantum signature key pair, and a terminal post-quantum encryption key pair. Next, the terminal concatenates the terminal public key and the quantum key identifier to obtain a first concatenation. The terminal public key includes the terminal classical signature public key of the terminal classical signature key pair, the terminal post-quantum signature public key of the terminal post-quantum signature key pair, and the terminal temporary post-quantum encryption public key of the terminal post-quantum encryption key pair. Finally, the terminal encrypts the first concatenation using the first quantum key to obtain a first encrypted message.

[0234] In this way, the terminal randomly generates a terminal key pair through the terminal's cryptographic module, which can be used for various subsequent signature processing and can use the terminal key pair to generate a security certificate. It also obtains a first encrypted message, which can be used by the subsequent certificate authentication center to verify the accuracy of the data information sent by the terminal.

[0235] See also Figure 5 In some embodiments, the security certificate includes a classic encryption certificate, a first classic encryption certificate signature, and a second classic encryption certificate signature, and the method further includes:

[0236] 015: Verify the signature of the first classic encryption certificate according to the terminal classic signature public key to obtain the first classic encryption certificate verification result;

[0237] 016: Verify the signature of the second classical encryption certificate according to the terminal post-quantum signature public key to obtain the second classical encryption certificate verification result;

[0238] 017: If the signature verification results of the first and second classic encryption certificates are correct, confirm that the classic encryption certificate is correct.

[0239] In certain embodiments, the signature verification module is configured to verify the signature of the first classical encryption certificate using the terminal's classical signature public key to obtain a first classical encryption certificate verification result. Furthermore, the signature verification module is configured to verify the signature of the second classical encryption certificate using the terminal's post-quantum signature public key to obtain a second classical encryption certificate verification result. The confirmation module is further configured to confirm the validity of the classical encryption certificate if the first classical encryption certificate verification result and the second classical encryption certificate verification result are correct.

[0240] In certain embodiments, the processor is further configured to verify the signature of the first classical encryption certificate using the terminal's classical signature public key to obtain a first classical encryption certificate verification result. Furthermore, the processor is configured to verify the signature of the second classical encryption certificate using the terminal's post-quantum signature public key to obtain a second classical encryption certificate verification result. Furthermore, if the first classical encryption certificate verification result and the second classical encryption certificate verification result are correct, confirming that the classical encryption certificate is correct.

[0241] Specifically, the terminal verifies the signature of the first classical encryption certificate using the terminal's classical signature public key to obtain a first classical encryption certificate verification result. Next, the terminal verifies the signature of the second classical encryption certificate using the terminal's post-quantum signature public key to obtain a second classical encryption certificate verification result. Finally, if the verification results of the first and second classical encryption certificates are correct, the classical encryption certificate is confirmed to be correct.

[0242] In this way, the terminal verifies the signatures of the first and second classic encryption certificates respectively, determines the correctness of the classic encryption certificates based on the verification results, and ensures that the correct classic encryption certificates are obtained so that the terminal's communications can be encrypted.

[0243] See also Figure 6 In some embodiments, the security certificate includes a classic signing certificate, a first classic signing certificate signature, and a second classic signing certificate signature, and the method further includes:

[0244] 018: Verify the signature of the first classic signature certificate according to the terminal classic signature public key to obtain the first classic signature certificate verification result;

[0245] 019: Verify the signature of the second classical signature certificate according to the terminal post-quantum signature public key to obtain the second classical signature certificate verification result;

[0246] 020: If the verification results of the first and second classic signature certificates are correct, confirm that the classic signature certificate is correct.

[0247] In certain embodiments, the signature verification module is configured to verify the signature of the first classic signature certificate using the terminal's classic signature public key to obtain a first classic signature certificate verification result. Furthermore, the signature verification module is configured to verify the signature of the second classic signature certificate using the terminal's post-quantum signature public key to obtain a second classic signature certificate verification result. The confirmation module is further configured to confirm the correctness of the classic signature certificate if the verification results of the first and second classic signature certificates are correct.

[0248] In certain embodiments, the processor is further configured to verify the signature of the first classic signature certificate using the terminal's classic signature public key to obtain a first classic signature certificate verification result. Furthermore, the processor is configured to verify the signature of the second classic signature certificate using the terminal's post-quantum signature public key to obtain a second classic signature certificate verification result. Furthermore, if the first classic signature certificate verification result and the second classic signature certificate verification result are correct, confirming that the classic signature certificate is correct.

[0249] Specifically, the terminal verifies the signature of the first classic signature certificate using the terminal's classic signature public key to obtain a first classic signature certificate verification result. Next, the terminal verifies the signature of the second classic signature certificate using the terminal's post-quantum signature public key to obtain a second classic signature certificate verification result. Finally, if the verification results of the first and second classic signature certificates are correct, the classic signature certificate is confirmed to be correct.

[0250] In this way, the terminal verifies the signatures of the first classic signature certificate and the second classic signature certificate respectively, determines the correctness of the classic signature certificate based on the verification result, ensures that the correct classic signature certificate is obtained, and can encrypt the terminal's communication.

[0251] See also Figure 7 In some embodiments, the security certificate includes a post-quantum encryption certificate, a first post-quantum encryption certificate signature, and a second post-quantum encryption certificate signature, and the method further includes:

[0252] 021: Verify the signature of the first post-quantum encryption certificate according to the terminal's classic signature public key to obtain a first post-quantum encryption certificate verification result;

[0253] 022: Verify the signature of the second post-quantum encryption certificate according to the terminal post-quantum signature public key to obtain the second post-quantum encryption certificate verification result;

[0254] 023: If the verification results of the first and second post-quantum encryption certificates are correct, confirm that the post-quantum encryption certificate is correct.

[0255] In certain embodiments, the signature verification module is configured to verify the signature of the first post-quantum encryption certificate using the terminal's classical signature public key to obtain a first post-quantum encryption certificate verification result. Furthermore, the signature verification module is configured to verify the signature of the second post-quantum encryption certificate using the terminal's post-quantum signature public key to obtain a second post-quantum encryption certificate verification result. The confirmation module is further configured to confirm the correctness of the post-quantum encryption certificate if the first and second post-quantum encryption certificate verification results are correct.

[0256] In certain embodiments, the processor is further configured to verify the signature of the first post-quantum encryption certificate using the terminal's classical signature public key to obtain a first post-quantum encryption certificate verification result. Furthermore, the processor is configured to verify the signature of the second post-quantum encryption certificate using the terminal's post-quantum signature public key to obtain a second post-quantum encryption certificate verification result. Furthermore, if the first and second post-quantum encryption certificate verification results are correct, confirming that the post-quantum encryption certificate is correct.

[0257] Specifically, the terminal verifies the signature of the first post-quantum encryption certificate using the terminal's classical signature public key to obtain a first post-quantum encryption certificate verification result. Next, the terminal verifies the signature of the second post-quantum encryption certificate using the terminal's post-quantum signature public key to obtain a second post-quantum encryption certificate verification result. Finally, if the first and second post-quantum encryption certificate verification results are correct, the post-quantum encryption certificate is confirmed to be correct.

[0258] In this way, the terminal verifies the signatures of the first and second post-quantum encryption certificates respectively, determines the correctness of the post-quantum encryption certificates based on the results of the verification, ensures that the correct post-quantum encryption certificates are obtained, and can encrypt the terminal's communications.

[0259] See also Figure 8 In some embodiments, the security certificate includes a post-quantum signature certificate, a first post-quantum signature certificate signature, and a second post-quantum signature certificate signature, and the method further includes:

[0260] 024: Verify the signature of the first post-quantum signature certificate according to the terminal classic signature public key to obtain the first post-quantum signature certificate verification result;

[0261] 025: Verify the signature of the second post-quantum signature certificate according to the terminal post-quantum signature public key to obtain the second post-quantum signature certificate verification result;

[0262] 026: If the verification results of the first post-quantum signature certificate and the second post-quantum signature certificate are correct, confirm that the post-quantum signature certificate is correct.

[0263] In certain embodiments, the signature verification module is configured to verify the signature of the first post-quantum signature certificate using the terminal's classical signature public key to obtain a first post-quantum signature certificate verification result. Furthermore, the signature verification module is configured to verify the signature of the second post-quantum signature certificate using the terminal's post-quantum signature public key to obtain a second post-quantum signature certificate verification result. The confirmation module is further configured to confirm the correctness of the post-quantum signature certificate if the first and second post-quantum signature certificate verification results are correct.

[0264] In certain embodiments, the processor is further configured to verify the signature of the first post-quantum signature certificate using the terminal's classical signature public key to obtain a first post-quantum signature certificate verification result, and to verify the signature of the second post-quantum signature certificate using the terminal's post-quantum signature public key to obtain a second post-quantum signature certificate verification result. Furthermore, if the first and second post-quantum signature certificate verification results are correct, confirming that the post-quantum signature certificate is correct.

[0265] Specifically, the terminal verifies the signature of the first post-quantum signature certificate using the terminal's classical signature public key to obtain a first post-quantum signature certificate verification result. Next, the terminal verifies the signature of the second post-quantum signature certificate using the terminal's post-quantum signature public key to obtain a second post-quantum signature certificate verification result. Finally, if the first and second post-quantum signature certificate verification results are correct, the post-quantum signature certificate is confirmed to be correct.

[0266] In this way, the terminal verifies the signatures of the first post-quantum signature certificate and the second post-quantum signature certificate respectively, determines the correctness of the post-quantum signature certificate according to the result of the verification process, ensures that the correct post-quantum signature certificate is obtained, and can encrypt the terminal's communication.

[0267] See also Figure 9 In some embodiments, the response message includes a first classical cryptographic envelope signature, a first classical cryptographic envelope post-quantum signature, a first post-quantum cryptographic envelope signature, a first post-quantum cryptographic envelope post-quantum signature, an encrypted classical cryptographic envelope, and an encrypted post-quantum cryptographic envelope, and the method further includes:

[0268] 027: Verify the signature of the first classic cryptographic envelope to obtain a first terminal verification result;

[0269] 028: Verify the quantum signature of the first classical cryptographic envelope to obtain the second terminal verification result;

[0270] 029: Verify the signature of the first post-quantum cryptographic envelope and obtain the third terminal's verification result;

[0271] 030: Verify the post-quantum signature of the first post-quantum cryptographic envelope to obtain a fourth terminal verification result;

[0272] 031: When the signature verification results of the first terminal, the second terminal, the third terminal, and the fourth terminal are all correct, decrypt the encrypted classical cryptographic envelope according to the first quantum key to obtain the classical cryptographic envelope;

[0273] 032: Decrypt the encrypted post-quantum cryptographic envelope according to the first quantum key to obtain a post-quantum cryptographic envelope.

[0274] In certain embodiments, the signature verification module is further configured to verify the signature of the first classical cryptographic envelope to obtain a first terminal verification result, verify the signature of the post-quantum signature of the first classical cryptographic envelope to obtain a second terminal verification result, verify the signature of the first post-quantum cryptographic envelope to obtain a third terminal verification result, and verify the signature of the post-quantum signature of the first post-quantum cryptographic envelope to obtain a fourth terminal verification result. The decryption module is configured to decrypt the encrypted classical cryptographic envelope using the first quantum key to obtain a classical cryptographic envelope if the first terminal verification result, the second terminal verification result, the third terminal verification result, and the fourth terminal verification result are all correct, and decrypt the encrypted post-quantum cryptographic envelope using the first quantum key to obtain a post-quantum cryptographic envelope.

[0275] In certain embodiments, the processor is further configured to perform signature verification processing on the signature of the first classical cryptographic envelope to obtain a first terminal signature verification result, perform signature verification processing on the post-quantum signature of the first classical cryptographic envelope to obtain a second terminal signature verification result, perform signature verification processing on the signature of the first post-quantum cryptographic envelope to obtain a third terminal signature verification result, and perform signature verification processing on the post-quantum signature of the first post-quantum cryptographic envelope to obtain a fourth terminal signature verification result. The processor is further configured to, if the first terminal verification result, the second terminal verification result, the third terminal verification result, and the fourth terminal verification result are all correct, decrypt the encrypted classical cryptographic envelope using the first quantum key to obtain a classical cryptographic envelope, and decrypt the encrypted post-quantum cryptographic envelope using the first quantum key to obtain a post-quantum cryptographic envelope.

[0276] Specifically, the terminal verifies the signature of the first classical cryptographic envelope to obtain a first terminal verification result. Next, the terminal verifies the post-quantum signature of the first classical cryptographic envelope to obtain a second terminal verification result. The terminal further verifies the signature of the first post-quantum cryptographic envelope to obtain a third terminal verification result. The terminal also verifies the post-quantum signature of the first post-quantum cryptographic envelope to obtain a fourth terminal verification result. Then, if the first, second, third, and fourth terminal verification results are all correct, the terminal decrypts the encrypted classical cryptographic envelope using the first quantum key to obtain a classical cryptographic envelope. Finally, the terminal decrypts the encrypted post-quantum cryptographic envelope using the first quantum key to obtain a post-quantum cryptographic envelope.

[0277] In this way, after multiple signature verifications, the terminal confirms that the encrypted classical cryptographic envelope and the encrypted post-quantum cryptographic envelope are correct. The terminal then decrypts the encrypted classical cryptographic envelope and the encrypted post-quantum cryptographic envelope using the first quantum key to obtain the classical cryptographic envelope and the post-quantum cryptographic envelope, respectively. In subsequent processes, the terminal can use these classical cryptographic envelopes and the post-quantum cryptographic envelopes to obtain multiple private keys generated for the terminal by the key management system.

[0278] See also Figure 10 In certain embodiments, the method further comprises:

[0279] 033: Decrypt the encrypted temporary symmetric key in the classic cryptographic envelope using the private key in the terminal's classic signature key pair to obtain a temporary symmetric key.

[0280] 034: Decrypt the classic encryption private key in the classic cryptographic envelope using the temporary symmetric key to obtain the private key in the classic encryption key pair.

[0281] In some embodiments, the decryption module is further configured to decrypt the encrypted temporary symmetric key in the classic cryptographic envelope using the private key in the terminal's classic signature key pair to obtain a temporary symmetric key, and to decrypt the classic encryption private key in the classic cryptographic envelope using the temporary symmetric key to obtain the private key in the classic encryption key pair.

[0282] In some embodiments, the processor is further configured to decrypt the encrypted temporary symmetric key in the classic cryptographic envelope using the private key in the terminal's classic signature key pair to obtain a temporary symmetric key, and decrypt the classic encryption private key in the classic cryptographic envelope using the temporary symmetric key to obtain the private key in the classic encryption key pair.

[0283] Specifically, the terminal decrypts the encrypted temporary symmetric key in the classic cryptographic envelope using the private key in the terminal's classic signature key pair to obtain the temporary symmetric key. The terminal then decrypts the classic encryption private key in the classic cryptographic envelope using the temporary symmetric key to obtain the private key in the classic encryption key pair.

[0284] In this way, the terminal obtains the private key in the classic encryption key pair, which can be used in the terminal's communication process to encrypt and decrypt data.

[0285] See also Figure 11 In certain embodiments, the method further comprises:

[0286] 035: Decapsulate the first encapsulated message in the post-quantum cryptographic envelope to obtain a second spliced ​​body;

[0287] 036: Obtain a fixed string based on the second concatenation to confirm the correctness of the post-quantum cryptographic envelope;

[0288] 037: If the post-quantum cryptographic envelope is correct, perform post-quantum encryption on the first spliced ​​body to obtain a first encryption key;

[0289] 038: Decrypt the post-quantum encryption private key in the post-quantum cryptographic envelope according to the first encryption key to obtain the private key in the post-quantum encryption key pair.

[0290] In certain embodiments, the decapsulation module is further configured to decapsulate the first encapsulated message in the post-quantum cryptographic envelope to obtain a second concatenation. The processing module is configured to obtain a fixed string based on the second concatenation to confirm the correctness of the post-quantum cryptographic envelope. The encryption module is further configured to, if the post-quantum cryptographic envelope is correct, perform post-quantum encryption on the first concatenation to obtain a first encryption key. The decryption module is configured to decrypt the post-quantum encryption private key in the post-quantum cryptographic envelope using the first encryption key to obtain the private key of the post-quantum encryption key pair.

[0291] In certain embodiments, the processor is further configured to decapsulate the first encapsulated message in the post-quantum cryptographic envelope to obtain a second concatenation, and to obtain a fixed string based on the second concatenation to confirm the correctness of the post-quantum cryptographic envelope. If the post-quantum cryptographic envelope is correct, the processor is further configured to perform post-quantum encryption on the first concatenation to obtain a first encryption key, and to decrypt the post-quantum encryption private key in the post-quantum cryptographic envelope using the first encryption key to obtain the private key of the post-quantum encryption key pair.

[0292] Specifically, the terminal decrypts the first encapsulated message in the post-quantum cryptographic envelope to obtain a second concatenation. Next, the terminal obtains a fixed string from the second concatenation to confirm the correctness of the post-quantum cryptographic envelope. If the post-quantum cryptographic envelope is correct, the terminal performs post-quantum encryption on the first concatenation to obtain a first encryption key. The terminal then decrypts the post-quantum encrypted private key in the post-quantum cryptographic envelope using the first encryption key to obtain the private key in the post-quantum encryption key pair.

[0293] In this way, the terminal obtains the private key in the quantum encryption key pair, which can be used in the terminal's communication process to encrypt and decrypt data.

[0294] See also Figure 12 The embodiments of the present application provide a method for enhancing quantum security of online certificate issuance and key pair distribution in a communication network. The communication network includes a terminal, a certificate authentication center, and a key management system. The method is used in the certificate authentication center and includes:

[0295] 040: receiving the application message sent by the terminal;

[0296] 041: Generate a key application package based on the application message and send the key application package to the key management system;

[0297] 042: Receive the key response packet sent by the key management system;

[0298] 043: Generate a security certificate based on the application message and key response package;

[0299] 044: Generate a response message according to the key response package and the security certificate, and send the response message to the terminal, so that the terminal can use the response message to communicate with other terminals in the communication network except the terminal.

[0300] The embodiment of the present application also provides a certificate authentication center, including a memory and a processor. The method of the embodiment of the present application can be implemented by the certificate authentication center of the embodiment of the present application. Specifically, a computer program is stored in the memory, and the processor is used to receive an application message sent by a terminal. And generate a key application package based on the application message, and send the key application package to the key management system. The processor is also used to receive a key response package sent by the key management system. And generate a security certificate based on the application message and the key response package. And generate a response message based on the key response package and the security certificate, and send the response message to the terminal, so that the terminal can use the response message to communicate with other terminals in the communication network except the terminal.

[0301] The embodiment of the present application also provides a certificate authentication center anti-quantum security enhancement device. The method of the embodiment of the present application can be implemented by the certificate authentication center anti-quantum security enhancement device of the embodiment of the present application. Specifically, the certificate authentication center anti-quantum security enhancement device includes a receiving module and a derivation module. The receiving module is used to receive an application message sent by a terminal. The receiving module is used to receive a first encryption result of post-quantum cryptographic encryption processing of a quantum key identifier by the terminal. The derivation module is used to generate a key application package based on the application message. The receiving module is also used to receive a key response package sent by a key management system, and the key response package is generated by the key management system based on the key application package. The derivation module is used to generate a security certificate based on the application message and the key response package. And generate a response message based on the key response package and the security certificate, and send the response message to the terminal, so that the terminal can use the response message to communicate with other terminals in the communication network except the terminal.

[0302] Specifically, the anti-quantum security enhancement method of this embodiment is basically the same as the anti-quantum security enhancement method of the aforementioned embodiment with the terminal as the execution object. For details, please refer to the explanation of the corresponding part. The difference is that this embodiment takes the certificate authentication center as the execution object, which will not be repeated here.

[0303] In summary, in the quantum security enhancement method for online certificate issuance and key pair distribution in a communication network, the communication system, terminal, certificate authentication center, and key management system of the embodiments of the present application, during the communication process in which a terminal obtains a security certificate from a certificate authentication center and a key pair from a key management system, the terminal applies for a first quantum key and uses the first quantum key to encrypt a quantum key identifier and a terminal key pair to generate a first encrypted message that is resistant to quantum computing attacks. The first quantum key has good quantum resistance. Next, the terminal generates a request message based on the first encrypted message, the terminal key pair, and the quantum key identifier, and sends the request message to the certificate authentication center. The certificate authentication center generates a key request package based on the request message and sends the key request package to the key management system. The key management system processes the key request package using a post-quantum cryptographic algorithm, a series of encryption algorithms designed to resist quantum computing attacks, to obtain a key response package, which it then returns to the certificate authentication center. The certificate authentication center generates a security certificate based on the request message and the key response package sent by the key management system. It then generates a response message based on the security certificate and the key response package and sends it to the terminal. In this way, quantum key distribution technology and post-quantum cryptographic algorithms enhance the terminal's ability to resist quantum computing attacks in the communication process of obtaining security certificates from the certificate authentication center and obtaining key pairs from the key management system.

[0304] See also Figure 13 In certain embodiments, the method further comprises:

[0305] 045: Access the second network node through the pre-established channel;

[0306] 046: Security certificate issued by the certificate authority.

[0307] In some embodiments, the access module is configured to access the second network node via a pre-established channel. The issuing module is configured to issue a security certificate of a certificate authentication center.

[0308] In some embodiments, the processor is further configured to access the second network node through a pre-established channel and issue a security certificate of a certificate authentication center.

[0309] Specifically, the certificate authentication center accesses the second network node through a pre-established channel and then issues a security certificate of the certificate authentication center.

[0310] In this way, the certificate authentication center can access the network node through the channel and obtain the second quantum key. In addition, the certificate authentication center also issues its own security certificate, which can be used for encryption and decryption in subsequent processes.

[0311] See also Figure 14In certain embodiments, the method further comprises:

[0312] 047: Sending a quantum key application to a second network node of the access certificate authentication center according to the quantum key identifier;

[0313] 048: Receive the second quantum key distributed by the second network node according to the quantum key application.

[0314] In some embodiments, the sending module is further configured to send a quantum key application to a second network node of an access certificate authentication center based on the quantum key identifier. The receiving module is further configured to receive a second quantum key distributed by the second network node based on the quantum key application.

[0315] In some embodiments, the processor is further configured to send a quantum key application to a second network node of an access certificate authentication center based on the quantum key identifier, and receive a second quantum key distributed by the second network node based on the quantum key application.

[0316] Specifically, the certificate authentication center sends a quantum key application to a second network node connected to the certificate authentication center based on the quantum key identifier. Then, the certificate authentication center receives the second quantum key distributed by the second network node based on the quantum key application.

[0317] In this way, the certificate authentication center obtains the second quantum key, which has good quantum resistance and can be used in subsequent processes, making it have good quantum resistance.

[0318] See also Figure 15 In some embodiments, the application message includes a first encrypted message, a terminal classical signature key pair, a terminal post-quantum signature key pair, a terminal post-quantum encryption key pair, and a quantum key identifier, and the method further includes:

[0319] 049: Concatenate the terminal classic signature public key in the terminal classic signature key pair, the terminal post-quantum signature public key in the terminal post-quantum signature key pair, the terminal temporary post-quantum encryption public key in the terminal post-quantum encryption key pair, and the quantum key identifier to obtain a second concatenation;

[0320] 050: Encrypting the second spliced ​​body according to the second quantum key to obtain a second encrypted message;

[0321] 051: Confirm the correctness of the received terminal classical signature public key, terminal post-quantum signature public key, terminal temporary post-quantum encryption public key and quantum key identifier based on the second encrypted message and the first encrypted message.

[0322] In certain embodiments, the splicing module is further configured to splice the terminal classical signature public key in the terminal classical signature key pair, the terminal post-quantum signature public key in the terminal post-quantum signature key pair, the terminal temporary post-quantum encryption public key in the terminal post-quantum encryption key pair, and the quantum key identifier to obtain a second spliced ​​body. The encryption module is further configured to encrypt the second spliced ​​body according to the second quantum key to obtain a second encrypted message. The confirmation module is configured to confirm the correctness of the received terminal classical signature public key, terminal post-quantum signature public key, terminal temporary post-quantum encryption public key, and quantum key identifier based on the second encrypted message and the first encrypted message.

[0323] In certain embodiments, the processor is further configured to concatenate the terminal classical signature public key in the terminal classical signature key pair, the terminal post-quantum signature public key in the terminal post-quantum signature key pair, the terminal temporary post-quantum encryption public key in the terminal post-quantum encryption key pair, and the quantum key identifier to obtain a second concatenation, encrypt the second concatenation according to the second quantum key to obtain a second encrypted message, and confirm the correctness of the received terminal classical signature public key, terminal post-quantum signature public key, terminal temporary post-quantum encryption public key, and quantum key identifier based on the second encrypted message and the first encrypted message.

[0324] Specifically, the certificate authentication center concatenates the terminal classical signature public key in the terminal classical signature key pair, the terminal post-quantum signature public key in the terminal post-quantum signature key pair, the terminal temporary post-quantum encryption public key in the terminal post-quantum encryption key pair, and the quantum key identifier to obtain a second concatenation. The certificate authentication center then encrypts the second concatenation using the second quantum key to obtain a second encrypted message. Finally, the certificate authentication center verifies the correctness of the received terminal classical signature public key, terminal post-quantum signature public key, terminal temporary post-quantum encryption public key, and quantum key identifier based on the second encrypted message and the first encrypted message.

[0325] In this way, the certificate authentication center can confirm the accuracy of the message received by the certificate authentication center based on the second spliced ​​body generated by the certificate authentication center and the first spliced ​​body generated by the terminal.

[0326] See also Figure 16 In some embodiments, step 041 (generating a key application package based on the application message and sending the key application package to the key management system) includes:

[0327] 0411: Generate the first temporary key application package;

[0328] 0412: Store the terminal classic signature public key and the terminal temporary post-quantum encryption public key in the first temporary key application package to obtain a second temporary key application package;

[0329] 0413: Storing the classic signature identifier associated with the terminal classic signature public key and the post-quantum signature identifier associated with the terminal post-quantum signature public key in the second temporary key application package to obtain a third temporary key application package;

[0330] 0414: Sign the third temporary key application package according to the classic signature algorithm associated with the terminal classic signature public key to obtain a first classic signature value;

[0331] 0415: Signing the third temporary key application package according to the post-quantum signature algorithm associated with the terminal post-quantum signature public key to obtain a first post-quantum signature value;

[0332] 0416: Storing the first classical signature value and the first post-quantum signature value in a third temporary key application package to obtain a key application package;

[0333] 0417: Send the key application package to the key management system.

[0334] In certain embodiments, the derivation module is used to generate a first temporary key application package. The storage module is used to store the terminal classical signature public key and the terminal temporary post-quantum encryption public key in the first temporary key application package to obtain a second temporary key application package. And the classical signature identifier associated with the terminal classical signature public key and the post-quantum signature identifier associated with the terminal post-quantum signature public key are stored in the second temporary key application package to obtain a third temporary key application package. The signature module is used to sign the third temporary key application package according to the classical signature algorithm associated with the terminal classical signature public key to obtain a first classical signature value. And the third temporary key application package is signed according to the post-quantum signature algorithm associated with the terminal post-quantum signature public key to obtain a first post-quantum signature value. The storage module is also used to store the first classical signature value and the first post-quantum signature value in the third temporary key application package to obtain a key application package. The sending module is also used to send the key application package to the key management system.

[0335] In certain embodiments, the processor is further configured to generate a first temporary key application package. The terminal classical signature public key and the terminal temporary post-quantum encryption public key are stored in the first temporary key application package to obtain a second temporary key application package. The classical signature identifier associated with the terminal classical signature public key and the post-quantum signature identifier associated with the terminal post-quantum signature public key are stored in the second temporary key application package to obtain a third temporary key application package. The processor is further configured to sign the third temporary key application package according to the classical signature algorithm associated with the terminal classical signature public key to obtain a first classical signature value. The processor is further configured to sign the third temporary key application package according to the post-quantum signature algorithm associated with the terminal post-quantum signature public key to obtain a first post-quantum signature value. The processor is further configured to store the first classical signature value and the first post-quantum signature value in the third temporary key application package to obtain a key application package and send the key application package to the key management system.

[0336] Specifically, the certificate authentication center generates a first temporary key application package. Then, the certificate authentication center stores the terminal classic signature public key and the terminal temporary post-quantum encryption public key in the first temporary key application package to obtain a second temporary key application package. Then, the certificate authentication center stores the classic signature identifier associated with the terminal classic signature public key and the post-quantum signature identifier associated with the terminal post-quantum signature public key in the second temporary key application package to obtain a third temporary key application package. Subsequently, the certificate authentication center signs the third temporary key application package according to the classic signature algorithm associated with the terminal classic signature public key to obtain a first classic signature value. And signs the third temporary key application package according to the post-quantum signature algorithm associated with the terminal post-quantum signature public key to obtain a first post-quantum signature value. Finally, the certificate authentication center stores the first classic signature value and the first post-quantum signature value in the third temporary key application package to obtain a key application package. And sends the key application package to the key management system.

[0337] In this way, the first temporary key application package storing the terminal classical signature public key and the terminal temporary post-quantum encryption public key is processed layer by layer by the post-quantum cryptography algorithm to obtain a key application package. The key application package has good quantum resistance, and the key management system can ensure that the key application package is not unauthorizedly accessed during transmission based on the first classical signature value and the first post-quantum signature value on the key application package.

[0338] See also Figure 17 In some embodiments, the key application package includes a second classical signature message and a second post-quantum signature message. Step 043 (generating a security certificate based on the application message and the key response package) includes:

[0339] 0431: Upon receiving the key response packet sent by the key management system, verify the second classic signature message according to the classic signature algorithm to obtain a second classic signature verification result;

[0340] 0432: Verify the second post-quantum signature message according to the post-quantum signature algorithm to obtain a second post-quantum signature verification result;

[0341] 0433: If both the second classical signature verification result and the second post-quantum signature verification result are correct, obtain the public key in the classical encryption key pair and the public key in the post-quantum encryption key pair from the key response packet;

[0342] 0434: Generates a classic signature certificate in the security certificate for the terminal based on the terminal's classic signature public key;

[0343] 0435: Generates a classic encryption certificate for the terminal based on the public key in the classic encryption key pair.

[0344] 0436: Generate a post-quantum signature certificate in the security certificate for the terminal based on the terminal's post-quantum signature public key;

[0345] 0437: Generates a post-quantum encryption certificate in a security certificate for the terminal based on the public key in the post-quantum encryption key pair.

[0346] In certain embodiments, the signature verification module is configured to, upon receiving a key response packet sent by the key management system, perform signature verification processing on the second classical signature message according to the classical signature algorithm to obtain a second classical signature verification result. And perform signature verification processing on the second post-quantum signature message according to the post-quantum signature algorithm to obtain a second post-quantum signature verification result. The acquisition module is configured to, when both the second classical signature verification result and the second post-quantum signature verification result are correct, obtain the public key in the classical encryption key pair and the public key in the post-quantum encryption key pair from the key response packet. The derivation module is configured to generate a classical signature certificate in a security certificate for the terminal based on the classical signature public key of the terminal. And generate a classical encryption certificate in a security certificate for the terminal based on the public key in the classical encryption key pair. And generate a post-quantum signature certificate in a security certificate for the terminal based on the post-quantum signature public key of the terminal and generate a post-quantum encryption certificate in a security certificate for the terminal based on the public key in the post-quantum encryption key pair.

[0347] In certain embodiments, the processor is further configured to, upon receiving a key response packet sent by the key management system, perform signature verification processing on the second classical signature message according to the classical signature algorithm to obtain a second classical signature verification result. And perform signature verification processing on the second post-quantum signature message according to the post-quantum signature algorithm to obtain a second post-quantum signature verification result. And, when both the second classical signature verification result and the second post-quantum signature verification result are correct, obtain the public key in the classical encryption key pair and the public key in the post-quantum encryption key pair from the key response packet. The processor is further configured to generate a classical signature certificate in a security certificate for the terminal based on the classical signature public key of the terminal. And generate a classical encryption certificate in a security certificate for the terminal based on the public key in the classical encryption key pair. And generate a post-quantum signature certificate in a security certificate for the terminal based on the post-quantum signature public key of the terminal and generate a post-quantum encryption certificate in a security certificate for the terminal based on the public key in the post-quantum encryption key pair.

[0348] Specifically, upon receiving the key response package sent by the key management system, the certificate authentication center verifies the second classical signature message according to the classical signature algorithm to obtain a second classical signature result. And verifies the second post-quantum signature message according to the post-quantum signature algorithm to obtain a second post-quantum signature result. Then, if both the second classical signature result and the second post-quantum signature result are correct, the certificate authentication center obtains the public key in the classical encryption key pair and the public key in the post-quantum encryption key pair from the key response package. Then, the certificate authentication center generates a classical signature certificate in the security certificate for the terminal based on the classical signature public key of the terminal. And generates a classical encryption certificate in the security certificate for the terminal based on the public key in the classical encryption key pair. And generates a post-quantum signature certificate in the security certificate for the terminal based on the post-quantum signature public key of the terminal. And generates a post-quantum encryption certificate in the security certificate for the terminal based on the public key in the post-quantum encryption key pair.

[0349] In this way, after confirming that the signature verification results are correct multiple times, the certificate authentication center obtains the terminal's signature certificate, encryption certificate, post-quantum signature certificate and post-quantum encryption certificate. These certificates can be used for terminal communication and protect data during terminal communication.

[0350] See also Figure 18 In certain embodiments, the method further comprises:

[0351] 052: Sign the classic encryption certificate using the private key in the terminal classic signature key pair to obtain the first classic encryption certificate signature in the security certificate;

[0352] 053: Sign the classical encryption certificate according to the private key in the terminal post-quantum signature key pair to obtain the second classical encryption certificate signature in the security certificate.

[0353] In certain embodiments, the signature module is configured to sign the classical encryption certificate using the private key in the terminal's classical signature key pair to obtain a first classical encryption certificate signature in the security certificate. The signature module is further configured to sign the classical encryption certificate using the private key in the terminal's post-quantum signature key pair to obtain a second classical encryption certificate signature in the security certificate.

[0354] In some embodiments, the processor is further configured to sign the classical encryption certificate using the private key in the terminal's classical signature key pair to obtain a first classical encryption certificate signature in the security certificate, and to sign the classical encryption certificate using the private key in the terminal's post-quantum signature key pair to obtain a second classical encryption certificate signature in the security certificate.

[0355] Specifically, the certificate authentication center signs the classic encryption certificate using the private key in the terminal's classic signature key pair to obtain the first classic encryption certificate signature in the security certificate. Next, the certificate authentication center signs the classic encryption certificate using the private key in the terminal's post-quantum signature key pair to obtain the second classic encryption certificate signature in the security certificate.

[0356] In this way, the certificate authentication center obtains the first and second signatures of the classical encryption certificate, which can be used to verify the accuracy of the classical encryption certificate and confirm that the classical encryption certificate has not been accessed by unauthorized persons during transmission. Furthermore, the second signature of the classical encryption certificate obtained by signing the classical encryption certificate with the private key of the terminal's post-quantum signature key pair also has good quantum resistance.

[0357] See also Figure 19 In certain embodiments, the method further comprises:

[0358] 054: Sign the classic signature certificate according to the private key in the terminal classic signature key pair to obtain the first classic signature certificate signature in the security certificate;

[0359] 055: Sign the classic signature certificate according to the private key in the terminal post-quantum signature key pair to obtain the second classic signature certificate signature in the security certificate.

[0360] In certain embodiments, the signature module is configured to sign the classic signature certificate using the private key in the terminal's classic signature key pair to obtain a first classic signature certificate signature in the security certificate. The signature module is further configured to sign the classic signature certificate using the private key in the terminal's post-quantum signature key pair to obtain a second classic signature certificate signature in the security certificate.

[0361] In some embodiments, the processor is further configured to sign the classic signature certificate using the private key in the terminal's classic signature key pair to obtain a first classic signature certificate signature in the security certificate, and to sign the classic signature certificate using the private key in the terminal's post-quantum signature key pair to obtain a second classic signature certificate signature in the security certificate.

[0362] Specifically, the certificate authentication center signs the classic signature certificate using the private key in the terminal's classic signature key pair to obtain the first classic signature certificate signature in the security certificate. Next, the certificate authentication center signs the classic signature certificate using the private key in the terminal's post-quantum signature key pair to obtain the second classic signature certificate signature in the security certificate.

[0363] In this way, the certificate authority obtains the first and second signatures of the classic signature certificate, which can be used to verify the accuracy of the classic signature certificate and confirm that the classic signature certificate has not been accessed by unauthorized persons during transmission. Furthermore, the second signature of the classic signature certificate in the security certificate obtained by signing the classic signature certificate with the private key of the terminal's post-quantum signature key pair also has good quantum resistance.

[0364] See also Figure 20 In certain embodiments, the method further comprises:

[0365] 056: Sign the post-quantum encryption certificate according to the private key in the terminal classic signature key pair to obtain the first post-quantum encryption certificate signature in the security certificate;

[0366] 057: Sign the post-quantum encryption certificate according to the private key in the terminal post-quantum signature key pair to obtain the second post-quantum encryption certificate signature in the security certificate.

[0367] In certain embodiments, the signature module is configured to sign the post-quantum encryption certificate using the private key in the terminal's classical signature key pair to obtain a first post-quantum encryption certificate signature in the security certificate. The signature module is further configured to sign the post-quantum encryption certificate using the private key in the terminal's post-quantum signature key pair to obtain a second post-quantum encryption certificate signature in the security certificate.

[0368] In certain embodiments, the processor is further configured to sign the post-quantum encryption certificate using the private key in the terminal's classical signature key pair to obtain a first post-quantum encryption certificate signature in the security certificate, and to sign the post-quantum encryption certificate using the private key in the terminal's post-quantum signature key pair to obtain a second post-quantum encryption certificate signature in the security certificate.

[0369] Specifically, the certificate authentication center signs the post-quantum encryption certificate using the private key in the terminal's classical signature key pair to obtain the first post-quantum encryption certificate signature in the security certificate. Next, the certificate authentication center signs the post-quantum encryption certificate using the private key in the terminal's post-quantum signature key pair to obtain the second post-quantum encryption certificate signature in the security certificate.

[0370] In this way, the certificate authentication center obtains the first and second post-quantum encryption certificate signatures, which can be used to verify the accuracy of the post-quantum encryption certificate and confirm that the post-quantum encryption certificate has not been accessed by unauthorized persons during transmission. Furthermore, the second post-quantum encryption certificate signature in the security certificate obtained by signing the post-quantum encryption certificate with the private key of the terminal's post-quantum signature key pair also has good quantum resistance.

[0371] See also Figure 21 In certain embodiments, the method further comprises:

[0372] 058: Sign the post-quantum signature certificate according to the private key in the terminal classic signature key pair to obtain the first post-quantum signature certificate signature in the security certificate;

[0373] 059: Sign the post-quantum signature certificate according to the private key in the terminal post-quantum signature key pair to obtain the second post-quantum signature certificate signature in the security certificate.

[0374] In certain embodiments, the signature module is configured to sign the post-quantum signature certificate using the private key in the terminal's classical signature key pair to obtain a first post-quantum signature certificate signature in the security certificate. The signature module is further configured to sign the post-quantum signature certificate using the private key in the terminal's post-quantum signature key pair to obtain a second post-quantum signature certificate signature in the security certificate.

[0375] In certain embodiments, the processor is further configured to sign the post-quantum signature certificate using the private key in the terminal's classical signature key pair to obtain a first post-quantum signature certificate signature in the security certificate, and to sign the post-quantum signature certificate using the private key in the terminal's post-quantum signature key pair to obtain a second post-quantum signature certificate signature in the security certificate.

[0376] Specifically, the certificate authentication center signs the post-quantum signature certificate using the private key in the terminal's classical signature key pair to obtain the first post-quantum signature certificate signature in the security certificate. Next, the certificate authentication center signs the post-quantum signature certificate using the private key in the terminal's post-quantum signature key pair to obtain the second post-quantum signature certificate signature in the security certificate.

[0377] In this way, the certificate authentication center obtains the first and second post-quantum signature certificate signatures, which can be used to verify the accuracy of the post-quantum signature certificate and confirm that the post-quantum signature certificate has not been accessed by unauthorized persons during transmission. Furthermore, the second post-quantum signature certificate signature in the security certificate obtained by signing the post-quantum signature certificate with the private key of the terminal's post-quantum signature key pair also has good quantum resistance.

[0378] See also Figure 22 In some embodiments, the key response package includes a classical cryptographic envelope and a post-quantum cryptographic envelope. Step 044 (generating a response message based on the key response package and the security certificate, and sending the response message to the terminal) includes:

[0379] 0441: Sign the classic cryptographic envelope according to the classic signature algorithm to obtain a first classic cryptographic envelope signature;

[0380] 0442: Sign the classical cryptographic envelope according to the post-quantum signature algorithm to obtain the first classical cryptographic envelope post-quantum signature;

[0381] 0443: Sign the post-quantum cryptographic envelope according to the classical signature algorithm to obtain the first post-quantum cryptographic envelope signature;

[0382] 0444: Sign the post-quantum cryptographic envelope according to the post-quantum signature algorithm to obtain a first post-quantum cryptographic envelope post-quantum signature;

[0383] 0445: Encrypting the classical cryptographic envelope according to the second quantum key to obtain an encrypted classical cryptographic envelope;

[0384] 0446: Encrypting the post-quantum cryptographic envelope according to the second quantum key to obtain an encrypted post-quantum cryptographic envelope;

[0385] 0447: Send the security certificate, the first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, the first post-quantum cryptographic envelope post-quantum signature, the encrypted classical cryptographic envelope, and the encrypted post-quantum cryptographic envelope as response messages to the terminal.

[0386] In certain embodiments, the signature module is configured to sign a classical cryptographic envelope according to a classical signature algorithm to obtain a first classical cryptographic envelope signature. Furthermore, the signature module is configured to sign the classical cryptographic envelope according to a post-quantum signature algorithm to obtain a first classical cryptographic envelope post-quantum signature. Furthermore, the signature module is configured to sign the post-quantum cryptographic envelope according to the classical signature algorithm to obtain a first post-quantum cryptographic envelope signature and to sign the post-quantum cryptographic envelope according to the post-quantum signature algorithm to obtain a first post-quantum cryptographic envelope post-quantum signature. The encryption module is configured to encrypt the classical cryptographic envelope according to a second quantum key to obtain an encrypted classical cryptographic envelope. Furthermore, the encryption module is configured to encrypt the post-quantum cryptographic envelope according to the second quantum key to obtain an encrypted post-quantum cryptographic envelope. The processing module is configured to send the security certificate, the first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, the first post-quantum cryptographic envelope post-quantum signature, the encrypted classical cryptographic envelope, and the encrypted post-quantum cryptographic envelope as a response message to the terminal.

[0387] In certain embodiments, the processor is further configured to sign the classical cryptographic envelope according to a classical signature algorithm to obtain a first classical cryptographic envelope signature, and to sign the classical cryptographic envelope according to a post-quantum signature algorithm to obtain a first classical cryptographic envelope post-quantum signature. Furthermore, the processor is configured to sign the post-quantum cryptographic envelope according to the classical signature algorithm to obtain a first post-quantum cryptographic envelope signature and to sign the post-quantum cryptographic envelope according to the post-quantum signature algorithm to obtain a first post-quantum cryptographic envelope post-quantum signature. The processor is further configured to encrypt the classical cryptographic envelope according to a second quantum key to obtain an encrypted classical cryptographic envelope, and to encrypt the post-quantum cryptographic envelope according to the second quantum key to obtain an encrypted post-quantum cryptographic envelope. Furthermore, the processor is configured to send the security certificate, the first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, the first post-quantum cryptographic envelope post-quantum signature, the encrypted classical cryptographic envelope, and the encrypted post-quantum cryptographic envelope as response messages to the terminal.

[0388] Specifically, the certificate authentication center signs the classical cryptographic envelope using a classical signature algorithm to obtain a first classical cryptographic envelope signature. Next, the certificate authentication center signs the classical cryptographic envelope using a post-quantum signature algorithm to obtain a first classical cryptographic envelope post-quantum signature. Then, the certificate authentication center signs the post-quantum cryptographic envelope using a classical signature algorithm to obtain a first post-quantum cryptographic envelope signature. The certificate authentication center then signs the post-quantum cryptographic envelope using a post-quantum signature algorithm to obtain a first post-quantum cryptographic envelope post-quantum signature. Subsequently, the certificate authentication center encrypts the classical cryptographic envelope using a second quantum key to obtain an encrypted classical cryptographic envelope. Furthermore, the certificate authentication center encrypts the post-quantum cryptographic envelope using the second quantum key to obtain an encrypted post-quantum cryptographic envelope. Finally, the certificate authentication center sends the security certificate, the first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, the first post-quantum cryptographic envelope post-quantum signature, the encrypted classical cryptographic envelope, and the encrypted post-quantum cryptographic envelope as a response message to the terminal.

[0389] In this way, the certificate authentication center sends the corresponding message to the terminal, allowing the terminal to protect the terminal's communication data based on the security certificate in the response message. The first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, and the first post-quantum cryptographic envelope post-quantum signature in the response message can confirm that the response message has not been unauthorizedly accessed during transmission. The encrypted classical cryptographic envelope and encrypted post-quantum cryptographic envelope in the response message can protect the classical cryptographic envelope and the post-quantum cryptographic envelope.

[0390] See also Figure 23The embodiments of the present application provide a method for enhancing quantum security of online certificate issuance and key pair distribution in a communication network, wherein the communication network includes a terminal, a certificate authentication center, and a key management system. The method is used in the key management system and includes:

[0391] 060: Receive the key application package sent by the certificate authority;

[0392] 061: Generate a key response package based on the key request package and send the key response package to the certificate authority.

[0393] Embodiments of the present application also provide a key management system, including a memory and a processor. The methods of the embodiments of the present application can be implemented by the key management system of the embodiments of the present application. Specifically, the memory stores a computer program, and the processor is configured to receive a key request package sent by a certificate authentication authority, generate a key response package based on the key request package, and send the key response package to the certificate authentication authority.

[0394] The embodiments of the present application also provide a key management system with enhanced quantum security. The methods of the embodiments of the present application can be implemented by the key management system with enhanced quantum security. Specifically, the key management system with enhanced quantum security includes a receiving module and a processing module. The receiving module is configured to receive a key request package sent by a certificate authentication center. The processing module is configured to generate a key response package based on the key request package and send the key response package to the certificate authentication center.

[0395] Specifically, the quantum security enhancement method of this embodiment is basically the same as the quantum security enhancement method of the aforementioned embodiment with the terminal as the execution object. For details, please refer to the explanation of the corresponding part. The difference is that this embodiment takes the key management system as the execution object, which will not be repeated here.

[0396] In summary, in the quantum security enhancement method for online certificate issuance and key pair distribution in a communication network, the communication system, terminal, certificate authentication center, and key management system of the embodiments of the present application, during the communication process in which a terminal obtains a security certificate from a certificate authentication center and a key pair from a key management system, the terminal applies for a first quantum key and uses the first quantum key to encrypt a quantum key identifier and a terminal key pair to generate a first encrypted message that is resistant to quantum computing attacks. The first quantum key has good quantum resistance. Next, the terminal generates a request message based on the first encrypted message, the terminal key pair, and the quantum key identifier, and sends the request message to the certificate authentication center. The certificate authentication center generates a key request package based on the request message and sends the key request package to the key management system. The key management system processes the key request package using a post-quantum cryptographic algorithm, a series of encryption algorithms designed to resist quantum computing attacks, to obtain a key response package, which it then returns to the certificate authentication center. The certificate authentication center generates a security certificate based on the request message and the key response package sent by the key management system. It then generates a response message based on the security certificate and the key response package and sends it to the terminal. In this way, quantum key distribution technology and post-quantum cryptographic algorithms enhance the terminal's ability to resist quantum computing attacks in the communication process of obtaining security certificates from the certificate authentication center and obtaining key pairs from the key management system.

[0397] See also Figure 24 In certain embodiments, the method further comprises:

[0398] 062: Obtain the management security certificate of the key management system from the certificate authority.

[0399] In some embodiments, the acquisition module is used to obtain a management security certificate of the key management system from a certificate authority.

[0400] In some embodiments, the processor is further configured to obtain a management security certificate of the key management system from a certificate authority.

[0401] Specifically, the key management system obtains the management security certificate of the key management system from the certificate authentication center.

[0402] In this way, the key management system obtains its own management security certificate, which can be used for encryption and decryption of subsequent processes.

[0403] See also Figure 25 In some embodiments, step 060 (receiving a key application package sent by a certificate authority) includes:

[0404] 0601: Receive the key application package sent by the certificate authentication center. The key application package includes the terminal classic signature public key, the terminal temporary post-quantum encryption public key, the classic signature identifier associated with the terminal classic signature public key, the post-quantum signature identifier associated with the terminal post-quantum signature public key, the first classic signature value, and the first post-quantum signature value.

[0405] In certain embodiments, the receiving module is used to receive a key application package sent by a certificate authentication center, where the key application package includes a terminal classical signature public key, a terminal temporary post-quantum encryption public key, a classical signature identifier associated with the terminal classical signature public key, a post-quantum signature identifier associated with the terminal post-quantum signature public key, a first classical signature value, and a first post-quantum signature value.

[0406] In some embodiments, the processor is further used to receive a key application package sent by a certificate authentication center, the key application package including a terminal classical signature public key, a terminal temporary post-quantum encryption public key, a classical signature identifier associated with the terminal classical signature public key, a post-quantum signature identifier associated with the terminal post-quantum signature public key, a first classical signature value, and a first post-quantum signature value.

[0407] Specifically, the key management system receives a key application package sent by the certificate authentication center, which includes the terminal classic signature public key, the terminal temporary post-quantum encryption public key, the classic signature identifier associated with the terminal classic signature public key, the post-quantum signature identifier associated with the terminal post-quantum signature public key, the first classic signature value and the first post-quantum signature value.

[0408] In this way, the key management system receives the terminal classical signature public key, the terminal temporary post-quantum encryption public key, the classical signature identifier associated with the terminal classical signature public key, the post-quantum signature identifier associated with the terminal post-quantum signature public key, the first classical signature value and the first post-quantum signature value, which can be used for subsequent processes.

[0409] See also Figure 26 In certain embodiments, the method further comprises:

[0410] 063: Verify the first classic signature value according to the classic signature algorithm associated with the terminal classic signature public key to obtain a first signature verification result;

[0411] 064: Verify the first post-quantum signature value according to the post-quantum signature algorithm associated with the terminal post-quantum signature public key to obtain a second verification result;

[0412] If both the first and second signature verification results are correct, a classical encryption key pair and a post-quantum encryption key pair are generated for the terminal.

[0413] In certain embodiments, the signature verification module is configured to verify the first classical signature value using a classical signature algorithm associated with the terminal's classical signature public key, thereby obtaining a first signature verification result. The signature verification module is further configured to verify the first post-quantum signature value using a post-quantum signature algorithm associated with the terminal's post-quantum signature public key, thereby obtaining a second signature verification result. The derivation module is configured to generate a classical encryption key pair and a post-quantum encryption key pair for the terminal if both the first and second signature verification results are correct.

[0414] In certain embodiments, the processor is further configured to perform signature verification processing on the first classical signature value according to a classical signature algorithm associated with the terminal's classical signature public key to obtain a first signature verification result. Furthermore, the processor is configured to perform signature verification processing on the first post-quantum signature value according to a post-quantum signature algorithm associated with the terminal's post-quantum signature public key to obtain a second signature verification result. Furthermore, if both the first and second signature verification results are correct, generate a classical encryption key pair and a post-quantum encryption key pair for the terminal.

[0415] Specifically, the key management system verifies the first classical signature value using the classical signature algorithm associated with the terminal's classical signature public key, obtaining a first verification result. Next, the key management system verifies the first post-quantum signature value using the post-quantum signature algorithm associated with the terminal's post-quantum signature public key, obtaining a second verification result. Finally, if both the first and second verification results are correct, the key management system generates a classical encryption key pair and a post-quantum encryption key pair for the terminal.

[0416] In this way, the key management system, after multiple signature verification processes, confirms that the received key application package is correct, and then generates a classic encryption key pair and a post-quantum encryption key pair for the terminal, which can be used by the subsequent certificate authentication center to generate security certificates based on the classic encryption key pair and the post-quantum encryption key pair.

[0417] See also Figure 27 In some embodiments, step 061 (generating a key response package based on the key request package and sending the key response package to the certificate authority) includes:

[0418] 0611: Generate the first temporary key response packet according to the key request packet;

[0419] 0612: Generate a second temporary key response package based on the first temporary key response package, the temporary symmetric key randomly generated by the key management system, and the classic encryption key pair;

[0420] 0613: Generate a third temporary key response packet based on the second temporary key response packet and the post-quantum encryption key pair;

[0421] 0614: Store the classical signature identifier and the post-quantum signature identifier in the third temporary key response packet to obtain a fourth temporary key response packet;

[0422] 0615: Process the fourth temporary key response packet according to the classical signature algorithm and the post-quantum signature algorithm to obtain a key response packet;

[0423] 0616: Send the key response package to the certificate authority.

[0424] In certain embodiments, the derivation module is configured to generate a first temporary key response package based on the key request package. Furthermore, the derivation module is configured to generate a second temporary key response package based on the first temporary key response package, a temporary symmetric key randomly generated by the key management system, and a classical encryption key pair. Furthermore, the derivation module is configured to generate a third temporary key response package based on the second temporary key response package and the post-quantum encryption key pair. The storage module is further configured to store the classical signature identifier and the post-quantum signature identifier in the third temporary key response package to obtain a fourth temporary key response package. The processing module is configured to process the fourth temporary key response package based on the classical signature algorithm and the post-quantum signature algorithm to obtain a key response package. The sending module is configured to send the key response package to a certificate authority.

[0425] In certain embodiments, the processor is further configured to generate a first temporary key response package based on the key request package, generate a second temporary key response package based on the first temporary key response package, a temporary symmetric key randomly generated by the key management system, and a classical encryption key pair, generate a third temporary key response package based on the second temporary key response package and the post-quantum encryption key pair, store the classical signature identifier and the post-quantum signature identifier in the third temporary key response package, and obtain a fourth temporary key response package, process the fourth temporary key response package based on the classical signature algorithm and the post-quantum signature algorithm to obtain a key response package, and send the key response package to a certificate authority.

[0426] Specifically, the key management system generates a first temporary key response package based on the key request package. Next, the key management system generates a second temporary key response package based on the first temporary key response package, a temporary symmetric key randomly generated by the key management system, and a classical encryption key pair. Then, the key management system generates a third temporary key response package based on the second temporary key response package and the post-quantum encryption key pair. The key management system then stores the classical signature identifier and the post-quantum signature identifier in the third temporary key response package, obtaining a fourth temporary key response package. Subsequently, the key management system processes the fourth temporary key response package using the classical signature algorithm and the post-quantum signature algorithm to obtain a key response package. Finally, the key management system sends the key response package to the certificate authority.

[0427] In this way, the key management system performs multiple operations based on post-quantum cryptographic algorithms, classical cryptographic algorithms and other data information to generate a key response package, and the certificate authentication system can generate a security certificate based on the key response package.

[0428] See also Figure 28 In some embodiments, step 0612 (generating a second temporary key response packet based on the first temporary key response packet, the temporary symmetric key randomly generated by the key management system, and the classic encryption key pair) includes:

[0429] 06121: Encrypt the private key in the classic encryption key pair using the temporary symmetric key to obtain the classic encryption private key in the classic cryptographic envelope;

[0430] 06122: Sign the temporary symmetric key using the terminal's classic signature public key to obtain the encrypted temporary symmetric key in the classic cryptographic envelope;

[0431] 06123: Store the public key and the classic cryptographic envelope in the classic encryption key pair in the first temporary key response packet to obtain a second temporary key response packet.

[0432] In certain embodiments, the encryption module is configured to encrypt the private key in the classic encryption key pair using the temporary symmetric key to obtain the classic encryption private key in the classic cryptographic envelope. The signature module is further configured to sign the temporary symmetric key using the terminal's classic signature public key to obtain the encrypted temporary symmetric key in the classic cryptographic envelope. The storage module is configured to store the public key in the classic encryption key pair and the classic cryptographic envelope in a first temporary key response packet to obtain a second temporary key response packet.

[0433] In certain embodiments, the processor is further configured to encrypt the private key in the classic encryption key pair using the temporary symmetric key to obtain the classic encryption private key in the classic cryptographic envelope; and to sign the temporary symmetric key using the terminal's classic signature public key to obtain the encrypted temporary symmetric key in the classic cryptographic envelope; and to store the public key in the classic encryption key pair and the classic cryptographic envelope in a first temporary key response packet to obtain a second temporary key response packet.

[0434] Specifically, the key management system encrypts the private key in the classic encryption key pair using the temporary symmetric key, obtaining the classic encryption private key in the classic cryptographic envelope. Next, the key management system signs the temporary symmetric key using the terminal's classic signature public key, obtaining an encrypted temporary symmetric key in the classic cryptographic envelope. Finally, the key management system stores the public key in the classic encryption key pair and the classic cryptographic envelope in a first temporary key response packet, obtaining a second temporary key response packet.

[0435] In this way, the key management system ensures the security of the private key in the classic encryption key pair during transmission and ensures that only the terminal holding the corresponding private key can decrypt and use the temporary symmetric key.

[0436] See also Figure 29 In some embodiments, step 0613 (generating a third temporary key response packet based on the second temporary key response packet and the post-quantum encryption key pair) includes:

[0437] 06131: Concatenate the random number randomly generated by the key management system and the fixed string to obtain a third concatenation;

[0438] 06132: Perform post-quantum encryption on the third spliced ​​object to obtain a first encryption key;

[0439] 06133: Perform post-quantum encryption encapsulation processing on the third spliced ​​body to obtain the first encapsulated message in the post-quantum cryptographic envelope;

[0440] 06134: Encrypt the private key in the post-quantum encryption key pair according to the first encryption key to obtain the post-quantum encryption private key in the post-quantum cryptographic envelope;

[0441] 06135: Store the public key and post-quantum cryptographic envelope in the post-quantum encryption key pair in the second temporary key response package to obtain a third temporary key response package.

[0442] In certain embodiments, the concatenation module is configured to concatenate a random number randomly generated by a key management system and a fixed string to obtain a third concatenation. The encryption module is further configured to perform post-quantum encryption on the third concatenation to obtain a first encryption key. The encryption encapsulation module is configured to perform post-quantum encryption encapsulation on the third concatenation to obtain a first encapsulated message in a post-quantum cryptographic envelope. The encryption module is configured to encrypt a private key in a post-quantum cryptographic key pair using the first encryption key to obtain a post-quantum cryptographic private key in the post-quantum cryptographic envelope. The storage module is configured to store the public key in the post-quantum cryptographic key pair and the post-quantum cryptographic envelope in a second temporary key response packet to obtain a third temporary key response packet.

[0443] In certain embodiments, the processor is further configured to concatenate a random number randomly generated by the key management system and a fixed string to obtain a third concatenation, perform post-quantum encryption on the third concatenation to obtain a first encryption key, perform post-quantum encryption encapsulation on the third concatenation to obtain a first encapsulated message in a post-quantum cryptographic envelope, encrypt a private key in a post-quantum cryptographic key pair using the first encryption key to obtain a post-quantum encrypted private key in the post-quantum cryptographic envelope, and store the public key in the post-quantum cryptographic key pair and the post-quantum cryptographic envelope in a second temporary key response packet to obtain a third temporary key response packet.

[0444] Specifically, the key management system concatenates the random number randomly generated by the key management system and the fixed string to obtain a third concatenation. Next, the key management system performs post-quantum encryption on the third concatenation to obtain the first encryption key. The key management system then performs post-quantum encryption encapsulation on the third concatenation to obtain the first encapsulated message in the post-quantum cryptographic envelope. Then, the key management system encrypts the private key in the post-quantum cryptographic key pair using the first encryption key to obtain the post-quantum encrypted private key in the post-quantum cryptographic envelope. Finally, the key management system stores the public key in the post-quantum cryptographic key pair and the post-quantum cryptographic envelope in a second temporary key response packet to obtain a third temporary key response packet.

[0445] In this way, the key management system uses the first encryption key generated by the post-quantum encryption algorithm to encrypt the private key in the post-quantum encryption key pair, ensuring the security of the private key in the post-quantum encryption key pair during transmission.

[0446] See also Figure 30 In some embodiments, step 0615 (processing the fourth temporary key response packet according to the classical signature algorithm and the post-quantum signature algorithm to obtain a key response packet) includes:

[0447] 06151: Sign the fourth temporary key response packet according to the classic signature algorithm to obtain a second classic signature message;

[0448] 06152: Perform post-quantum signature processing on the fourth temporary key response packet according to the post-quantum signature algorithm to obtain a second post-quantum signature message;

[0449] 06153: Store the second classical signature message and the second post-quantum signature message in the fourth temporary key response package to obtain a key response package.

[0450] In certain embodiments, the signing module is configured to perform a signature process on the fourth temporary key response packet according to a classical signature algorithm to obtain a second classical signature message. Furthermore, the signing module is configured to perform a post-quantum signature process on the fourth temporary key response packet according to a post-quantum signature algorithm to obtain a second post-quantum signature message. The storage module is further configured to store the second classical signature message and the second post-quantum signature message in the fourth temporary key response packet to obtain a key response packet.

[0451] In certain embodiments, the processor is further configured to perform a signature process on the fourth temporary key response packet according to a classical signature algorithm to obtain a second classical signature message, perform a post-quantum signature process on the fourth temporary key response packet according to a post-quantum signature algorithm to obtain a second post-quantum signature message, and store the second classical signature message and the second post-quantum signature message in the fourth temporary key response packet to obtain a key response packet.

[0452] Specifically, the key management center signs the fourth temporary key response package using a classical signature algorithm to obtain a second classical signature message. Next, the key management center performs a post-quantum signature on the fourth temporary key response package using a post-quantum signature algorithm to obtain a second post-quantum signature message. Finally, the key management center stores the second classical signature message and the second post-quantum signature message in the fourth temporary key response package to obtain a key response package.

[0453] In this way, the key management center processes the fourth temporary key response package according to the post-quantum cryptography algorithm and the classical algorithm to obtain a key response package, which can ensure that the key application package is not accessed by unauthorized persons during transmission.

[0454] The following example illustrates the method of the present application implementation. In this embodiment, the terminal is a user terminal device that uses a user digital certificate issued by a certificate authentication center and a user key pair distributed by a key management system. The certificate authentication center issues digital certificates, including a signature certificate and an encryption certificate, to the user and applies to the key management system KM for the user's encryption key pair. The certificate authentication center is typically directly connected to a cryptographic device, which performs relevant cryptographic operations. In this embodiment, the certificate authentication center and cryptographic device are considered as a whole, hereinafter referred to as the certificate authentication center CA, or simply CA. The key management system generates and distributes the terminal's encryption key pair to the certificate authentication center CA. The key management system is also typically directly connected to a cryptographic device, which performs relevant cryptographic and key operations. In this embodiment, the key management system and cryptographic device are considered as a whole, hereinafter referred to as the key management system KM, or KM. A quantum network node is a network node that stores and provides generated quantum keys to a device management center via a trusted channel, or provides generated quantum keys to cryptographic devices via a key service node. A key service node is a service node that connects to quantum network nodes and provides pre-shared key injection and quantum key services to multiple cryptographic devices.

[0455] See also Figure 31 The terminal's classic signature key pair is the user's SM2 signature key pair, the terminal's post-quantum signature key pair is the user's PQC signature key pair, and the terminal's post-quantum encryption key pair is the user's PQC temporary encryption key pair. The application message is an online certificate and key application message. The classic signature identifier associated with the terminal's classic signature public key is the SM2 algorithm identifier, and the post-quantum signature identifier associated with the terminal's post-quantum signature public key is the PQC signature algorithm identifier.

[0456] Before communication begins, the CA connects to the physically closest, authorized second quantum network node through a trusted channel. A trusted channel refers to a mechanism or protocol that provides a secure communication path between two communicating entities. One approach is to establish a secure communication path between the authentication server and the second quantum network node within the same cabinet and directly connected via a shielded network cable. This channel ensures the confidentiality, integrity, and availability of data during transmission, preventing unauthorized access, tampering, or eavesdropping. Furthermore, the CA generates and issues SM2 and PQC root signature certificates. These root certificates enable the CA to issue various certificates. Furthermore, the CA issues SM2 and PQC signature certificates to the KM.

[0457] The terminal uses the key service node to inject a pre-shared key (1M bits) of 128-bit keys into its personal cryptographic module (PCM). The PCM includes, but is not limited to, a smart key (HSM) and a virtual security module (VSM). The terminal then sends a quantum key request to the key service node, randomly selecting a key from the PCM as the protection key. The terminal then performs a hash operation (Hash-based Message Authentication Code (HMAC)) on the key ID and the request content using the SM3 algorithm and the protection key. The key service node then performs a hash operation on the key ID and the request content using the SM3 algorithm and the protection key to verify data integrity and authenticity. HMAC is a method that uses hash functions and keys to provide data integrity and origin authentication.

[0458] After the quantum key application is successfully confirmed, the terminal receives the quantum key encryption result obtained by encrypting the first quantum key QK_UUID-1 and the quantum key identifier UUID_QK using the protection key from the key service node. The first quantum key QK_UUID-1 is generated and distributed to the key service node by the first quantum network node connected to the key service node. The quantum key identifier UUID_QK is obtained by identifying the first quantum key QK_UUID-1 by the first quantum network node using the first quantum network node's unique universal identification code. The terminal then decrypts the quantum key encryption result using the protection key to obtain the first quantum key QK_UUID-1 and the quantum key identifier UUID_QK.

[0459] The terminal uses a personal password module such as an intelligent password key to generate a user SM2 signature key pair, a user PQC signature key pair, and a user PQC temporary encryption key pair. Next, the terminal concatenates the public key of the user SM2 signature key pair, the public key of the user PQC signature key pair, the public key of the user PQC temporary encryption key pair, and the quantum key identifier UUID_QK to obtain a first concatenation T1. The terminal then uses the SM3 cryptographic hash algorithm and the first quantum key QK_UUID-1 to calculate the first concatenation T1 to obtain a first encrypted message M1. Finally, the terminal sends the public key of the user SM2 signature key pair, the public key of the user PQC signature key pair, the public key of the user PQC temporary encryption key pair, the quantum key identifier UUID_QK, and the first encrypted message M1 to the CA online as an online certificate and key application message.

[0460] After receiving the certificate and key application message from the terminal, the CA first sends a quantum key application to the second quantum network node directly connected to the CA based on the quantum key identifier UUID_QK. After the quantum key application is approved, the second quantum network node sends the second quantum key QK_UUID-2 to the CA. The CA concatenates the public key of the user SM2 signature key pair, the public key of the user PQC signature key pair, the public key of the user PQC temporary encryption key pair, and the quantum key identifier UUID_QK to obtain a second concatenation T2. ​​The second concatenation T2 is then encrypted using the SM3 cryptographic hash algorithm and the second quantum key QK_UUID-2 to obtain a second encrypted message M2. The first encrypted message M1 and the second encrypted message M2 are then compared to confirm whether the first encrypted message M1 and the second encrypted message M2 are consistent. If the first encrypted message M1 and the second encrypted message M2 are consistent, it is confirmed that the application message received by the CA is correct.

[0461] After receiving the second quantum key QK_UUID-2 sent by the second quantum network node and confirming that the CA received the correct request message, the CA generates a first temporary key application package CARequest-1 according to the KM security protocol. The CA then stores the user SM2 signature key pair and the user PQC temporary encryption key pair in the user public key information substructure (userPubKey) of the user information substructure (AppUserInfo) of the key request structure (KSRequest) of the first temporary key application package CARequest-1, thereby obtaining a second temporary key application package CARequest-2. The CA then stores the SM2 algorithm identifier and the PQC algorithm identifier in the signature algorithm structure (signatureAlgorithm) within the CARequest-2 structure, thereby obtaining a third temporary key application package CARequest-3. The CA then signs the third temporary key application package CARequest-3 using the SM2 algorithm and the PQC algorithm, respectively, to obtain a first classical signature value and a first post-quantum signature value. These first classical signature value and the first post-quantum signature value are then stored in the signature value (signatureValue) of the third temporary key application package CARequest-3, thereby obtaining a key application package CARequest. Finally, CA sends the key application package CARequest to KM.

[0462] After receiving the key application package CARequest sent by the CA, the KM uses the CA's SM2 signature root certificate to verify the first classical signature value in the key application package to obtain a first signature verification result, and uses the PQC signature root certificate to verify the first post-quantum signature value to obtain a second signature verification result. If both the first and second signature verification results are correct, the KM generates an SM2 encryption key pair and a PQC encryption key pair for the terminal. The KM generates a first temporary key response package KMRespond-1 according to the KM security protocol. The ksRespond substructure of the first temporary key response package KMRespond-1 contains at least two Respond response sub-packages, and the public key and classical cryptographic envelope in the SM2 encryption key pair are stored in a Respond response sub-package to obtain a second temporary response package KMRespond-2. In certain embodiments, the classical cryptographic envelope is generated as follows: the KM uses a randomly generated temporary symmetric key to encrypt the private key in the SM2 encryption key pair to obtain a classical encryption private key in the classical cryptographic envelope, and then uses the public key in the SM2 signature key pair to encrypt the temporary symmetric key to encrypt the encrypted temporary symmetric key in the classical cryptographic envelope. The public key and post-quantum cryptographic envelope in the PQC encryption key pair are stored in a Respond response sub-packet, resulting in a third temporary response packet KMRespond-3. In certain embodiments, the post-quantum cryptographic envelope is generated as follows: the KM randomly generates a 256-bit random number R, concatenates R with a fixed 256-bit string S agreed upon by the KM and the CA, and obtains a third concatenation P3, i.e., R|S. The third concatenation P3 is encrypted using the PQC key encapsulation algorithm to obtain the first encryption key K, and then the third concatenation P3 is encapsulated using the public key in the user's PQC temporary encryption key pair to obtain the first encapsulated message F1 in the post-quantum cryptographic envelope. The KM then uses the first encryption key K and the SM4 block cipher algorithm to encrypt the private key in the PQC encryption key pair to obtain the post-quantum encrypted private key in the post-quantum cryptographic envelope.

[0463] The KM also stores the SM2 algorithm identifier and the PQC algorithm identifier in the signatureAlgorithm structure within the KMRequest structure, obtaining a fourth temporary key response package, KMRespond-4. The KM then signs the fourth temporary key response package using the SM2 algorithm and the PQC algorithm, respectively, to obtain a second classical signature message and a second post-quantum signature message. The KM then stores the second classical signature message and the second post-quantum signature message in the signatureValue structure within the fourth temporary key response package, KMRespond-4, to obtain a key response package, KMRespond. The KM then sends the key response package, KMRespond, to the CA.

[0464] After receiving the key response package KMRespond sent by KM, CA uses KM's SM2 signature certificate to verify the second classical signature message to obtain the second classical signature result, and uses KM's PQC signature certificate to verify the second post-quantum signature message to obtain the second post-quantum signature result. If both the second classical signature result and the second post-quantum signature result are correct, CA extracts the public key in the SM2 encryption key pair and the public key of the PQC encryption key pair from the Respond response sub-package in the key response package KMRespond.

[0465] Then, the CA generates a classic signature certificate in the security certificate based on the public key in the user's SM2 signature key pair, generates a classic encryption certificate in the security certificate based on the public key in the SM2 encryption key pair, generates a post-quantum signature certificate in the security certificate based on the public key in the user's PQC signature key pair, and generates a post-quantum encryption certificate in the security certificate based on the public key in the PQC encryption key pair. While generating and issuing the certificates, the CA uses the SM2 signature algorithm to sign the classic signature certificate, classic encryption certificate, post-quantum signature certificate, and post-quantum encryption certificate, obtaining the first classic signature certificate signature in the classic signature certificate, the first classic encryption certificate signature in the classic encryption certificate, the first post-quantum signature certificate signature in the post-quantum signature certificate, and the first post-quantum encryption certificate signature in the post-quantum encryption certificate. The CA then uses the PQC signature algorithm to sign the classic signature certificate, classic encryption certificate, post-quantum signature certificate, and post-quantum encryption certificate, obtaining the second classic signature certificate signature in the classic signature certificate, the second classic encryption certificate signature in the classic encryption certificate, the second post-quantum signature certificate signature in the post-quantum signature certificate, and the second post-quantum encryption certificate signature in the post-quantum encryption certificate.

[0466] Subsequently, the CA uses the SM2 signature algorithm and the PQC signature algorithm to sign the classical cryptographic envelope, obtaining the first classical cryptographic envelope signature and the first classical cryptographic envelope post-quantum signature. The CA then uses the SM2 signature algorithm and the PQC signature algorithm to sign the post-quantum cryptographic envelope, obtaining the first post-quantum cryptographic envelope signature and the first post-quantum cryptographic envelope post-quantum signature. Next, the CA encrypts the classical cryptographic envelope using the second quantum key and the SM4 block encryption algorithm to obtain an encrypted classical cryptographic envelope. The CA then encrypts the post-quantum cryptographic envelope using the second quantum key and the SM4 block encryption algorithm to obtain an encrypted post-quantum cryptographic envelope. The CA sends the security certificate, the first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, the first post-quantum cryptographic envelope post-quantum signature, the encrypted classical cryptographic envelope, and the encrypted post-quantum cryptographic envelope as response messages to the terminal.

[0467] After receiving the response message sent by the CA, first, the terminal uses the CA's SM2 signature root certificate to verify the signature of the first classic signature certificate in the classic signature certificate issued by the CA and uses the PQC signature root certificate to verify the signature of the second classic signature certificate in the classic signature certificate issued by the CA, confirming that the received classic signature certificate is correct. The terminal uses the CA's SM2 signature root certificate to verify the signature of the first classic encryption certificate in the classic encryption certificate issued by the CA and uses the PQC signature root certificate to verify the signature of the second classic encryption certificate in the classic encryption certificate issued by the CA, confirming that the received classic encryption certificate is correct. The terminal uses the CA's SM2 signature root certificate to verify the signature of the first post-quantum encryption certificate in the post-quantum encryption certificate issued by the CA and uses the PQC signature root certificate to verify the signature of the second post-quantum encryption certificate in the post-quantum encryption certificate issued by the CA, confirming that the received post-quantum encryption certificate is correct. The terminal uses the CA's SM2 signature root certificate to verify the signature of the first post-quantum signature certificate in the post-quantum signature certificate issued by the CA, and uses the PQC signature root certificate to verify the signature of the second post-quantum signature certificate in the post-quantum signature certificate issued by the CA, confirming that the received post-quantum signature certificate is correct.

[0468] Next, the terminal uses the SM2 signature certificate to verify the signature of the first classical cryptographic envelope to obtain a first terminal verification result, and uses the PQC signature algorithm to verify the post-quantum signature of the first classical cryptographic envelope to obtain a second terminal verification result. When the first terminal verification result and the second terminal verification result are correct, the terminal decrypts the encrypted classical cryptographic envelope according to the first quantum key QK_UUID-1 and the SM4 block encryption algorithm to obtain a classical cryptographic envelope. Subsequently, the SM2 signature certificate is used to verify the signature of the first post-quantum cryptographic envelope to obtain a third terminal verification result, and the PQC signature algorithm is used to verify the post-quantum signature of the first post-quantum cryptographic envelope to obtain a fourth terminal verification result. When the third terminal verification result and the fourth terminal verification result are correct, the terminal decrypts the encrypted post-quantum cryptographic envelope according to the first quantum key QK_UUID-1 and the SM4 block encryption algorithm to obtain a post-quantum cryptographic envelope.

[0469] Next, the terminal decrypts the encrypted temporary symmetric key in the classical cryptographic envelope using the private key in the terminal signature key pair to obtain a temporary symmetric key. The terminal then decrypts the classical encryption private key using the temporary symmetric key to obtain the private key in the classical encryption key pair. Next, the terminal unseals the first encapsulated message F1 in the post-quantum cryptographic envelope to obtain a second concatenation. Next, the terminal obtains a fixed string S based on the second concatenation to confirm the correctness of the post-quantum cryptographic envelope. If the post-quantum cryptographic envelope is correct, the terminal performs post-quantum encryption on the first concatenation to obtain the first encryption key K. The terminal then decrypts the post-quantum encryption private key in the post-quantum cryptographic envelope using the first encryption key K to obtain the private key in the post-quantum encryption key pair.

[0470] Finally, the terminal obtains the public key and private key in the classical encryption key pair, the public key and private key in the post-quantum encryption key pair, the classical encryption certificate, the classical signature certificate, the post-quantum encryption certificate, and the post-quantum signature certificate, which can be used for various communication processes of the terminal.

[0471] The present application also provides a computer-readable storage medium containing a computer program. When the computer program is executed by one or more processors, the one or more processors execute the method of the present application.

[0472] It is understood that a computer program includes computer program code. The computer program code may be in source code form, object code form, executable file, or some intermediate form. Computer-readable storage media may include any entity or device capable of carrying computer program code, recording media, USB flash drives, removable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution media.

[0473] In the description of this specification, the descriptions with reference to the terms "particularly", "further", "particularly", "understandably", etc. are intended to mean that the specific features, structures, materials or characteristics described in conjunction with the embodiments or examples are included in at least one embodiment or example of the present application. In this specification, the schematic expressions of the above terms are not intended to refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0474] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may be performed out of the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present application belong.

[0475] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A method for enhancing quantum security of online certificate issuance and key pair distribution in a communication network, characterized in that: The communication network includes a terminal, a certificate authentication center, and a key management system. The method is used for the terminal, and the method includes: Acquire a first quantum key and a quantum key identifier from a first network node connected to the terminal; Encrypting the quantum key identifier and the randomly generated terminal key pair according to the first quantum key to obtain a first encrypted message; Generate an application message according to the first encrypted message, the terminal key pair and the quantum key identifier, and send the application message to the certificate authentication center; Receive a response message sent by the certificate authentication center so that the terminal can use the response message to communicate with other terminals in the communication network except the terminal, wherein the response message includes a key response package and a security certificate, the key response package is generated by the key management system according to the key application package sent by the certificate authentication center, the key application package is generated by the certificate authentication center according to the application message, and the security certificate is generated by the certificate authentication center according to the application message and the key response package sent by the key management system.

2. The method according to claim 1, characterized in that The method of obtaining a first key and a quantum key identifier from a first network node connected to the terminal includes: Using a service node to inject multiple keys into a cryptographic module of the terminal; Sending a quantum key application to the service node, wherein the quantum key application is protected by a protection key, and the protection key is a randomly used one from a plurality of keys injected into the cryptographic module; receiving a quantum key encryption result obtained by the service node encrypting the first quantum key and the quantum key identifier according to the protection key, where the first quantum key is generated by a first network node connected to the service node and distributed to the service node, and the quantum key identifier is obtained by the first network node identifying the first quantum key according to an identification code of the first network node; The quantum key encryption result is decrypted to obtain the first quantum key and the quantum key identifier.

3. The method according to claim 2, characterized in that The step of encrypting the quantum key identifier and the randomly generated terminal key pair according to the first quantum key to obtain a first encrypted message includes: Randomly generate a terminal key pair according to the cryptographic module of the terminal, the terminal key pair including a terminal classical signature key pair, a terminal post-quantum signature key pair and a terminal post-quantum encryption key pair; Concatenate the terminal public key and the quantum key identifier to obtain a first concatenation, wherein the terminal public key includes the terminal classical signature public key of the terminal classical signature key pair, the terminal post-quantum signature public key of the terminal post-quantum signature key pair, and the terminal temporary post-quantum encryption public key of the terminal post-quantum encryption key pair; The first spliced ​​body is encrypted according to the first quantum key to obtain a first encrypted message.

4. The method according to claim 3, characterized in that The security certificate includes a classic encryption certificate, a first classic encryption certificate signature, and a second classic encryption certificate signature, and the method further includes: Performing signature verification processing on the first classic encryption certificate signature according to the terminal classic signature public key to obtain a first classic encryption certificate signature verification result; Verifying the signature of the second classical encryption certificate according to the terminal post-quantum signature public key to obtain a second classical encryption certificate verification result; When the first classic encryption certificate verification result and the second classic encryption certificate verification result are correct, confirm that the classic encryption certificate is correct.

5. The method according to claim 3, characterized in that: The security certificate includes a classic signature certificate, a first classic signature certificate signature, and a second classic signature certificate signature, and the method further includes: Verifying the signature of the first classic signature certificate according to the terminal classic signature public key to obtain a first classic signature certificate verification result; Verifying the signature of the second classic signature certificate according to the terminal post-quantum signature public key to obtain a second classic signature certificate verification result; When the verification result of the first classic signature certificate and the verification result of the second classic signature certificate are correct, confirming that the classic signature certificate is correct.

6. The method according to claim 3, characterized in that The security certificate includes a post-quantum encryption certificate, a first post-quantum encryption certificate signature, and a second post-quantum encryption certificate signature, and the method further includes: Performing signature verification processing on the first post-quantum encryption certificate signature according to the terminal classic signature public key to obtain a first post-quantum encryption certificate signature verification result; Performing a signature verification process on the second post-quantum encryption certificate signature according to the terminal post-quantum signature public key to obtain a second post-quantum encryption certificate signature verification result; When the first post-quantum encryption certificate verification result and the second post-quantum encryption certificate verification result are correct, confirm that the post-quantum encryption certificate is correct.

7. The method according to claim 3, characterized in that The security certificate includes a post-quantum signature certificate, a first post-quantum signature certificate signature, and a second post-quantum signature certificate signature, and the method further includes: Verifying the signature of the first post-quantum signature certificate according to the terminal classic signature public key to obtain a first post-quantum signature certificate verification result; Verify the signature of the second post-quantum signature certificate according to the terminal post-quantum signature public key to obtain a second post-quantum signature certificate verification result; When the verification result of the first post-quantum signature certificate and the verification result of the second post-quantum signature certificate are correct, confirm that the post-quantum signature certificate is correct.

8. The method according to claim 3, characterized in that The response message includes a first classical cryptographic envelope signature, a first classical cryptographic envelope post-quantum signature, a first post-quantum cryptographic envelope signature, a first post-quantum cryptographic envelope post-quantum signature, an encrypted classical cryptographic envelope, and an encrypted post-quantum cryptographic envelope, and the method further includes: Performing signature verification processing on the first classic cryptographic envelope signature to obtain a first terminal signature verification result; Performing a signature verification process on the first classical cryptographic envelope post-quantum signature to obtain a second terminal signature verification result; Performing signature verification processing on the first post-quantum cryptographic envelope signature to obtain a third terminal signature verification result; Performing signature verification processing on the first post-quantum cryptographic envelope post-quantum signature to obtain a fourth terminal signature verification result; When the signature verification result of the first terminal, the signature verification result of the second terminal, the signature verification result of the third terminal and the signature verification result of the fourth terminal are all correct, decrypting the encrypted classical cryptographic envelope according to the first quantum key to obtain a classical cryptographic envelope; The encrypted post-quantum cryptographic envelope is decrypted according to the first quantum key to obtain a post-quantum cryptographic envelope.

9. The method according to claim 8, characterized in that The method further comprises: Decrypting the encrypted temporary symmetric key in the classic cryptographic envelope according to the private key in the terminal classic signature key pair to obtain a temporary symmetric key; The classic encryption private key in the classic cryptographic envelope is decrypted according to the temporary symmetric key to obtain the private key in the classic encryption key pair.

10. The method according to claim 8, characterized in that The method further comprises: Decapsulating the first encapsulated message in the post-quantum cryptographic envelope to obtain a second spliced ​​body; Obtaining a fixed string according to the second concatenated body to confirm the correctness of the post-quantum cryptographic envelope; When the post-quantum cryptographic envelope is correct, performing post-quantum encryption processing on the first spliced ​​body to obtain a first encryption key; The post-quantum encryption private key in the post-quantum cryptographic envelope is decrypted according to the first encryption key to obtain the private key in the post-quantum encryption key pair.

11. A method for enhancing quantum security of online certificate issuance and key pair distribution in a communication network, characterized in that: The communication network includes a terminal, a certificate authentication center and a key management system, and the method is used in the certificate authentication center, and the method includes: receiving an application message sent by the terminal, wherein the application message is generated by the terminal according to a terminal key pair, a quantum key identifier, and a first encrypted message, the terminal key pair is randomly generated by the terminal, the quantum key identifier is obtained by the first network node to which the terminal has accessed, the first encrypted message is obtained by encrypting the quantum key identifier and the terminal key pair with a first quantum key, and the first quantum key is obtained by the first network node to which the terminal has accessed; Generate a key application package according to the application message, and send the key application package to the key management system; Receiving a key response packet sent by the key management system, wherein the key response packet is generated by the key management system according to the key application packet; Generate a security certificate according to the application message and the key response packet; A response message is generated according to the key response package and the security certificate, and the response message is sent to the terminal, so that the terminal can use the response message to communicate with other terminals in the communication network except the terminal.

12. The method according to claim 11, characterized in that The method further comprises: accessing a second network node through a pre-established channel; Issue the security certificate of the certificate authority.

13. The method according to claim 11, characterized in that The method further comprises: Sending a quantum key application to a second network node connected to the certificate authentication center according to the quantum key identifier; Receive a second quantum key distributed by the second network node according to the quantum key application.

14. The method according to claim 13, characterized in that The application message includes the first encrypted message, a terminal classical signature key pair, a terminal post-quantum signature key pair, a terminal post-quantum encryption key pair, and the quantum key identifier, and the method further includes: Concatenating the terminal classic signature public key in the terminal classic signature key pair, the terminal post-quantum signature public key in the terminal post-quantum signature key pair, the terminal temporary post-quantum encryption public key in the terminal post-quantum encryption key pair, and the quantum key identifier to obtain a second concatenation; Encrypting the second spliced ​​body according to the second quantum key to obtain a second encrypted message; Confirm the correctness of the received terminal classical signature public key, the terminal post-quantum signature public key, the terminal temporary post-quantum encryption public key and the quantum key identifier according to the second encrypted message and the first encrypted message.

15. The method according to claim 14, characterized in that The generating a key application package according to the application message, and sending the key application package to the key management system includes: Generate a first temporary key application package according to the terminal key pair; Storing the terminal classical signature public key and the terminal temporary post-quantum encryption public key in the first temporary key application package to obtain a second temporary key application package; The classic signature identifier associated with the terminal classic signature public key and the post-quantum signature identifier associated with the terminal post-quantum signature public key are stored in the second temporary key application package to obtain a third temporary key application package; Signing the third temporary key application package according to the classic signature algorithm associated with the terminal classic signature public key to obtain a first classic signature value; Signing the third temporary key application package according to the post-quantum signature algorithm associated with the terminal post-quantum signature public key to obtain a first post-quantum signature value; Storing the first classical signature value and the first post-quantum signature value in the third temporary key application package to obtain a key application package; The key application package is sent to the key management system.

16. The method according to claim 15, characterized in that The key application package includes a second classical signature message and a second post-quantum signature message, and generating a security certificate according to the application message and the key response package includes: Upon receiving the key response package sent by the key management system, performing signature verification processing on the second classic signature message according to the classic signature algorithm to obtain a second classic signature verification result; Performing signature verification processing on the second post-quantum signature message according to the post-quantum signature algorithm to obtain a second post-quantum signature verification result; When both the second classical signature verification result and the second post-quantum signature verification result are correct, obtaining a public key in a classical encryption key pair and a public key in a post-quantum encryption key pair from the key response packet; Generate a classic signature certificate in the security certificate for the terminal according to the terminal classic signature public key; Generate a classic encryption certificate in the security certificate for the terminal according to the public key in the classic encryption key pair; Generate a post-quantum signature certificate in the security certificate for the terminal according to the post-quantum signature public key of the terminal; A post-quantum encryption certificate in the security certificate is generated for the terminal according to the public key in the post-quantum encryption key pair.

17. The method according to claim 16, characterized in that The method further comprises: Signing the classic encryption certificate according to the private key in the terminal classic signature key pair to obtain a first classic encryption certificate signature in the security certificate; The classical encryption certificate is signed according to the private key in the terminal post-quantum signature key pair to obtain a second classical encryption certificate signature in the security certificate.

18. The method according to claim 16, characterized in that The method further comprises: Signing the classic signature certificate according to the private key in the terminal classic signature key pair to obtain a first classic signature certificate signature in the security certificate; The classic signature certificate is signed according to the private key in the terminal post-quantum signature key pair to obtain a second classic signature certificate signature in the security certificate.

19. The method according to claim 16, characterized in that The method further comprises: Signing the post-quantum encryption certificate according to the private key in the terminal classic signature key pair to obtain a first post-quantum encryption certificate signature in the security certificate; The post-quantum encryption certificate is signed according to the private key in the terminal post-quantum signature key pair to obtain a second post-quantum encryption certificate signature in the security certificate.

20. The method according to claim 16, characterized in that The method further comprises: Signing the post-quantum signature certificate according to the private key in the terminal classic signature key pair to obtain a first post-quantum signature certificate signature in the security certificate; The post-quantum signature certificate is signed according to the private key in the terminal post-quantum signature key pair to obtain a second post-quantum signature certificate signature in the security certificate.

21. The method according to claim 15, characterized in that The key response package includes a classical cryptographic envelope and a post-quantum cryptographic envelope, and generating a response message according to the key response package and the security certificate, and sending the response message to the terminal, comprises: Signing the classic cryptographic envelope according to the classic signature algorithm to obtain a first classic cryptographic envelope signature; Signing the classical cryptographic envelope according to the post-quantum signature algorithm to obtain a first classical cryptographic envelope post-quantum signature; Signing the post-quantum cryptographic envelope according to the classical signature algorithm to obtain a first post-quantum cryptographic envelope signature; Signing the post-quantum cryptographic envelope according to the post-quantum signature algorithm to obtain a first post-quantum cryptographic envelope post-quantum signature; Encrypting the classical cryptographic envelope according to the second quantum key to obtain an encrypted classical cryptographic envelope; Encrypting the post-quantum cryptographic envelope according to the second quantum key to obtain an encrypted post-quantum cryptographic envelope; The security certificate, the first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, the first post-quantum cryptographic envelope post-quantum signature, the encrypted classical cryptographic envelope and the encrypted post-quantum cryptographic envelope are sent to the terminal as response messages.

22. A method for enhancing quantum security of online certificate issuance and key pair distribution in a communication network, characterized in that: The communication network includes a terminal, a certificate authentication center and a key management system, and the method is used in the key management system, and the method includes: receiving a key application package sent by the certificate authentication center, wherein the key application package is generated by the certificate authentication center according to an application message, the application message is generated by the terminal according to a terminal key pair, a quantum key identifier, and a first encrypted message, the terminal key pair is randomly generated by the terminal, the quantum key identifier is obtained by the first network node accessed by the terminal, the first encrypted message is obtained by encrypting the quantum key identifier and the terminal key pair with a first quantum key, and the first quantum key is obtained by the first network node accessed by the terminal; A key response package is generated according to the key application package, and the key response package is sent to the certificate authentication center, wherein the certificate authentication center generates a security certificate according to the application message and the key response package, and sends a response message generated according to the security certificate and the key response package to the terminal, so that the terminal can use the response message to communicate with other terminals in the communication network except the terminal.

23. The method according to claim 22, characterized in that The method further comprises: Obtain the management security certificate of the key management system from the certificate authentication center.

24. The method according to claim 22, characterized in that The receiving of the key application package sent by the certificate authentication center comprises: Receive a key application package sent by the certificate authentication center, wherein the key application package includes a terminal classic signature public key, a terminal temporary post-quantum encryption public key, a classic signature identifier associated with the terminal classic signature public key, a post-quantum signature identifier associated with the terminal post-quantum signature public key, a first classic signature value, and a first post-quantum signature value.

25. The method according to claim 24, characterized in that The method further comprises: Performing signature verification processing on the first classic signature value according to the classic signature algorithm associated with the terminal classic signature public key to obtain a first signature verification result; Performing signature verification processing on the first post-quantum signature value according to a post-quantum signature algorithm associated with the terminal post-quantum signature public key to obtain a second signature verification result; When both the first signature verification result and the second signature verification result are correct, a classical encryption key pair and a post-quantum encryption key pair are generated for the terminal.

26. The method according to claim 25, characterized in that The step of generating a key response package according to the key application package and sending the key response package to the certificate authentication center includes: Generate a first temporary key response packet according to the key application packet; Generate a second temporary key response packet according to the first temporary key response packet, the temporary symmetric key randomly generated by the key management system, and the classic encryption key pair; Generate a third temporary key response packet according to the second temporary key response packet and the post-quantum encryption key pair; Storing the classical signature identifier and the post-quantum signature identifier in the third temporary key response package to obtain a fourth temporary key response package; Processing the fourth temporary key response packet according to the classical signature algorithm and the post-quantum signature algorithm to obtain the key response packet; The key response packet is sent to the certificate authentication center.

27. The method according to claim 26, characterized in that The generating a second temporary key response package according to the first temporary key response package, the temporary symmetric key randomly generated by the key management system, and the classic encryption key pair comprises: Encrypting the private key in the classic encryption key pair according to the temporary symmetric key to obtain the classic encryption private key in the classic cryptographic envelope; Sign the temporary symmetric key according to the terminal classic signature public key to obtain the encrypted temporary symmetric key in the classic cryptographic envelope; The public key in the classic encryption key pair and the classic cryptographic envelope are stored in the first temporary key response package to obtain the second temporary key response package.

28. The method according to claim 26, characterized in that The generating a third temporary key response packet according to the second temporary key response packet and the post-quantum encryption key pair comprises: Concatenate the random number randomly generated by the key management system and the fixed string to obtain a third concatenated body; Performing post-quantum encryption processing on the third spliced ​​body to obtain a first encryption key; Performing post-quantum encryption encapsulation processing on the third spliced ​​body to obtain a first encapsulated message in a post-quantum cryptographic envelope; Encrypting the private key in the post-quantum encryption key pair according to the first encryption key to obtain the post-quantum encryption private key in the post-quantum cryptographic envelope; The public key in the post-quantum encryption key pair and the post-quantum cryptographic envelope are stored in the second temporary key response package to obtain a third temporary key response package.

29. The method according to claim 26, characterized in that The step of processing the fourth temporary key response packet according to the classical signature algorithm and the post-quantum signature algorithm to obtain the key response packet includes: Signing the fourth temporary key response packet according to the classic signature algorithm to obtain a second classic signature message; Performing post-quantum signature processing on the fourth temporary key response packet according to the post-quantum signature algorithm to obtain a second post-quantum signature message; The second classical signature message and the second post-quantum signature message are stored in the fourth temporary key response package to obtain the key response package.

Images