A method to enhance the quantum security of the Central Authentication Service Protocol

Abstract

The present application discloses a method for enhancing the anti-quantum security of a central authentication service protocol of a communication network. The method includes: sending a first resource access request to a server when accessing a resource in a server for the first time. Receive a login ticket and a login form obtained by the server according to the first resource access request. Obtain a first quantum key according to the login ticket. Obtain the authentication information of the terminal according to the login form. Process the authentication information according to the first quantum key and the post-quantum cryptographic algorithm to obtain the ticket request information, and send it to the server. Receive a service ticket generated by the server. Send a second resource access request generated according to the service ticket to the server, and the server confirms the access rights of the corresponding resource according to the second resource access request, so that the terminal can access the server's resources. The terminal and the server encrypt communication by using post-quantum cryptographic algorithms and quantum key distribution technology, significantly enhancing the ability to resist quantum computing attacks.

Description

Technical Field

[0001] The present application relates to the field of network security, and more specifically, to a method for enhancing quantum security of a central authentication service protocol of a communication network. Background Art

[0002] The leap in computing power represented by quantum computing has a significant impact on the security of related algorithms in classical cryptography. Understandably, with the realization of large-scale quantum computers, it will have a certain impact on key negotiation, encryption, signature and other applications in classical cryptography. Therefore, providing cryptographic technology that can resist quantum computing attacks has become an urgent problem to be solved. Summary of the invention

[0003] The present application provides a method for enhancing the quantum security of a central authentication service protocol of a communication network.

[0004] The embodiment of the present application provides a method for enhancing the anti-quantum security of a central authentication service protocol of a communication network, wherein the communication network includes a terminal and a server, and the method is used for the terminal, and the method includes:

[0005] When accessing a resource in the server for the first time, sending a first resource access request to the server;

[0006] receiving a login ticket and a login form obtained by the server according to the first resource access request;

[0007] Obtaining a first quantum key from a first network node connected to the terminal according to the login ticket;

[0008] Acquiring authentication information of the terminal according to the login form;

[0009] Processing the authentication information according to the first quantum key and the post-quantum cryptographic algorithm to obtain ticket request information, and sending the ticket request information to the server;

[0010] receiving a service ticket generated by the server according to the ticket request information;

[0011] A second resource access request generated according to the service ticket is sent to the server, and the server confirms access rights to resources corresponding to the second resource access request according to the second resource access request, so that the terminal accesses resources to the server.

[0012] In this way, during the communication process in which the terminal first applies to access resources in the server, the terminal uses the login ticket received from the server to apply to the first network node of the access terminal for a quantum key. The authentication information generated according to the login form received from the server is encrypted using the quantum key and the post-quantum cryptographic algorithm to generate ticket request information that can resist quantum computing attacks. The post-quantum cryptographic algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good resistance to quantum computing attacks. Next, the server generates a service ticket based on the ticket request information sent by the terminal and sends the service ticket to the terminal. Then, the terminal generates a resource access request based on the service ticket for accessing resources in the server. Finally, the server determines whether the terminal can access the resources corresponding to the resource access request by verifying the correctness of the service ticket. In this way, the ability to resist quantum computing attacks in the communication process in which the terminal applies to access server resources is enhanced through quantum key distribution technology and post-quantum cryptographic algorithms.

[0013] In certain embodiments, the method further comprises:

[0014] Sending the post-quantum public key of the terminal to the server.

[0015] In this way, the terminal sends its post-quantum public key to the server. In this way, the server obtains the post-quantum public key of the terminal for subsequent signature and verification processes. The post-quantum public key has good resistance to quantum computing attacks, which can make the transmitted data have good resistance to quantum computing attacks.

[0016] In some embodiments, obtaining a first quantum key from a first network node connected to the terminal according to the login ticket includes:

[0017] Using a service node to inject multiple keys into a cryptographic module of the terminal;

[0018] Sending a quantum key application to the service node according to the login ticket, wherein the quantum key application is protected by a protection key, and the protection key is a randomly used one from a plurality of keys injected into the cryptographic module;

[0019] receiving a quantum key encryption result obtained by the service node encrypting the first quantum key according to the protection key, where the first quantum key is distributed to the service node by a first network node connected to the service node;

[0020] The quantum key encryption result is decrypted to obtain the first quantum key.

[0021] In this way, the terminal uses the service node to charge multiple keys into the terminal's cryptographic module. Then, the terminal sends a quantum key application to the service node based on the authorization code received from the server. The quantum key application is protected by a protection key, which is a randomly used one of the multiple keys charged into the cryptographic module. Then, the terminal receives the quantum key encryption result obtained by the service node by encrypting the first quantum key according to the protection key. The first quantum key is generated by the first network node accessing the service node and distributed to the service node. Finally, the terminal decrypts the quantum key encryption result to obtain the first quantum key. In this way, the terminal obtains the first quantum key, which has good resistance to quantum computing attacks and can protect the communication between the terminal and the server from having good resistance to quantum computing attacks.

[0022] In some embodiments, the processing the authentication information according to the first quantum key and the post-quantum cryptographic algorithm to obtain ticket request information, and sending the ticket request information to the server includes:

[0023] Encrypting the authentication information according to the first quantum key to obtain encrypted authentication information;

[0024] Performing post-quantum signature processing on a temporary public key in a temporary key pair randomly generated by the terminal to obtain a temporary public key signature message;

[0025] The encrypted authentication information, the temporary public key signature message, the temporary public key, the login ticket and resource information of the resource corresponding to the first resource access request are sent to the server as ticket request information.

[0026] In this way, the terminal encrypts the authentication information according to the first quantum key to obtain encrypted authentication information. Then, the terminal performs post-quantum signature processing on the temporary public key in the temporary key pair randomly generated by the terminal to obtain a temporary public key signature message. Finally, the terminal sends the encrypted authentication information, the temporary public key signature message, the temporary public key, the login ticket, and the resource information of the resource corresponding to the first resource access request as ticket request information to the server. In this way, the terminal encrypts the authentication information using the first quantum key to obtain encrypted authentication information, so that the authentication information has good resistance to quantum computing attacks. And the temporary public key is signed with the post-quantum public key to ensure the integrity and authenticity of the temporary public key during transmission.

[0027] In some implementations, sending the second resource access request generated according to the service ticket to the server includes:

[0028] Concatenate the resource information and the verification random number randomly generated by the terminal to obtain a verification concatenation;

[0029] Signing the verification splice according to the temporary private key in the temporary key pair to obtain a verification signature message;

[0030] A verification message, the service ticket and the resource information are sent to the server as a second resource access request, wherein the verification message includes the verification signature message and the verification random number.

[0031] In this way, the terminal concatenates the resource information and the verification random number randomly generated by the terminal to obtain a verification concatenation. Then, the terminal performs post-quantum signature processing on the verification concatenation according to the temporary private key in the temporary key pair to obtain a verification signature message. Finally, the terminal sends the verification message, service ticket and resource information as a second resource access request to the server, and the verification message includes a verification signature message and a verification random number. In this way, the terminal signs the verification concatenation obtained by concatenating the resource information and the verification random number randomly generated by the terminal through the post-quantum signature algorithm to obtain a verification signature message, so that the second resource access request has good quantum resistance during the communication process between the terminal and the server, preventing the communication data from being accessed without authorization.

[0032] In certain embodiments, the method further comprises:

[0033] A ticket granting ticket is received from the server, where the ticket granting ticket is generated by the server according to the ticket request information.

[0034] In this way, the terminal receives the ticket authorization ticket sent by the server, and the ticket authorization ticket is generated by the server according to the ticket request information. In this way, the terminal obtains the ticket authorization ticket, and the terminal can simplify the process of obtaining the service ticket by using the ticket authorization ticket.

[0035] In certain embodiments, the method further comprises:

[0036] In case of non-first access to a resource in the server, sending a ticket-granting ticket to the server;

[0037] receiving a subsequent service ticket generated according to the ticket-granting ticket and sent by the server;

[0038] A third resource access request generated according to the subsequent service ticket is sent to the server, and the server confirms the access rights of the subsequent resources corresponding to the third resource access request according to the third resource access request, so that the terminal can access the subsequent resources in the server.

[0039] In this way, in the case of not accessing resources in the server for the first time, the terminal sends a ticket authorization ticket to the server. Then, the terminal receives a subsequent service ticket generated by the ticket authorization ticket and sent by the server. Finally, the terminal sends a third resource access request generated by the subsequent service ticket to the server, and the server confirms the access rights to the subsequent resources corresponding to the third resource access request based on the third resource access request, so that the terminal can access the subsequent resources in the server. In this way, in the case of not accessing resources in the server for the first time, the terminal uses the obtained ticket authorization ticket to obtain a subsequent service ticket from the server, thereby accessing the resources that need to be accessed, simplifying the process of the terminal obtaining subsequent service tickets. And because the ticket service ticket has anti-quantum capabilities, the communication process of obtaining subsequent service tickets based on the ticket authorization ticket has good anti-quantum computing attack capabilities.

[0040] The embodiment of the present application provides a method for enhancing the anti-quantum security of a central authentication service protocol of a communication network, wherein the communication network includes a terminal and a server, and the method is used for the server, and the method includes:

[0041] receiving a first resource access request sent by the terminal, where the first resource access request is generated by the terminal when accessing a resource in the server for the first time;

[0042] Acquire a second quantum key and a quantum key identifier from a second network node connected to the server;

[0043] Sending a login ticket and a login form to the terminal, wherein the login ticket is the quantum key identifier, and the login form is generated by the server according to the first resource access request;

[0044] Receiving ticket request information sent by the terminal obtained by processing authentication information according to a first quantum key and a post-quantum cryptographic algorithm, wherein the first quantum key is obtained by the terminal according to the login ticket, and the authentication information is obtained by the terminal according to the login form;

[0045] Generate a service ticket according to the ticket request information, and send the service ticket to the terminal;

[0046] A second resource access request generated by the terminal according to the service ticket is received, and access rights to resources corresponding to the second resource access request are confirmed so that the terminal can access resources on the server.

[0047] In this way, during the communication process in which the terminal first applies to access resources in the server, the terminal uses the login ticket received from the server to apply to the first network node of the access terminal for a quantum key. The authentication information generated according to the login form received from the server is encrypted using the quantum key and the post-quantum cryptographic algorithm to generate ticket request information that can resist quantum computing attacks. The post-quantum cryptographic algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good resistance to quantum computing attacks. Next, the server generates a service ticket based on the ticket request information sent by the terminal and sends the service ticket to the terminal. Then, the terminal generates a resource access request based on the service ticket for accessing resources in the server. Finally, the server determines whether the terminal can access the resources corresponding to the resource access request by verifying the correctness of the service ticket. In this way, the ability to resist quantum computing attacks in the communication process in which the terminal applies to access server resources is enhanced through quantum key distribution technology and post-quantum cryptographic algorithms.

[0048] In certain embodiments, the method further comprises:

[0049] Receive the post-quantum public key of the terminal sent by the terminal.

[0050] In this way, the server receives the terminal's own post-quantum public key sent by the terminal. In this way, the server obtains the terminal's post-quantum public key and can decrypt the communication data sent by the terminal based on the terminal's post-quantum public key. The post-quantum public key has good resistance to quantum computing attacks, and can make the data protected by the post-quantum public key have good resistance to quantum computing attacks.

[0051] In some embodiments, obtaining a second quantum key and a quantum key identifier from a second network node connected to the server includes:

[0052] Upon receiving the first resource access request, sending a quantum key application to a second network node connected to the server;

[0053] receiving the second quantum key and the quantum key identifier sent by the second network node, where the second quantum key is obtained by the second network node according to the quantum key application, and the quantum key identifier is obtained by the second network node identifying the second quantum key according to an identification code of the second network node.

[0054] In this way, when receiving the first resource access request, the server sends a quantum key application to the second network node accessing the server. Then, the server receives the second quantum key and quantum key identifier sent by the second network node. The second quantum key is obtained by the second network node according to the quantum key application, and the quantum key identifier is obtained by the second network node by identifying the second quantum key according to the identification code of the second network node. In this way, the server obtains the second quantum key and quantum key identifier. The second quantum key has good resistance to quantum computing attacks and can be used to make the communication between the terminal and the server have strong confidentiality. The quantum key identifier helps to manage and use quantum keys. Using the quantum key identifier as a login ticket has strong confidentiality.

[0055] In some embodiments, the ticket request information includes encrypted authentication information, a temporary public key signature message, a login ticket, and a temporary public key, and the method further includes:

[0056] confirming the usage of the second quantum key corresponding to the login ticket;

[0057] When the second quantum key is not used, decrypting the encrypted authentication information according to the second quantum key to obtain authentication information;

[0058] Performing signature verification on the temporary public key signature message according to the post-quantum public key to determine the correctness of the temporary public key;

[0059] When the authentication information is obtained, deleting the second quantum key to ensure that the second quantum key cannot be reused;

[0060] The temporary public key is divided into a first temporary public key and a second temporary public key.

[0061] In this way, the server first confirms the use of the second quantum key corresponding to the login ticket. When the second quantum key is not used, the server decrypts the encrypted authentication information according to the second quantum key to obtain the authentication information. Then, the server verifies the temporary public key signature message according to the post-quantum public key to determine the correctness of the temporary public key. When the authentication information is obtained, the server deletes the second quantum key to ensure that the second quantum key cannot be reused. In addition, the server also divides the temporary public key into a first temporary public key and a second temporary public key. In this way, by confirming that the quantum key corresponding to the login ticket has not been used for the previous login, the security of the authentication process is ensured and unauthorized access is prevented. And when the authentication information has been obtained, the second quantum key is deleted to ensure that the quantum key that has been used cannot be used again. In addition, the server also divides the temporary public key into a first temporary public key and a second temporary public key, which are used in subsequent processes to reduce potential security risks.

[0062] In some implementations, the ticket request information includes resource information, and generating a service ticket according to the ticket request information and sending the service ticket to the terminal includes:

[0063] generating a temporary ticket-granting ticket according to the resource information;

[0064] generating a first temporary service ticket based on the temporary ticket-granting ticket;

[0065] concatenating the temporary public key and the ticket-granting ticket attribute value in the first temporary service ticket to obtain a temporary concatenation, wherein the ticket-granting ticket attribute value is used to store relevant information related to the temporary ticket-granting ticket;

[0066] Performing post-quantum signature processing on the temporary splice according to the second post-quantum private key of the server to obtain a service ticket signature message;

[0067] Storing the service ticket signature message and the first temporary public key in the first temporary service ticket to obtain a second temporary service ticket;

[0068] Signing the second temporary service ticket according to the second classic public key of the server to obtain a service ticket, and sending the service ticket to the terminal;

[0069] The second temporary public key is cached and the first temporary public key is deleted.

[0070] In this way, the server generates a temporary ticket authorization ticket according to the resource information. Next, the server generates a first temporary service ticket according to the temporary ticket authorization ticket. Then, the server splices the temporary public key and the ticket authorization ticket attribute value in the first temporary service ticket to obtain a temporary splice, and the ticket authorization ticket attribute value is used to store the relevant information of the temporary ticket authorization ticket. The server then performs post-quantum signature processing on the temporary splice according to the server's second post-quantum private key to obtain a service ticket signature message. And the service ticket signature message and the first temporary public key are stored in the first temporary service ticket to obtain a second temporary service ticket. Finally, the server signs the second temporary service ticket according to the server's second classical public key to obtain a service ticket, and sends the service ticket to the terminal. In addition, the server caches the second temporary public key and deletes the first temporary public key. In this way, the server generates a first temporary service ticket, and uses the post-quantum signature algorithm and the classical signature algorithm to sign and protect the first temporary service ticket, so that the service ticket obtained by the signature protection processing has good confidentiality and quantum resistance. The server caches part of the temporary public key locally and deletes the other part to reduce potential security risks and maintain the integrity of the public key.

[0071] In some implementations, the receiving a second resource access request generated by the terminal according to the service ticket, and confirming access rights to a resource corresponding to the second resource access request so that the terminal accesses the resource to the server, includes:

[0072] receiving a second resource access request generated by the terminal according to the service ticket, wherein the second resource access request includes a verification message, the service ticket, and the resource information, and the verification message includes a verification signature message and a verification random number;

[0073] Performing signature verification processing on the verification signature message according to the second classic private key of the server to confirm that the service ticket is valid;

[0074] The second temporary public key and the received first temporary public key are synthesized to obtain the temporary public key;

[0075] Performing signature verification on the service ticket signature message according to the second post-quantum public key of the server to confirm that the ticket-granting ticket corresponding to the ticket-granting ticket attribute value is valid;

[0076] The correctness of the authentication information is confirmed according to the temporary public key; and if the authentication information is correct, the terminal is allowed to access resources of the server.

[0077] In this way, the server receives the second resource access request generated by the terminal according to the service ticket, the second resource access request includes a verification message, a service ticket and resource information, and the verification message includes a verification signature message and a verification random number. Next, the server verifies the verification signature message according to the second classical private key of the server to confirm that the service ticket is valid. Then, the server synthesizes the second temporary public key and the received first temporary public key to obtain a temporary public key. The server then verifies the service ticket signature message according to the second post-quantum public key of the server to confirm that the ticket authorization ticket corresponding to the ticket authorization ticket attribute value is valid. Finally, the server confirms the correctness of the authentication information according to the temporary public key; in the case where the authentication information is correct, the terminal is allowed to access the server's resources. In this way, by verifying the validity of the service ticket in the second resource access request, and verifying the service ticket signature message through the synthesized temporary public key to confirm that the ticket authorization ticket is valid. So that the server can ensure the authenticity of the terminal's identity, provide strong security and quantum security for resource access requests, and help protect the security of data and communications.

[0078] In certain embodiments, the method further comprises:

[0079] Signing the temporary ticket-granting ticket according to the second classic public key of the server to obtain a classic signed ticket-granting ticket;

[0080] Performing post-quantum signature processing on the temporary ticket authorization ticket according to the second post-quantum public key of the server to obtain a post-quantum signature ticket authorization ticket;

[0081] Storing the classical signature ticket-granting ticket and the post-quantum signature ticket-granting ticket in the temporary ticket-granting ticket to obtain a ticket-granting ticket;

[0082] The ticket-granting ticket is sent to the terminal.

[0083] In this way, the server signs the temporary ticket authorization ticket according to the server's second classical public key to obtain a classical signature ticket authorization ticket. Next, the server performs post-quantum signature processing on the temporary ticket authorization ticket according to its own second post-quantum public key to obtain a post-quantum signature ticket authorization ticket. Then, the server stores the classical signature ticket authorization ticket and the post-quantum signature ticket authorization ticket in the temporary ticket authorization ticket to obtain a ticket authorization ticket. Finally, the server sends the ticket authorization ticket to the terminal. In this way, the temporary ticket authorization ticket is signed by the classical signature algorithm and the post-quantum signature algorithm respectively to obtain a classical signature ticket authorization ticket and a post-quantum signature ticket authorization ticket. The classical signature ticket authorization ticket and the post-quantum signature ticket authorization ticket are then stored in the temporary ticket authorization ticket to obtain a ticket authorization ticket, so that the ticket authorization ticket has good quantum resistance and confidentiality.

[0084] In certain embodiments, the method further comprises:

[0085] In case of not first access to resources in the server, receiving a ticket granting ticket sent by the terminal;

[0086] generating a subsequent service ticket according to the ticket authorization ticket, and sending the subsequent service ticket to the terminal;

[0087] A third resource access request generated according to the subsequent service ticket and sent by the terminal is received, and access rights to subsequent resources corresponding to the third resource access request are confirmed, so that the terminal can access the subsequent resources of the server.

[0088] In this way, in the case of not the first access to resources in the server, the server receives the ticket authorization ticket sent by the terminal. Then, the server generates a subsequent service ticket based on the ticket authorization ticket, and sends the subsequent service ticket to the terminal. Finally, the server receives a third resource access request generated based on the subsequent service ticket sent by the terminal, and confirms the access rights to the subsequent resources corresponding to the third resource access request, so that the terminal can access the subsequent resources of the server. In this way, in the case of not the first access to resources in the server, the server generates a subsequent service ticket based on the received ticket authorization ticket, so that the terminal can access the resources in the server, which greatly simplifies the process of the terminal obtaining a service ticket, while having good quantum resistance and confidentiality.

[0089] In some implementations, generating a subsequent service ticket according to the ticket-granting ticket and sending the subsequent service ticket to the terminal includes:

[0090] Performing signature verification on the ticket-granting ticket according to the second classical public key and the second post-quantum public key to confirm the correctness of the ticket-granting ticket;

[0091] When confirming that the ticket-granting ticket is correct, a subsequent service ticket is sent to the terminal.

[0092] In this way, the server verifies the ticket authorization ticket according to the second classical public key and the second post-quantum public key to confirm the correctness of the ticket authorization ticket. When the ticket authorization ticket is confirmed to be correct, the server sends a subsequent service ticket to the terminal. In this way, by verifying the ticket authorization ticket, the correctness of the ticket authorization ticket is confirmed, and the subsequent service ticket is generated and distributed, the identity of the terminal is confirmed, and the security of the resources in the server is ensured.

[0093] Additional aspects and advantages of the embodiments of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the embodiments of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0094] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0095] Figure 1 It is one of the flow charts of the method of the implementation mode of the present application;

[0096] Figure 2 It is an architectural diagram of a method for implementing the present application;

[0097] Figure 3 is a signaling diagram of a method according to an embodiment of the present application;

[0098] Figure 4 This is the second flow chart of the method of the implementation mode of the present application;

[0099] Figure 5 This is the third flow chart of the method of the implementation mode of the present application;

[0100] Figure 6 This is the fourth flow chart of the method of the implementation mode of the present application;

[0101] Figure 7 This is the fifth flow chart of the method of the implementation mode of the present application;

[0102] Figure 8 This is the sixth flow chart of the method of the implementation mode of the present application;

[0103] Fig. 9 This is the seventh flow chart of the method of the implementation mode of the present application;

[0104] Fig.10 This is the eighth flow chart of the method of the implementation mode of the present application;

[0105] Fig.11 This is the ninth flow chart of the method of the implementation mode of the present application;

[0106] Fig.12 This is the tenth flowchart of the method of the implementation mode of the present application;

[0107] Fig.13 This is the eleventh flow chart of the method of the implementation mode of the present application;

[0108] Fig.14 This is the twelfth flow chart of the method of the implementation mode of the present application;

[0109] Fig.15 This is the thirteenth flow chart of the method of the implementation mode of the present application;

[0110] Fig.16 This is the fourteenth flow chart of the method of the implementation mode of the present application;

[0111] Fig.17 This is the fifteenth flowchart of the method of the implementation mode of the present application;

[0112] Fig.18 This is the sixteenth flow chart of the method of the implementation mode of the present application. DETAILED DESCRIPTION

[0113] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals represent the same or similar elements or elements having the same or similar functions from beginning to end. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the embodiments of the present application, and cannot be understood as limiting the embodiments of the present application.

[0114] The leap in computing power represented by quantum computing has a significant impact on the security of related algorithms in classical cryptography. In other words, quantum computing poses a more direct and urgent threat to the cracking of classical cryptography. A series of classical algorithms, such as the Diffie-Hellman algorithm, the RSA algorithm, and the elliptic curve (ECC) algorithm, face greater security risks because the number theory problems they are based on, such as large prime number decomposition and discrete logarithms, are no longer difficult in the quantum era. Understandably, with the realization of large quantum computers, it will have a certain impact on key negotiation, encryption, signature and other applications in classical cryptography.

[0115] As a result, the security of the Internet, which uses classical cryptographic algorithms to protect the communication process, is deeply threatened by quantum computing attacks. For example, the Central Authentication Service (CAS), a simple and powerful ticket-based protocol, is used to provide a centralized authentication service that can simplify the user authentication process and improve the security and user experience of the system. Among them, the CAS authentication client (CAS Client) is deployed together with the protected client application as part of the client application to handle authentication and authorization interactions with the CAS server. In the related technology, the interaction process between the CAS Client and the authentication server (CAS Server) is as follows:

[0116] For each resource access request to access protected resources, the CAS Client will analyze whether the request contains a service ticket (ST). If not, it means that the current user has not logged in, so the resource access request will be redirected to the designated authentication server login address and the resource address Service corresponding to the resource access request will be passed. Next, the user enters the authentication information. If the login is successful, the CAS Server randomly generates a service ticket ST of considerable length, unique, and unforgeable, and caches it for future verification. After that, the system automatically redirects to the address of the resource address Service and sets a ticket granting cookie (TGC) for the client browser. After the CAS Client obtains the address of the resource address Service and the newly generated service ticket, the CAS Server performs identity verification to ensure the legitimacy of the service ticket ST.

[0117] In the above interaction process between CAS Client and CAS Server, classic authentication technologies are used to authenticate and protect the communication data in the interaction process. These classic authentication technologies use classic public key encryption algorithms such as RSA algorithm and ECC algorithm. However, in this way, the central authentication service protocol does not have the ability to resist quantum computing attacks, and has a greater security risk when facing quantum computing attacks.

[0118] At present, the international technologies for dealing with the threat of quantum computing attacks are mainly divided into two categories: one is to use asymmetric algorithms for (symmetric) key negotiation and then encrypt and transmit through symmetric algorithms, and study the use of quantum key distribution (QKD) networks for symmetric key negotiation to protect the security of keys; the other is to study post-quantum cryptography (PQC) algorithms to directly replace existing asymmetric algorithms. Quantum key distribution technology uses the principles of quantum mechanics to generate keys that cannot be stolen by third parties, ensuring the security of key transmission. It is particularly suitable for key exchange scenarios and can replace existing asymmetric key negotiation algorithms, such as RSA or ECC, to improve the security of keys. However, quantum key distribution technology cannot currently completely replace all applications of asymmetric algorithms. For example, scenarios such as signature verification, integrity protection, and non-repudiation still require the use of asymmetric algorithms.

[0119] Post-quantum cryptographic algorithms are asymmetric cryptographic algorithms designed based on new mathematical problems, aiming to resist the possible threats posed by quantum computers. NIST has announced the first batch of four post-quantum cryptographic algorithms to be standardized, including Kyber, Dilithium, Falcon, and SPHINCS+. These algorithms cover a variety of technical routes to reduce the risk of a single technology being cracked. Post-quantum cryptographic algorithms can theoretically replace all asymmetric algorithms and are more general. However, the security of post-quantum cryptographic algorithms still depends on the complexity of computational problems, and may face new cracking methods in the future or become unsafe as computing power increases. In addition, the post-quantum cryptographic algorithm standard has not yet been officially announced, and the production and certification of related products also take time, so its large-scale application still requires a long period of time.

[0120] Both post-quantum cryptographic algorithms and quantum key distribution technologies have the ability to resist quantum computing attacks, but each has its limitations. Therefore, providing relatively low-cost and highly secure cryptographic technology that can resist quantum computing attacks has become an urgent problem to be solved.

[0121] Based on the above questions, please refer to Figure 1 The embodiment of the present application provides a method for enhancing the anti-quantum security of a central authentication service protocol of a communication network, wherein the communication network includes a terminal and a server, and the method is used in the terminal, and the method includes:

[0122] 011: when accessing resources in the server for the first time, sending a first resource access request to the server;

[0123] 012: receiving the login ticket and login form obtained by the server according to the first resource access request;

[0124] 013: Obtain a first quantum key from a first network node of the access terminal according to the login ticket;

[0125] 014: Obtain the terminal's authentication information based on the login form;

[0126] 015: Process the authentication information according to the first quantum key and the post-quantum cryptographic algorithm to obtain the ticket request information, and send the ticket request information to the server;

[0127] 016: Receive the service ticket generated by the server according to the ticket request information;

[0128] 017: Send a second resource access request generated according to the service ticket to the server, and the server confirms the access rights of the resource corresponding to the second resource access request according to the second resource access request, so that the terminal can access the resource of the server.

[0129] The embodiment of the present application also provides a terminal, including a memory and a processor. The method of the embodiment of the present application can be implemented by the terminal of the embodiment of the present application. Specifically, a computer program is stored in the memory, and the processor is used to send a first resource access request to the server when accessing resources in the server for the first time. And receive the login ticket and login form obtained by the server according to the first resource access request. And obtain the first quantum key from the first network node of the access terminal according to the login ticket. The processor is also used to obtain the authentication information of the terminal according to the login form. And process the authentication information according to the first quantum key and the post-quantum cryptographic algorithm to obtain the ticket request information, and send the ticket request information to the server. And receive the service ticket generated by the server according to the ticket request information and send the second resource access request generated according to the service ticket to the server.

[0130] The embodiment of the present application also provides a terminal security enhancement device. The method of the embodiment of the present application can be implemented by the terminal security enhancement device of the embodiment of the present application. Specifically, the terminal security enhancement device includes a sending module, a receiving module, an acquisition module, a processing module, a receiving module and a sending module. The sending module is used to send a first resource access request to the server when accessing a resource in the server for the first time. The receiving module is used to receive a login ticket and a login form obtained by the server according to the first resource access request. The acquisition module is used to obtain a first quantum key from the first network node of the access terminal according to the login ticket, and to obtain the authentication information of the terminal according to the login form. The processing module is used to process the authentication information according to the first quantum key and the post-quantum cryptographic algorithm to obtain the ticket request information, and send the ticket request information to the server. The receiving module is used to receive a service ticket generated by the server according to the ticket request information. The sending module sends a second resource access request generated according to the service ticket to the server.

[0131] The present application provides a communication system based on a central authentication service protocol, the communication system comprising a terminal, a server and a quantum key distribution network of the above-mentioned implementation mode, and the quantum key distribution network is configured to distribute quantum keys to the terminal or the server.

[0132] Specifically, the terminal is the user end of the CAS protocol, and is a user who needs to access related resources in the CAS application scenario. The server includes an authentication server and a resource server. The authentication server is a server used to process authentication requests and issue tokens for authorized access to related resources in the CAS application scenario, and the resource server is a server that provides accessed resources and their services. The resource server and the authentication server can be the same server or different servers. The same or different servers have no substantial effect on the anti-quantum enhancement method of the present application. In practical applications, whether to choose the same server or different servers depends on specific needs, security considerations and budgets. In the embodiments of the present application, the resource server and the authentication server are deployed in different locations on the same server.

[0133] The quantum key distribution network includes network nodes and a quantum network link control center. Network nodes are used to store and distribute quantum keys in the quantum key distribution network. The quantum network link center can establish quantum key distribution and relay links between network nodes according to the names of network nodes. Quantum key distribution and relay links are used for data transfer and other functions. The quantum key distribution network is used to realize services such as quantum key generation, quantum key relay, and quantum key provision.

[0134] See also Figure 2 In some embodiments, when the terminal sends a resource access request to the resource server for the first time, the resource server redirects the terminal to the authentication server. Through the ticket request and response between the client and the authentication server, the client obtains the service ticket issued by the authentication server to initiate a resource access application to the resource server. After receiving the service ticket sent by the client, the resource server sends the service ticket to the authentication server so that the authentication server authenticates the user according to the service ticket, thereby allowing access to the resources corresponding to the resource access application. The terminal accesses a service node, which is a transfer station used by the terminal to connect to the network node, and is used to inject keys into the terminal and transfer and store quantum keys. When the terminal sends a quantum key application, the network node sends the quantum key generated by the quantum key distribution network to the service node accessing the terminal, and the service node then sends the quantum key to the terminal. The simple process of the terminal and the authentication server obtaining the quantum key is as follows: First, the authentication server sends a quantum key application to the second network node accessing the server. Then, the second network node distributes the quantum key generated according to the quantum key application to the server. At the same time, the quantum network link control center synchronizes the first network node of the access terminal to generate a quantum key, but the quantum key will not be distributed to the access terminal immediately, but will be stored in the network node first. The corresponding relationship between the above terminals, authentication servers, service nodes and network nodes is provided by the management and control platform.

[0135] It should be noted that the implementation method of this application uses FIPS203 Module-Lattice-based Key-Encapsulation Mechanism Standard as the PQC key encapsulation algorithm and FIPS 204 Module-Lattice-Based Digital Signature Standard as the PQC digital signature algorithm for explanation. The following descriptions of operations related to the PQC algorithm refer to the above FIPS standards. Of course, in other implementations, other algorithms such as the NewHope algorithm, Sidh algorithm, HQC algorithm, etc. can also be used as PQC related algorithms. It should also be noted that the embodiments of this application are for the Central Authentication Service (CAS) protocol, hereinafter referred to as the CAS protocol.

[0136] Specifically, the login form usually includes a username and password input box for collecting the user's authentication information. The authentication information includes the username and password entered by the user.

[0137] When accessing resources in the server for the first time, the terminal sends a first resource access request to the server. Since it is the first time for the terminal to access the server, the terminal does not have a service ticket, so the server obtains the second quantum key and quantum key identifier from the second network node connected to the server. The quantum key identifier is used as a login ticket and returned to the terminal together with the login form generated according to the first resource access request.

[0138] After receiving the login ticket and login form sent by the server, the terminal sends a quantum key application to the first network node of the access terminal according to the login ticket to obtain the first quantum key. And the terminal obtains the authentication information of the terminal according to the login form. After that, the terminal performs a series of processing on the authentication information according to the first quantum key and the post-quantum cryptographic algorithm to obtain the ticket request information, and sends the ticket request information to the server.

[0139] After receiving the ticket request information sent by the terminal, the server generates a service ticket according to the ticket request information and then returns the service ticket to the terminal.

[0140] After receiving the service ticket, the terminal may generate a second resource access request according to the service ticket, and send the second resource access request to the server.

[0141] After the server receives the second resource access request, since the second resource access request carries the service ticket, the server can allow the terminal to access the resource corresponding to the second resource access request on the server after completing a series of processing.

[0142] The following is an example to illustrate the method of the implementation method of the present application. In the embodiment of the present application, the terminal is a user end of the CAS protocol, and a user who needs to access related resources in the CAS application scenario. The server is a server of the CAS protocol, including an authentication server and a resource server. The authentication server is a server used to process authentication requests and issue tokens for authorizing access to related resources in the CAS application scenario, and the resource server is a server that provides accessed resources and their services.

[0143] The network node is a quantum network node, which stores and provides the generated quantum key to the server through a trusted channel or provides the generated quantum key to the client through a key service node. The service node is a key service node, which is used to connect to the quantum network node and provide pre-shared key injection and quantum key services to the client.

[0144] See also Figure 3 , when accessing resources in the server for the first time, the user terminal sends a first resource access request to the resource server. Since it is the first time for the user terminal to access the resource server, the user terminal does not provide a service ticket, and the resource server redirects the user to the authentication server. The authentication server obtains the second quantum key QK_UUID-2 and the quantum key identifier UUID_QK from the second quantum network node accessing the server. The quantum key identifier UUID_QK is used as a login ticket and returned to the user terminal together with the login form generated according to the first resource access request.

[0145] After the user terminal receives the login ticket and login form sent by the authentication server, it sends a quantum key application to the first quantum network node connected to the user terminal according to the login ticket to obtain the first quantum key QK_UUID-1. And the user terminal obtains the authentication information entered by the user in the login form. After that, the user terminal performs a series of processing on the authentication information according to the first quantum key QK_UUID-1 and the post-quantum cryptographic algorithm to obtain the ticket request information, and sends the ticket request information to the authentication server.

[0146] After receiving the ticket request information sent by the client, the authentication server generates a service ticket (ST) based on the ticket request information and then returns the service ticket (ST) to the client.

[0147] After receiving the service ticket (ST), the user terminal may generate a second resource access request according to the service ticket (ST) and send the second resource access request to the resource server.

[0148] After receiving the second resource access request, the resource server submits the second resource access request to the authentication server because the second resource access request carries a service ticket (ST). After the authentication server completes the verification process, it can allow the user client to access the resource corresponding to the second resource access request on the resource server.

[0149] In summary, in the anti-quantum security enhancement method, communication system, terminal and server of the central authentication service protocol of the communication network of the implementation mode of the present application, for the communication process in which the terminal first applies to access resources in the server, the terminal uses the login ticket received from the server to apply for a quantum key from the first network node of the access terminal. And the authentication information generated according to the login form received from the server is encrypted using the quantum key and the post-quantum cryptographic algorithm to generate a ticket request information that can resist quantum computing attacks. The post-quantum cryptographic algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good resistance to quantum computing attacks. Next, the server generates a service ticket according to the ticket request information sent by the terminal, and sends the service ticket to the terminal. Then, the terminal generates a resource access request based on the service ticket for accessing resources in the server. Finally, the server determines whether the terminal can access the resources corresponding to the resource access request by verifying the correctness of the service ticket. In this way, the anti-quantum computing attack capability of the communication process in which the terminal applies to access server resources is enhanced by quantum key distribution technology and post-quantum cryptographic algorithms.

[0150] See also Figure 4 In some embodiments, the method further comprises:

[0151] 018: Send the terminal's post-quantum public key to the server.

[0152] In some embodiments, the sending module is used to send the post-quantum public key of the terminal to the server.

[0153] In some embodiments, the processor is further configured to send the post-quantum public key of the terminal to the server.

[0154] Specifically, the terminal sends the terminal's post-quantum public key to the server. In this way, the server obtains the terminal's post-quantum public key for subsequent signature and verification processes. The post-quantum public key has good resistance to quantum computing attacks, which can make the transmitted data have good resistance to quantum computing attacks.

[0155] Continuing with the above example, the post-quantum public key is the PQC public key. Figure 3 Before the user sends the first resource access request to the authentication server, the user registers its own PQC public key with the authentication server.

[0156] In this way, the authentication server obtains the user's PQC public key for subsequent signing and verification processes. The PQC public key has good resistance to quantum computing attacks, which can make the transmitted data have good resistance to quantum computing attacks.

[0157] See also Figure 5 In some embodiments, step 013 (obtaining a first quantum key from a first network node of an access terminal according to a login ticket) includes:

[0158] 0131: Use the service node to inject multiple keys into the terminal's cryptographic module;

[0159] 0132: Send quantum key request to service node according to login ticket;

[0160] 0133: receiving a quantum key encryption result obtained by the service node encrypting the first quantum key according to the protection key;

[0161] 0134: Decrypt the quantum key encryption result to obtain a first quantum key.

[0162] In some embodiments, the charging module is used to charge a plurality of keys to the cryptographic module of the terminal using the service node. The sending module is used to send a quantum key application to the service node according to the login ticket. The receiving module is used to receive a quantum key encryption result obtained by the service node encrypting the first quantum key according to the protection key. The decryption module is used to decrypt the quantum key encryption result to obtain the first quantum key.

[0163] In some embodiments, the processor is further configured to use the service node to charge a plurality of keys to the cryptographic module of the terminal, and to send a quantum key application to the service node according to the login ticket, wherein the quantum key application is protected by the protection key. The processor is further configured to receive a quantum key encryption result obtained by the service node encrypting the first quantum key according to the protection key, and to decrypt the quantum key encryption result to obtain the first quantum key.

[0164] Specifically, the terminal uses the service node to charge multiple keys into the terminal's cryptographic module. Then, the terminal sends a quantum key application to the service node based on the authorization code received from the server. The quantum key application is protected by a protection key, which is a randomly used one of the multiple keys charged into the cryptographic module. Then, the terminal receives the quantum key encryption result obtained by the service node by encrypting the first quantum key according to the protection key. The first quantum key is generated by the first network node accessing the service node and distributed to the service node. Finally, the terminal decrypts the quantum key encryption result to obtain the first quantum key. In this way, the terminal obtains the first quantum key, which has good resistance to quantum computing attacks and can protect the communication between the terminal and the server from having good resistance to quantum computing attacks.

[0165] Continuing with the above example, please refer again to Figure 3 , the user end uses the key service node to charge the pre-shared key to the personal password module in the user end, with a total of 1M bits of 128-bit keys. The personal password module includes but is not limited to the smart password key (HSM) and the virtual security module (VSM). Then, the client sends a quantum key application to the key service node based on the login ticket, and randomly uses a key in the smart password key as the protection key. The client performs a hash operation (Hash-basedMessage Authentication Code, HMAC) on the key ID and the application content by using the SM3 algorithm and the protection key. Afterwards, the key service node also performs a hash operation on the key ID and the application content by using the SM3 algorithm and the protection key to verify the integrity and authenticity of the data. HMAC is a method that uses hash functions and keys to provide data integrity and source authentication.

[0166] After the quantum key application is confirmed successfully, the user end receives the quantum key encryption result obtained by the key service node by encrypting the first quantum key QK_UUID-1 according to the protection key. The first quantum key QK_UUID-1 is generated by the first quantum network node connected to the key service node and distributed to the key service node. The user end then decrypts the quantum key encryption result according to the protection key to obtain the first quantum key QK_UUID-1.

[0167] In this way, the user terminal obtains the first quantum key QK_UUID-1, which has good resistance to quantum computing attacks and can protect the communication between the user terminal and the authentication server.

[0168] See also Figure 6In some embodiments, step 015 (processing the authentication information according to the first quantum key and the post-quantum cryptographic algorithm to obtain the ticket request information, and sending the ticket request information to the server) includes:

[0169] 0151: Encrypt the authentication information according to the first quantum key to obtain encrypted authentication information;

[0170] 0152: Perform post-quantum signature processing on the temporary public key in the temporary key pair randomly generated by the terminal to obtain a temporary public key signature message;

[0171] 0153: Send the encrypted authentication information, the temporary public key signature message, the temporary public key, the login ticket and the resource information of the resource corresponding to the first resource access request as ticket request information to the server.

[0172] In some embodiments, the encryption module is used to encrypt the authentication information according to the first quantum key to obtain the encrypted authentication information. The signature module is used to perform post-quantum signature processing on the temporary public key in the temporary key pair randomly generated by the terminal to obtain a temporary public key signature message. The processing module is used to send the encrypted authentication information, the temporary public key signature message, the temporary public key, the login ticket, and the resource information of the resource corresponding to the first resource access request as ticket request information to the server.

[0173] In some embodiments, the processor is further configured to encrypt the authentication information according to the first quantum key to obtain encrypted authentication information, and perform post-quantum signature processing on the temporary public key in the temporary key pair randomly generated by the terminal to obtain a temporary public key signature message, and send the encrypted authentication information, the temporary public key signature message, the temporary public key, the login ticket, and the resource information of the resource corresponding to the first resource access request as ticket request information to the server.

[0174] Specifically, the terminal encrypts the authentication information according to the first quantum key to obtain encrypted authentication information. Then, the terminal performs post-quantum signature processing on the temporary public key in the temporary key pair randomly generated by the terminal to obtain a temporary public key signature message. Finally, the terminal sends the encrypted authentication information, the temporary public key signature message, the temporary public key, the login ticket, and the resource information of the resource corresponding to the first resource access request as ticket request information to the server. In this way, the terminal encrypts the authentication information using the first quantum key to obtain encrypted authentication information, so that the authentication information has good resistance to quantum computing attacks. And the temporary public key is signed with the post-quantum public key to ensure the integrity and authenticity of the temporary public key during transmission.

[0175] Continuing with the above example, the temporary key pair includes a temporary public key and a temporary private key.

[0176] Please refer to Figure 3 , after the user terminal obtains the first quantum key QK_UUID-1 according to the login ticket, the user terminal encrypts the authentication information m1 according to the first quantum key QK_UUID-1 to obtain the encrypted authentication information M1. Next, the user terminal performs post-quantum signature processing on the temporary public key in the temporary key pair randomly generated by the user terminal to obtain a temporary public key signature message M2. In some embodiments, a pair of temporary key pairs is randomly generated using the ECC algorithm, the temporary public key is an ECC temporary public key, and the temporary private key is an ECC temporary private key. Finally, the user terminal sends the encrypted authentication information M1, the temporary public key signature message M2, the temporary public key, the login ticket, and the resource information Z1 of the resource corresponding to the first resource access request as ticket request information to the server.

[0177] In this way, the user end encrypts the authentication information m1 using the first quantum key QK_UUID-1 to obtain the encrypted authentication information M1, so that the authentication information m1 has good resistance to quantum computing attacks. And the temporary public key is signed using the post-quantum public key to ensure the integrity and authenticity of the temporary public key during transmission.

[0178] See also Figure 7 In some implementations, step 017 (sending a second resource access request generated according to the service ticket to the server) includes:

[0179] 0171: concatenate the resource information and the verification random number randomly generated by the terminal to obtain a verification concatenation;

[0180] 0172: Sign the verification concatenation according to the temporary private key in the temporary key pair to obtain a verification signature message;

[0181] 0173: Send the verification message, service ticket and resource information as the second resource access request to the server, where the verification message includes a verification signature message and a verification random number.

[0182] In some embodiments, the splicing module is used to splice the resource information and the verification random number randomly generated by the terminal to obtain a verification splice. The signature module is used to sign the verification splice according to the temporary private key in the temporary key pair to obtain a verification signature message. The processing module is used to send the verification message, the service ticket and the resource information as a second resource access request to the server.

[0183] In some embodiments, the processor is further configured to concatenate the resource information and the verification random number randomly generated by the terminal to obtain a verification concatenation, and to sign the verification concatenation according to the temporary private key in the temporary key pair to obtain a verification signature message, and to send the verification message, the service ticket, and the resource information to the server as a second resource access request.

[0184] Specifically, the terminal concatenates the resource information and the verification random number randomly generated by the terminal to obtain a verification concatenation. Then, the terminal performs post-quantum signature processing on the verification concatenation according to the temporary private key in the temporary key pair to obtain a verification signature message. Finally, the terminal sends the verification message, service ticket and resource information as a second resource access request to the server, and the verification message includes a verification signature message and a verification random number. In this way, the terminal signs the verification concatenation obtained by concatenating the resource information and the verification random number randomly generated by the terminal through the post-quantum signature algorithm to obtain a verification signature message, so that the second resource access request has good quantum resistance during the communication process between the terminal and the server, preventing the communication data from being accessed without authorization.

[0185] Continuing with the above example, see Figure 3 , the user end concatenates the resource information Z1 and the verification random number R1 randomly generated by the user end to obtain the verification concatenation T1. Then, the user end performs post-quantum signature processing on the verification concatenation T1 according to the temporary private key in the temporary key pair to obtain the verification signature message M3. Finally, the user end sends the verification message, the service ticket ST and the resource information Z1 as the second resource access request to the resource server. The verification message includes the verification signature message M3 and the verification random number R1.

[0186] In this way, the user end signs the verification concatenation obtained by concatenating the resource information Z1 and the verification random number R1 randomly generated by the user end through the post-quantum signature algorithm, and signs the verification signature message M3 obtained by the signature process, so that the second resource access request has good quantum resistance during the communication process between the user end and the resource server, preventing the communication data from being accessed without authorization.

[0187] See also Figure 8 In some embodiments, the method further comprises:

[0188] 019: Receive the ticket-granting ticket sent by the server.

[0189] In some implementations, the receiving module is configured to receive a ticket-granting ticket sent by a server.

[0190] In some embodiments, the processor is further configured to receive a ticket granting ticket sent by the server.

[0191] Specifically, the terminal receives the ticket authorization ticket sent by the server, and the ticket authorization ticket is generated by the server according to the ticket request information. In this way, the terminal obtains the ticket authorization ticket, and using the ticket authorization ticket, the terminal can simplify the process of obtaining the service ticket ST.

[0192] Continuing with the above example, please refer again to Figure 3 , the client receives the Ticket Granting Ticket (TGT) sent by the authentication server. The Ticket Granting Ticket TGT is generated by the authentication server based on the ticket request information.

[0193] In this way, the user terminal obtains the ticket granting ticket TGT. By using the ticket granting ticket TGT, the user terminal can simplify the process of obtaining the service ticket ST.

[0194] See also Fig. 9 In some embodiments, the method further comprises:

[0195] 020: Send a ticket granting ticket to the server when it is not the first time to access resources in the server;

[0196] 021: Receive the subsequent service ticket generated by the server based on the ticket granting ticket;

[0197] 022: Send a third resource access request generated according to the subsequent service ticket to the server. The server confirms the access rights of the subsequent resources corresponding to the third resource access request according to the third resource access request, so that the terminal can access the subsequent resources in the server.

[0198] In some embodiments, the sending module is used to send a ticket authorization ticket to the server when it is not the first time to access the resources in the server. The receiving module is also used to receive a subsequent service ticket generated according to the ticket authorization ticket and sent by the server. The sending module is also used to send a third resource access request generated according to the subsequent service ticket to the server, and the server confirms the access rights of the subsequent resources corresponding to the third resource access request according to the third resource access request, so that the terminal can access the subsequent resources in the server.

[0199] In some embodiments, the processor is further configured to, when it is not the first time to access the resources in the server, send a ticket authorization ticket to the server, receive a subsequent service ticket generated according to the ticket authorization ticket and send a third resource access request generated according to the subsequent service ticket to the server, and the server confirms the access rights of the subsequent resources corresponding to the third resource access request according to the third resource access request, so that the terminal can access the subsequent resources in the server.

[0200] Specifically, the subsequent resource corresponding to the third resource access request may be the same as or different from the resource corresponding to the second resource access request. The subsequent service ticket may also be the same as or different from the service ticket.

[0201] In the case of non-first access to resources in the server, the terminal sends a ticket authorization ticket to the server. Then, the terminal receives a subsequent service ticket generated by the ticket authorization ticket and sent by the server. Finally, the terminal sends a third resource access request generated by the subsequent service ticket to the server, and the server confirms the access rights to the subsequent resources corresponding to the third resource access request based on the third resource access request, so that the terminal can access the subsequent resources in the server. In this way, in the case of non-first access to resources in the server, the terminal uses the obtained ticket authorization ticket to obtain a subsequent service ticket from the server, thereby accessing the resources that need to be accessed, simplifying the process of the terminal obtaining a service ticket. And because the ticket service ticket has anti-quantum capabilities, the communication process of obtaining a service ticket based on the ticket authorization ticket has good resistance to quantum computing attacks.

[0202] Continuing with the above example, please refer again to Figure 3 , in the case of non-first access to resources in the server, that is, when the user terminal accesses other resources in the resource server or accesses the second resource corresponding to the second resource access request again outside the Cookie validity period of the service ticket ST, the user terminal sends a ticket authorization ticket TGT to the authentication server. Then, the user terminal receives the subsequent service ticket ST-2 generated by the authentication server based on the ticket authorization ticket TGT. Finally, the user terminal sends a third resource access request generated based on the subsequent service ticket ST-2 to the resource server, and the resource server submits the third resource access request to the authentication server. Based on the third resource access request, the authentication server confirms the access rights of the subsequent resources corresponding to the third resource access request, so that the user terminal can access the subsequent resources in the resource server.

[0203] In this way, when it is not the first time to access the resources in the server, the user end uses the obtained ticket authorization ticket TGT to obtain the subsequent service ticket ST-2 from the server, thereby accessing the resources that need to be accessed, simplifying the process of the user end obtaining the subsequent service ticket ST-2. And because the ticket service ticket TGT has quantum resistance, the communication process of obtaining the subsequent service ticket ST-2 according to the ticket authorization ticket TGT has good resistance to quantum computing attacks.

[0204] See also Fig.10 The embodiment of the present application provides a method for enhancing the anti-quantum security of a central authentication service protocol of a communication network, wherein the communication network includes a terminal and a server, and the method is used for the server, and the method includes:

[0205] 031: receiving a first resource access request sent by a terminal, where the first resource access request is generated when the terminal accesses a resource in a server for the first time;

[0206] 032: Obtain a second quantum key and a quantum key identifier from a second network node of the access server;

[0207] 033: Sending a login ticket and a login form to the terminal, where the login ticket is a quantum key identifier, and the login form is generated by the server according to the first resource access request;

[0208] 034: ticket request information sent by the receiving terminal obtained by processing the authentication information according to the first quantum key and the post-quantum cryptographic algorithm;

[0209] 035: Generate a service ticket according to the ticket request information and send the service ticket to the terminal;

[0210] 036: Receive a second resource access request generated by the terminal according to the service ticket, and confirm access rights to the resource corresponding to the second resource access request, so that the terminal can access the resource of the server.

[0211] The embodiment of the present application also provides a server, including a memory and a processor. The method of the embodiment of the present application can be implemented by the server of the embodiment of the present application. Specifically, a computer program is stored in the memory, and the processor is used to receive a first resource access request sent by a terminal. And obtain a second quantum key and a quantum key identifier from a second network node of the self-access server. And send a login ticket and a login form to the terminal. The processor is also used to receive a ticket request information sent by the terminal obtained by processing the authentication information according to the first quantum key and the post-quantum cryptographic algorithm. And generate a service ticket according to the ticket request information, and send the service ticket to the terminal. And receive the second resource access request generated by the terminal according to the service ticket, confirm the access rights of the resource corresponding to the second resource access request, so that the terminal can access the server resources.

[0212] The embodiment of the present application also provides a server security enhancement device. The method of the embodiment of the present application can be implemented by the server security enhancement device of the embodiment of the present application. Specifically, the server security enhancement device includes a receiving module, an acquisition module, a sending module and a generating module. The receiving module is used to receive a first resource access request sent by a terminal. The acquisition module is used to obtain a second quantum key and a quantum key identifier from a second network node of the access server. The sending module is used to send a login ticket and a login form to the terminal. The receiving module is also used to receive ticket request information sent by the terminal, which is obtained by processing the authentication information according to the first quantum key and the post-quantum cryptographic algorithm. The generating module is also used to generate a service ticket according to the ticket request information, and send the service ticket to the terminal. The receiving module is also used to receive a second resource access request generated by the terminal according to the service ticket, and confirm the access rights of the resources corresponding to the second resource access request, so that the terminal can access the server resources.

[0213] The present application provides a communication system based on a central authentication service protocol, the communication system comprising a server, a terminal and a quantum key distribution network of the above-mentioned implementation mode, and the quantum key distribution network is configured to distribute quantum keys to the terminal or the server.

[0214] Specifically, the anti-quantum security enhancement method of this embodiment is basically the same as the anti-quantum security enhancement method of the aforementioned embodiment with the terminal as the execution object. For details, please refer to the explanation of the corresponding part. The difference is that this embodiment takes the server as the execution object, which will not be repeated here.

[0215] In summary, in the anti-quantum security enhancement method, communication system, terminal and server of the central authentication service protocol of the communication network of the implementation mode of the present application, for the communication process in which the terminal first applies to access resources in the server, the terminal uses the login ticket received from the server to apply for a quantum key from the first network node of the access terminal. And the authentication information generated according to the login form received from the server is encrypted using the quantum key and the post-quantum cryptographic algorithm to generate a ticket request information that can resist quantum computing attacks. The post-quantum cryptographic algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good resistance to quantum computing attacks. Next, the server generates a service ticket according to the ticket request information sent by the terminal, and sends the service ticket to the terminal. Then, the terminal generates a resource access request based on the service ticket for accessing resources in the server. Finally, the server determines whether the terminal can access the resources corresponding to the resource access request by verifying the correctness of the service ticket. In this way, the anti-quantum computing attack capability of the communication process in which the terminal applies to access server resources is enhanced by quantum key distribution technology and post-quantum cryptographic algorithms.

[0216] See also Fig.11In some embodiments, the method further comprises:

[0217] 037: The post-quantum public key of the terminal sent by the receiving terminal.

[0218] In some embodiments, the receiving module is further used to receive the post-quantum public key of the terminal sent by the terminal.

[0219] In some embodiments, the processor is further configured to receive a post-quantum public key of the terminal sent by the terminal.

[0220] Specifically, the server receives the terminal's own post-quantum public key sent by the terminal. In this way, the server obtains the terminal's post-quantum public key and can decrypt the communication data sent by the terminal based on the terminal's post-quantum public key. The post-quantum public key has good resistance to quantum computing attacks, and can make the data protected by the post-quantum public key have good resistance to quantum computing attacks.

[0221] Continuing with the above example, the post-quantum public key is the PQC public key. Figure 3 , the authentication server receives the PQC public key of the user sent by the user.

[0222] In this way, the authentication server obtains the PQC public key of the user end and can decrypt the communication data sent by the user end according to the PQC public key of the user end. The PQC public key has good resistance to quantum computing attacks, which can make the data protected by the PQC public key have good resistance to quantum computing attacks.

[0223] See also Fig.12 In some embodiments, step 032 (obtaining a second quantum key and a quantum key identifier from a second network node accessing the server) includes:

[0224] 0321: upon receiving the first resource access request, sending a quantum key application to a second network node of the access server;

[0225] 0322: Receive a second quantum key and a quantum key identifier sent by a second network node.

[0226] In some embodiments, the sending module is further configured to send a quantum key application to a second network node of the access server when receiving the first resource access request. The receiving module is further configured to receive a second quantum key and a quantum key identifier sent by the second network node.

[0227] In some embodiments, the processor is further configured to, upon receiving the first resource access request, send a quantum key application to a second network node of the access server, and receive a second quantum key and a quantum key identifier sent by the second network node.

[0228] Specifically, when receiving the first resource access request, the server sends a quantum key application to the second network node accessing the server. Then, the server receives the second quantum key and quantum key identifier sent by the second network node. The second quantum key is obtained by the second network node according to the quantum key application, and the quantum key identifier is obtained by the second network node by identifying the second quantum key according to the identification code of the second network node. In this way, the server obtains the second quantum key and quantum key identifier. The second quantum key has good resistance to quantum computing attacks and can be used to make the communication between the terminal and the server have strong confidentiality. The quantum key identifier helps to manage and use quantum keys. Using the quantum key identifier as a login ticket has strong confidentiality.

[0229] Continuing with the above example, see Figure 3 Before communicating with the user, the authentication server accesses the second quantum network node with the closest physical distance and completed authorization through a trusted channel. A trusted channel refers to a mechanism or protocol that provides a secure communication path between two communicating entities. One way to establish it is that the authentication server and the second quantum network node are in the same cabinet and directly connected by a shielded network cable. This channel ensures the confidentiality, integrity and availability of data during transmission, preventing unauthorized access, tampering or eavesdropping.

[0230] In the case of receiving the first resource access request, the authentication server sends a quantum key application to the second quantum network node that is connected. Then, the authentication server receives the second quantum key QK_UUID-2 (more than 128 bits) and the quantum key identifier UUID_QK sent by the second quantum network node according to the quantum key application. The quantum key identifier UUID_QK is obtained by the second quantum network node identifying the second quantum key QK_UUID-2 according to the unique universal identification code of the second quantum network node. The authentication server uses the quantum key identifier as a login ticket.

[0231] In this way, the authentication server obtains the second quantum key QK_UUID-2 and the quantum key identifier UUID_QK. The second quantum key QK_UUID-2 has good resistance to quantum computing attacks and can be used to make the communication between the client and the authentication server have strong confidentiality. The quantum key identifier UUID_QK helps to manage and use quantum keys. Using the quantum key identifier UUID_QK as a login ticket has strong confidentiality.

[0232] See also Fig.13 In some embodiments, the ticket request information includes encrypted authentication information, a temporary public key signature message, a login ticket, and a temporary public key, and the method further includes:

[0233] 038: Confirm the usage of the second quantum key corresponding to the login ticket;

[0234] 039: When the second quantum key is not used, the encrypted authentication information is decrypted according to the second quantum key to obtain the authentication information;

[0235] 040: Verify the temporary public key signature message based on the post-quantum public key to determine the correctness of the temporary public key;

[0236] 041: After obtaining the authentication information, the second quantum key is deleted to ensure that the second quantum key cannot be reused;

[0237] 042: Divide the temporary public key into a first temporary public key and a second temporary public key.

[0238] In some embodiments, the confirmation module is used to confirm the use of the second quantum key corresponding to the login ticket. The decryption module is used to decrypt the encrypted authentication information according to the second quantum key to obtain the authentication information when the second quantum key is not in use. The signature verification module is used to verify the signature of the temporary public key signature message according to the post-quantum public key to determine the correctness of the temporary public key. The deletion module is used to delete the second quantum key when the authentication information is obtained to ensure that the second quantum key cannot be reused. The segmentation module is used to divide the temporary public key into a first temporary public key and a second temporary public key.

[0239] In some embodiments, the processor is also used to confirm the use of the second quantum key corresponding to the login ticket. And when the second quantum key is not used, the encrypted authentication information is decrypted according to the second quantum key to obtain the authentication information. And the temporary public key signature message is verified according to the post-quantum public key to determine the correctness of the temporary public key. The processor is also used to delete the second quantum key when the authentication information is obtained to ensure that the second quantum key cannot be reused. And the temporary public key is divided into a first temporary public key and a second temporary public key.

[0240] Specifically, the authentication information includes a user name and password input by the user.

[0241] The server first confirms the use of the second quantum key corresponding to the login ticket. When the second quantum key is not used, the server decrypts the encrypted authentication information according to the second quantum key to obtain the authentication information. Then, the server verifies the temporary public key signature message according to the post-quantum public key to determine the correctness of the temporary public key. When the authentication information is obtained, the server deletes the second quantum key to ensure that the second quantum key cannot be reused. In addition, the server also divides the temporary public key into a first temporary public key and a second temporary public key. In this way, by confirming that the quantum key corresponding to the login ticket has not been used for the previous login, the security of the authentication process is ensured and unauthorized access is prevented. And when the authentication information has been obtained, the second quantum key is deleted to ensure that the quantum key that has been used cannot be used again. In addition, the server also divides the temporary public key into a first temporary public key and a second temporary public key, which are used in subsequent processes to reduce potential security risks.

[0242] Continuing with the above example, see Figure 3 After receiving the ticket request information sent by the user, the authentication server first confirms the usage of the second quantum key QK_UUID-2 corresponding to the login ticket, and confirms that the second quantum key QK_UUID-2 corresponding to the quantum key identifier UUID_QK in the login ticket has not been used for login before. When the second quantum key QK_UUID-2 is not used, the authentication server decrypts the encrypted authentication information M1 according to the second quantum key QK_UUID-2 to obtain the authentication information m1. Then, the authentication server verifies the temporary public key signature message M2 according to the post-quantum public key to determine the correctness of the temporary public key. When the authentication information M1 is obtained, the authentication server deletes the second quantum key QK_UUID-2 to ensure that the second quantum key QK_UUID-2 cannot be reused. In addition, the authentication server also divides the temporary public key into two parts: the first temporary public key P1 and the second temporary public key P2.

[0243] In this way, by confirming that the quantum key corresponding to the login ticket has not been used for the previous login, and by processing the temporary public key signature message and encrypted authentication message, the security of the authentication process and the prevention of unauthorized access are ensured. And when the authentication information m1 has been obtained, the second quantum key QK_UUID-2 is deleted to ensure that the quantum key that has been used cannot be used again. In addition, the authentication server also divides the temporary public key into the first temporary public key P1 and the second temporary public key P2, which are used in subsequent processes to reduce potential security risks.

[0244] See also Fig.14In some implementations, the ticket request information includes resource information. Step 035 (generating a service ticket according to the ticket request information and sending the service ticket to the terminal) includes:

[0245] 0351: Generate a temporary ticket granting ticket based on resource information;

[0246] 0352: Generate a first temporary service ticket based on the temporary ticket authorization ticket;

[0247] 0353: concatenate the temporary public key and the ticket authorization ticket attribute value in the first temporary service ticket to obtain a temporary concatenation;

[0248] 0354: Perform post-quantum signature processing on the temporary splice according to the server's second post-quantum private key to obtain a service ticket signature message;

[0249] 0355: Store the service ticket signature message and the first temporary public key in the first temporary service ticket to obtain a second temporary service ticket;

[0250] 0356: Sign the second temporary service ticket according to the second classic public key of the server to obtain a service ticket, and send the service ticket to the terminal;

[0251] 0357: Cache the second temporary public key and delete the first temporary public key.

[0252] In some embodiments, the derivation module is further used to generate a temporary ticket authorization ticket based on the resource information. The derivation module is further used to generate a first temporary service ticket based on the temporary ticket authorization ticket. The splicing module is used to splice the temporary public key and the ticket authorization ticket attribute value in the first temporary service ticket to obtain a temporary splicing body. The signature module is used to perform post-quantum signature processing on the temporary splicing body according to the second post-quantum private key of the server to obtain a service ticket signature message. The storage module is used to store the service ticket signature message and the first temporary public key in the first temporary service ticket to obtain a second temporary service ticket. The storage module is used to sign the second temporary service ticket according to the second classical public key of the server to obtain a service ticket, and send the service ticket to the terminal. The processing module is also used to cache the second temporary public key and delete the first temporary public key.

[0253] In some embodiments, the processor is further configured to generate a temporary ticket authorization ticket based on the resource information, and to generate a first temporary service ticket based on the temporary ticket authorization ticket. And the temporary public key and the ticket authorization ticket attribute value in the first temporary service ticket are spliced ​​to obtain a temporary splice. The processor is further configured to perform post-quantum signature processing on the temporary splice according to the second post-quantum private key of the server to obtain a service ticket signature message. And the service ticket signature message and the first temporary public key are stored in the first temporary service ticket to obtain a second temporary service ticket. And the second temporary service ticket is signed according to the second classical public key of the server to obtain a service ticket, and the service ticket is sent to the terminal and the second temporary public key is cached, and the first temporary public key is deleted.

[0254] Specifically, the server generates a temporary ticket authorization ticket according to the resource information. Then, the server generates a first temporary service ticket according to the temporary ticket authorization ticket. Then, the server splices the temporary public key and the ticket authorization ticket attribute value in the first temporary service ticket to obtain a temporary splice, and the ticket authorization ticket attribute value is used to store the relevant information of the temporary ticket authorization ticket. The server then performs post-quantum signature processing on the temporary splice according to the server's second post-quantum private key to obtain a service ticket signature message. And the service ticket signature message and the first temporary public key are stored in the first temporary service ticket to obtain a second temporary service ticket. Finally, the server signs the second temporary service ticket according to the server's second classical public key to obtain a service ticket, and sends the service ticket to the terminal. In addition, the server caches the second temporary public key and deletes the first temporary public key. In this way, the server generates a first temporary service ticket, and uses the post-quantum signature algorithm and the classical signature algorithm to sign and protect the first temporary service ticket, so that the service ticket obtained by the signature protection processing has good confidentiality and quantum resistance. The server caches part of the temporary public key locally and deletes the other part to reduce potential security risks and maintain the integrity of the public key.

[0255] Continuing with the above example, see Figure 3, the authentication server generates a temporary ticket granting ticket (Ticket Granting Ticket-1, TGT-1) according to the resource information Z1. Next, the authentication server generates a first temporary service ticket ST1 according to the temporary ticket granting ticket (TicketGranting Ticket-1, TGT-1). Then, the authentication server concatenates the temporary public key and the ticket granting ticket attribute value ticketGrantingTicket in the first temporary service ticket ST1 to obtain a temporary concatenation T2, and the ticket granting ticket attribute value ticketGrantingTicket is used to store relevant information about the temporary ticket granting ticket (Ticket Granting Ticket-1, TGT-1). The authentication server then performs post-quantum signature processing on the temporary concatenation T2 according to the second post-quantum private key of the authentication server to obtain a service ticket signature message M4. The service ticket signature message M4 and the first temporary public key P1 are stored in the first temporary service ticket to obtain a second temporary service ticket ST2. Finally, the authentication server signs the second temporary service ticket ST2 according to the second classic public key of the authentication server to obtain a service ticket (Service Ticket, ST), and sends the service ticket (Service Ticket, ST) to the terminal. In addition, the authentication server caches the second temporary public key P2 and deletes the first temporary public key P1.

[0256] In this way, the authentication server generates a first temporary service ticket ST1, and uses the post-quantum signature algorithm and the classical signature algorithm to sign and protect the first temporary service ticket ST1, so that the service ticket (ST) obtained by the signature protection process has good confidentiality and quantum resistance. In addition, the authentication server caches part of the temporary public key locally and deletes the other part to reduce potential security risks and maintain the integrity of the public key.

[0257] See also Fig.15 In some implementations, step 036 (receiving a second resource access request generated by the terminal according to the service ticket, and confirming access rights to the resource corresponding to the second resource access request so that the terminal can access the resource on the server) includes:

[0258] 0361: receiving a second resource access request generated by the terminal according to the service ticket;

[0259] 0362: Verify the signature message using the server's second classic private key to confirm that the service ticket is valid;

[0260] 0363: synthesize the second temporary public key and the received first temporary public key to obtain a temporary public key;

[0261] 0364: Verify the service ticket signature message according to the server's second post-quantum public key to confirm that the ticket authorization ticket corresponding to the ticket authorization ticket attribute value is valid;

[0262] 0365: Confirm the correctness of the authentication information based on the temporary public key; if the authentication information is correct, the terminal is allowed to access the server resources.

[0263] In certain embodiments, the receiving module is used to receive a second resource access request generated by the terminal according to the service ticket. The signature verification module is used to verify the signature message according to the second classical private key of the server to confirm that the service ticket is valid. The processing module is used to synthesize the second temporary public key and the received first temporary public key to obtain a temporary public key. The signature verification module is also used to verify the service ticket signature message according to the second post-quantum public key of the server to confirm that the ticket authorization ticket corresponding to the ticket authorization ticket attribute value is valid. The determination module is used to confirm the correctness of the authentication information according to the temporary public key; if the authentication information is correct, the terminal is allowed to access resources on the server.

[0264] In some embodiments, the processor is also used to receive a second resource access request generated by the terminal according to the service ticket. And the verification signature message is verified according to the second classic private key of the server to confirm that the service ticket is valid. And the second temporary public key and the received first temporary public key are synthesized to obtain a temporary public key. The processor is also used to verify the service ticket signature message according to the second post-quantum public key of the server to confirm that the ticket authorization ticket corresponding to the ticket authorization ticket attribute value is valid. And the correctness of the authentication information is confirmed according to the temporary public key; if the authentication information is correct, the terminal is allowed to access resources on the server.

[0265] Specifically, the server receives a second resource access request generated by the terminal according to the service ticket, the second resource access request includes a verification message, a service ticket and resource information, and the verification message includes a verification signature message and a verification random number. Next, the server verifies the verification signature message according to the second classical private key of the server to confirm that the service ticket is valid. Then, the server synthesizes the second temporary public key and the received first temporary public key to obtain a temporary public key. The server then verifies the service ticket signature message according to the second post-quantum public key of the server to confirm that the ticket authorization ticket corresponding to the ticket authorization ticket attribute value is valid. Finally, the server confirms the correctness of the authentication information according to the temporary public key; in the case where the authentication information is correct, the terminal is allowed to access the server's resources. In this way, by verifying the validity of the service ticket in the second resource access request, and verifying the service ticket signature message through the synthesized temporary public key, the ticket authorization ticket is confirmed to be valid. So that the server can ensure the authenticity of the terminal's identity, provide strong security and quantum security for resource access requests, and help protect the security of data and communications.

[0266] Continuing with the above example, see Figure 3 , the resource server receives the second resource access request generated by the user end according to the service ticket (ServiceTicket, ST), the second resource access request includes a verification message, a service ticket (Service Ticket, ST) and resource information Z1, and the verification message includes a verification signature message M3 and a verification random number R1. After receiving these data information, the resource server submits these data information to the authentication server. Then, the authentication server verifies the verification signature message M3 according to the second classical private key of the authentication server to confirm that the service ticket (ServiceTicket, ST) is valid. Then, the authentication server synthesizes the second temporary public key P2 and the received first temporary public key P1 to obtain a temporary public key. The authentication server then verifies the service ticket signature message M4 according to the second post-quantum public key of the authentication server to confirm that the ticket granting ticket TGT corresponding to the ticket granting ticket attribute value ticketGrantingTicket is valid. Finally, the authentication server confirms the correctness of the authentication information m1 according to the temporary public key; so that if the authentication information m1 is correct, the user end is allowed to access the resource of the resource server. In this way, by verifying the validity of the service ticket (ST) in the second resource access request, and verifying the service ticket signature message M4 through the synthesized temporary public key, the ticket authorization ticket is confirmed to be valid. So that the authentication server can ensure the authenticity of the user's identity, provide strong security and quantum security for resource access requests, and help protect the security of data and communications.

[0267] In this way, by verifying the validity of the service ticket (ST) in the second resource access request, and verifying the service ticket signature message M4 with the synthesized temporary public key, the ticket authorization ticket TGT is confirmed to be valid. This allows the authentication server to ensure the authenticity of the user's identity, providing strong security and quantum security for resource access requests, and helping to protect the security of data and communications.

[0268] See also Fig.16 In some embodiments, the method further comprises:

[0269] 0381: Sign the temporary ticket authorization ticket according to the second classic public key of the server to obtain a classic signature ticket authorization ticket;

[0270] 0382: Perform post-quantum signature processing on the temporary ticket authorization ticket according to the second post-quantum public key of the server to obtain a post-quantum signature ticket authorization ticket;

[0271] 0383: Store the classic signature ticket authorization ticket and the post-quantum signature ticket authorization ticket in the temporary ticket authorization ticket to obtain the ticket authorization ticket;

[0272] 0384: Send the ticket-granting ticket to the endpoint.

[0273] In some embodiments, the signature module is further used to sign the temporary ticket authorization ticket according to the second classical public key of the server to obtain a classical signature ticket authorization ticket. The signature module is further used to perform post-quantum signature processing on the temporary ticket authorization ticket according to the second post-quantum public key of the server to obtain a post-quantum signature ticket authorization ticket. The storage module is used to store the classical signature ticket authorization ticket and the post-quantum signature ticket authorization ticket in the temporary ticket authorization ticket to obtain a ticket authorization ticket. The sending module is used to send the ticket authorization ticket to the terminal.

[0274] In some embodiments, the processor is further configured to sign the temporary ticket authorization ticket according to the second classical public key of the server to obtain a classical signature ticket authorization ticket. And perform post-quantum signature processing on the temporary ticket authorization ticket according to the second post-quantum public key of the server to obtain a post-quantum signature ticket authorization ticket. The processor is further configured to store the classical signature ticket authorization ticket and the post-quantum signature ticket authorization ticket in the temporary ticket authorization ticket to obtain a ticket authorization ticket. And send the ticket authorization ticket to the terminal.

[0275] Specifically, the authentication server signs the temporary ticket authorization ticket according to the second classical public key of the authentication server to obtain a classical signature ticket authorization ticket. Next, the authentication server performs post-quantum signature processing on the temporary ticket authorization ticket according to its own second post-quantum public key to obtain a post-quantum signature ticket authorization ticket. Then, the authentication server stores the classical signature ticket authorization ticket and the post-quantum signature ticket authorization ticket in the temporary ticket authorization ticket to obtain a ticket authorization ticket. Finally, the authentication server sends the ticket authorization ticket to the terminal. In this way, the temporary ticket authorization ticket is signed by the classical signature algorithm and the post-quantum signature algorithm respectively to obtain a classical signature ticket authorization ticket and a post-quantum signature ticket authorization ticket. The classical signature ticket authorization ticket and the post-quantum signature ticket authorization ticket are then stored in the temporary ticket authorization ticket to obtain a ticket authorization ticket, so that the ticket authorization ticket has good quantum resistance and confidentiality.

[0276] Continuing with the above example, see Figure 3 , the authentication server signs the temporary ticket granting ticket (Ticket Granting Ticket-1, TGT-1) according to the second classical public key of the authentication server to obtain the classical signature ticket granting ticket Q1. Next, the authentication server performs post-quantum signature processing on the temporary ticket granting ticket (Ticket GrantingTicket-1, TGT-1) according to the second post-quantum public key to obtain the post-quantum signature ticket granting ticket Q2. Then, the authentication server stores the classical signature ticket granting ticket Q1 and the post-quantum signature ticket granting ticket Q2 in the temporary ticket granting ticket (Ticket Granting Ticket-1, TGT-1) to obtain the ticket granting ticket TGT. Finally, the authentication server sends the ticket granting ticket TGT to the user end.

[0277] In this way, the temporary ticket granting ticket (Ticket Granting Ticket-1, TGT-1) is signed by the classical signature algorithm and the post-quantum signature algorithm respectively, and the classical signature ticket granting ticket Q1 and the post-quantum signature ticket granting ticket Q2 are obtained. Then the classical signature ticket granting ticket Q1 and the post-quantum signature ticket granting ticket Q2 are stored in the temporary ticket granting ticket (Ticket Granting Ticket-1, TGT-1) to obtain the ticket granting ticket TGT, so that the ticket granting ticket TGT has good quantum resistance and confidentiality.

[0278] See also Fig.17 In some embodiments, the method further comprises:

[0279] 043: When it is not the first time to access the resources in the server, the ticket granting ticket sent by the receiving terminal;

[0280] 044: Generate a subsequent service ticket based on the ticket authorization ticket, and send the subsequent service ticket to the terminal;

[0281] 045: receiving a third resource access request generated according to the subsequent service ticket and sent by the terminal, and confirming access rights to subsequent resources corresponding to the third resource access request, so that the terminal can access subsequent resources of the server.

[0282] In some embodiments, the receiving module is further used to receive a ticket authorization ticket sent by the terminal when it is not the first time to access the resources in the server. The sending module is also used to generate a subsequent service ticket based on the ticket authorization ticket and send the subsequent service ticket to the terminal. The receiving module is also used to receive a third resource access request generated based on the subsequent service ticket and sent by the terminal, and confirm the access rights of the subsequent resources corresponding to the third resource access request, so that the terminal can access the subsequent resources of the server.

[0283] In some embodiments, the processor is further configured to receive a ticket authorization ticket sent by a terminal when it is not the first time to access resources in the server, generate a subsequent service ticket based on the ticket authorization ticket, and send the subsequent service ticket to the terminal, and receive a third resource access request generated based on the subsequent service ticket sent by the terminal, confirm the access rights of the subsequent resources corresponding to the third resource access request, so that the terminal can access the subsequent resources of the server.

[0284] Specifically, in the case of not first access to resources in the server, the server receives the ticket authorization ticket sent by the terminal. Then, the server generates a subsequent service ticket based on the ticket authorization ticket, and sends the subsequent service ticket to the terminal. Finally, the server receives a third resource access request generated based on the subsequent service ticket sent by the terminal, and confirms the access rights to the subsequent resources corresponding to the third resource access request, so that the terminal can access the subsequent resources of the server. In this way, in the case of not first access to resources in the server, the server generates a subsequent service ticket based on the received ticket authorization ticket, so that the terminal can access the resources in the server, which greatly simplifies the process of the terminal obtaining service tickets, while having good quantum resistance and confidentiality.

[0285] Continuing with the above example, see Figure 3, when the user terminal is not accessing the resources in the resource server for the first time, the authentication server receives the ticket granting ticket TGT sent by the user terminal. Then, the authentication server generates a subsequent service ticket ST-2 according to the ticket granting ticket TGT, and sends the subsequent service ticket ST-2 to the user terminal. Finally, the resource server receives the third resource access request generated according to the subsequent service ticket ST-2 sent by the user terminal, confirms the access rights of the subsequent resources corresponding to the third resource access request, so that the user terminal can access the subsequent resources of the resource server.

[0286] In this way, when the user terminal is not accessing the resources in the resource server for the first time, the authentication server generates a subsequent service ticket ST-2 based on the received ticket granting ticket TGT, so that the user terminal can access the resources in the resource server, which greatly simplifies the process of the user terminal obtaining the service ticket, while having good quantum resistance and confidentiality.

[0287] See also Fig.18 In some implementations, step 044 (generating a subsequent service ticket based on the ticket authorization ticket and sending the subsequent service ticket to the terminal) includes:

[0288] 0441: Verify the ticket authorization ticket according to the second classical public key and the second post-quantum public key to confirm the correctness of the ticket authorization ticket;

[0289] 0442: After confirming that the ticket-granting ticket is correct, a subsequent service ticket is sent to the terminal.

[0290] In some embodiments, the signature verification module is further used to perform signature verification on the ticket authorization ticket according to the second classical public key and the second post-quantum public key to confirm the correctness of the ticket authorization ticket. The receiving module is also used to send a subsequent service ticket to the terminal when confirming that the ticket authorization ticket is correct.

[0291] In some embodiments, the processor is further configured to perform signature verification processing on the ticket-granting ticket according to the second classical public key and the second post-quantum public key to confirm the correctness of the ticket-granting ticket, and to send a subsequent service ticket to the terminal when confirming that the ticket-granting ticket is correct.

[0292] Specifically, the server verifies the ticket authorization ticket according to the second classical public key and the second post-quantum public key to confirm the correctness of the ticket authorization ticket. When the ticket authorization ticket is confirmed to be correct, the server sends a subsequent service ticket to the terminal. In this way, by verifying the ticket authorization ticket, the correctness of the ticket authorization ticket is confirmed, and the subsequent service ticket is generated and distributed, the identity of the terminal is confirmed, and the security of the resources in the server is ensured.

[0293] Continuing with the above example, see Figure 3 The authentication server verifies the ticket authorization ticket TGT according to the second classical public key and the second post-quantum public key to confirm the correctness of the ticket authorization ticket TGT. When the ticket authorization ticket TGT is confirmed to be correct, the authentication server sends a subsequent service ticket ST-2 to the user end.

[0294] In this way, by verifying the signature of the ticket-granting ticket TGT, the correctness of the ticket-granting ticket TGT is confirmed, thereby generating and distributing the subsequent service ticket ST-2, confirming the identity of the user end, and ensuring the security of resources in the authentication server.

[0295] The present application also provides a computer-readable storage medium containing a computer program. When the computer program is executed by one or more processors, the one or more processors execute the method of the present application.

[0296] It is understood that a computer program includes computer program code. The computer program code may be in source code form, object code form, executable file or some intermediate form. Computer readable storage media may include: any entity or device capable of carrying computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution medium.

[0297] In the description of this specification, the descriptions with reference to the terms "specifically", "further", "particularly", "understandably", etc. are intended to mean that the specific features, structures, materials or characteristics described in conjunction with the embodiments or examples are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms are not intended to refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0298] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0299] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A method for enhancing quantum security of a central authentication service protocol of a communication network, It is characterized in that The communication network includes a terminal and a server, the method is used for the terminal, and the method includes: When accessing a resource in the server for the first time, sending a first resource access request to the server; receiving a login ticket and a login form obtained by the server according to the first resource access request; Obtaining a first quantum key from a first network node connected to the terminal according to the login ticket; Acquiring authentication information of the terminal according to the login form; Processing the authentication information according to the first quantum key and the post-quantum cryptographic algorithm to obtain ticket request information, and sending the ticket request information to the server; receiving a service ticket generated by the server according to the ticket request information; A second resource access request generated according to the service ticket is sent to the server, and the server confirms access rights to resources corresponding to the second resource access request according to the second resource access request, so that the terminal accesses resources to the server.

2. The method according to claim 1, It is characterized in that The method further comprises: Sending the post-quantum public key of the terminal to the server.

3. The method according to claim 1, It is characterized in that The obtaining a first quantum key from a first network node connected to the terminal according to the login ticket includes: Using a service node to inject multiple keys into a cryptographic module of the terminal; Sending a quantum key application to the service node according to the login ticket, wherein the quantum key application is protected by a protection key, and the protection key is a randomly used one from a plurality of keys injected into the cryptographic module; receiving a quantum key encryption result obtained by the service node encrypting the first quantum key according to the protection key, where the first quantum key is distributed to the service node by a first network node connected to the service node; The quantum key encryption result is decrypted to obtain the first quantum key.

4. The method according to claim 1, It is characterized in that The step of processing the authentication information according to the first quantum key and the post-quantum cryptographic algorithm to obtain ticket request information, and sending the ticket request information to the server includes: Encrypting the authentication information according to the first quantum key to obtain encrypted authentication information; Performing post-quantum signature processing on a temporary public key in a temporary key pair randomly generated by the terminal to obtain a temporary public key signature message; The encrypted authentication information, the temporary public key signature message, the temporary public key, the login ticket and resource information of the resource corresponding to the first resource access request are sent to the server as ticket request information.

5. The method according to claim 4, It is characterized in that The sending a second resource access request generated according to the service ticket to the server includes: Concatenate the resource information and the verification random number randomly generated by the terminal to obtain a verification concatenation; Signing the verification splice according to the temporary private key in the temporary key pair to obtain a verification signature message; A verification message, the service ticket and the resource information are sent to the server as a second resource access request, wherein the verification message includes the verification signature message and the verification random number.

6. The method according to claim 1, It is characterized in that The method further comprises: A ticket granting ticket is received from the server, where the ticket granting ticket is generated by the server according to the ticket request information.

7. The method according to claim 6, It is characterized in that The method further comprises: In case of non-first access to a resource in the server, sending a ticket-granting ticket to the server; receiving a subsequent service ticket generated according to the ticket-granting ticket and sent by the server; A third resource access request generated according to the subsequent service ticket is sent to the server, and the server confirms the access rights of the subsequent resources corresponding to the third resource access request according to the third resource access request, so that the terminal can access the subsequent resources in the server.

8. A method for enhancing quantum security of a central authentication service protocol of a communication network. It is characterized in that The communication network includes a terminal and a server, the method is used for the server, and the method includes: receiving a first resource access request sent by the terminal, where the first resource access request is generated by the terminal when accessing a resource in the server for the first time; Acquire a second quantum key and a quantum key identifier from a second network node connected to the server; Sending a login ticket and a login form to the terminal, wherein the login ticket is the quantum key identifier, and the login form is generated by the server according to the first resource access request; Receiving ticket request information sent by the terminal obtained by processing authentication information according to a first quantum key and a post-quantum cryptographic algorithm, wherein the first quantum key is obtained by the terminal according to the login ticket, and the authentication information is obtained by the terminal according to the login form; Generate a service ticket according to the ticket request information, and send the service ticket to the terminal; A second resource access request generated by the terminal according to the service ticket is received, and access rights to resources corresponding to the second resource access request are confirmed so that the terminal can access resources on the server.

9. The method according to claim 8, It is characterized in that The method further comprises: Receive the post-quantum public key of the terminal sent by the terminal.

10. The method according to claim 8, It is characterized in that The obtaining of a second quantum key and a quantum key identifier from a second network node connected to the server includes: Upon receiving the first resource access request, sending a quantum key application to a second network node connected to the server; receiving the second quantum key and the quantum key identifier sent by the second network node, where the second quantum key is obtained by the second network node according to the quantum key application, and the quantum key identifier is obtained by the second network node identifying the second quantum key according to an identification code of the second network node.

11. The method according to claim 9, It is characterized in that The ticket request information includes encrypted authentication information, a temporary public key signature message, a login ticket and a temporary public key, and the method further includes: confirming the usage of the second quantum key corresponding to the login ticket; When the second quantum key is not used, decrypting the encrypted authentication information according to the second quantum key to obtain authentication information; Performing signature verification on the temporary public key signature message according to the post-quantum public key to determine the correctness of the temporary public key; When the authentication information is obtained, deleting the second quantum key to ensure that the second quantum key cannot be reused; The temporary public key is divided into a first temporary public key and a second temporary public key.

12. The method according to claim 11, It is characterized in that The ticket request information includes resource information, and the generating a service ticket according to the ticket request information and sending the service ticket to the terminal includes: generating a temporary ticket-granting ticket according to the resource information; generating a first temporary service ticket based on the temporary ticket-granting ticket; concatenating the temporary public key and the ticket-granting ticket attribute value in the first temporary service ticket to obtain a temporary concatenation, wherein the ticket-granting ticket attribute value is used to store relevant information related to the temporary ticket-granting ticket; Performing post-quantum signature processing on the temporary splice according to the second post-quantum private key of the server to obtain a service ticket signature message; Storing the service ticket signature message and the first temporary public key in the first temporary service ticket to obtain a second temporary service ticket; Signing the second temporary service ticket according to the second classic public key of the server to obtain a service ticket, and sending the service ticket to the terminal; The second temporary public key is cached and the first temporary public key is deleted.

13. The method according to claim 12, It is characterized in that The receiving a second resource access request generated by the terminal according to the service ticket, and confirming access rights to resources corresponding to the second resource access request so that the terminal can access resources on the server, includes: receiving a second resource access request generated by the terminal according to the service ticket, wherein the second resource access request includes a verification message, the service ticket, and the resource information, and the verification message includes a verification signature message and a verification random number; Performing signature verification processing on the verification signature message according to the second classic private key of the server to confirm that the service ticket is valid; The second temporary public key and the received first temporary public key are synthesized to obtain the temporary public key; Performing signature verification on the service ticket signature message according to the second post-quantum public key of the server to confirm that the ticket-granting ticket corresponding to the ticket-granting ticket attribute value is valid; The correctness of the authentication information is confirmed according to the temporary public key; and if the authentication information is correct, the terminal is allowed to access resources of the server.

14. The method according to claim 12, It is characterized in that The method further comprises: Signing the temporary ticket-granting ticket according to the second classic public key of the server to obtain a classic signed ticket-granting ticket; Performing post-quantum signature processing on the temporary ticket authorization ticket according to the second post-quantum public key of the server to obtain a post-quantum signature ticket authorization ticket; Storing the classical signature ticket-granting ticket and the post-quantum signature ticket-granting ticket in the temporary ticket-granting ticket to obtain a ticket-granting ticket; The ticket-granting ticket is sent to the terminal.

15. The method according to claim 14, It is characterized in that The method further comprises: In case of not first access to resources in the server, receiving a ticket granting ticket sent by the terminal; generating a subsequent service ticket according to the ticket authorization ticket, and sending the subsequent service ticket to the terminal; A third resource access request generated according to the subsequent service ticket and sent by the terminal is received, and access rights to subsequent resources corresponding to the third resource access request are confirmed, so that the terminal can access the subsequent resources of the server.

16. The method according to claim 15, It is characterized in that The generating a subsequent service ticket according to the ticket authorization ticket and sending the subsequent service ticket to the terminal includes: Performing signature verification on the ticket-granting ticket according to the second classical public key and the second post-quantum public key to confirm the correctness of the ticket-granting ticket; When confirming that the ticket-granting ticket is correct, a subsequent service ticket is sent to the terminal.

Images