Quantum-resistant security enhancements for the Open Identity Connection Protocol

Abstract

The present application discloses a method for enhancing the anti-quantum security of an open identity connection protocol of a communication network. The method includes: receiving anti-quantum token request information sent by a client after completing communication preprocessing. Generate an access token and an identity token according to the anti-quantum token request information. Generate a temporary key pair associated with the client and obtain a quantum key identifier. Process the access token to generate an anti-quantum access token. Obtain an anti-quantum identity token according to the temporary key pair, the quantum key identifier, the post-quantum cryptographic algorithm and the identity token. Send an anti-quantum access token and an anti-quantum identity token to the client. Receive a resource access request generated according to the anti-quantum access token and the anti-quantum identity token, and confirm the access rights of the corresponding resources so that the client can access the resources of the server. The server and the client encrypt communication using post-quantum cryptographic algorithms and quantum key distribution technology, significantly enhancing the ability to resist quantum computing attacks.

Description

Technical Field

[0001] The present application relates to the field of network security, and more specifically, to a method for enhancing the anti-quantum security of an open identity connection protocol of a communication network. Background Art

[0002] The leap in computing power represented by quantum computing has a significant impact on the security of related algorithms in classical cryptography. Understandably, with the realization of large-scale quantum computers, it will have a certain impact on key negotiation, encryption, signature and other applications in classical cryptography. Therefore, providing cryptographic technology that can resist quantum computing attacks has become an urgent problem to be solved. Summary of the invention

[0003] The present application provides a method for enhancing the anti-quantum security of an open identity connection protocol of a communication network.

[0004] The embodiment of the present application provides a method for enhancing the anti-quantum security of an open identity connection protocol of a communication network, wherein the communication network includes a server and a client, and the method is used for the server, and the method includes:

[0005] When the communication preprocessing is completed, receiving the anti-quantum token request information sent by the client;

[0006] Generate an access token and an identity token according to the quantum-resistant token request information;

[0007] Randomly generate a temporary key pair associated with the client, the temporary key pair comprising a temporary public key and a temporary private key;

[0008] Obtaining a quantum key identifier from a first network node connected to the server;

[0009] Encrypting the access token to generate a quantum-resistant access token;

[0010] Obtain a quantum-resistant identity token according to the temporary key pair, the quantum key identifier, the post-quantum cryptographic algorithm, and the identity token;

[0011] Sending the quantum-resistant access token and the quantum-resistant identity token to the client;

[0012] A resource access request generated by the client according to the quantum-resistant access token and the quantum-resistant identity token is received, and access rights to resources corresponding to the resource access request are confirmed so that the client can access resources on the server.

[0013] In this way, during the communication process in which the client applies for access to resources in the server, the client sends a quantum-resistant token request message to the server. After receiving the quantum-resistant token request message, the server applies for a quantum key, and uses the quantum key and post-quantum cryptographic algorithm to encrypt the access token and identity token generated according to the quantum-resistant token request message to generate a quantum-resistant access token and a quantum-resistant identity token that can resist quantum computing attacks. The post-quantum cryptographic algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good resistance to quantum computing attacks. Next, the client receives the quantum-resistant access token and quantum-resistant identity token sent by the server, and sends the resource access request generated according to the quantum-resistant access token and quantum-resistant identity token to the server. Then, the server verifies the validity of the quantum-resistant access token and the quantum-resistant identity token to determine whether the server can access the resources corresponding to the resource access request. In this way, the quantum key distribution technology and post-quantum cryptographic algorithm enhance the ability to resist quantum computing attacks in the communication process in which the client applies to access server resources.

[0014] In certain embodiments, the method further comprises:

[0015] Receiving a registration request sent by the client, wherein the registration request includes a second post-quantum public key and a second classical public key of the client;

[0016] Sending a registration response request generated according to the registration request, wherein the registration response request includes a first post-quantum public key and a first classical public key of the server;

[0017] Receiving an authorization request sent by the client obtained according to the registration response request;

[0018] An authorization code is generated according to the authorization request, and the authorization code is sent to the client.

[0019] In this way, the server receives a registration request sent by the client, and the registration request includes the client's second post-quantum public key and second classical public key. Then, the server sends a registration response request generated according to the registration request, and the registration response request includes the server's first post-quantum public key and first classical public key. Then, the server receives an authorization request sent by the client based on the registration response request. Finally, the server generates an authorization code based on the authorization request and sends the authorization code to the client. In this way, the server and the client can exchange keys securely, and the server and the client obtain the client's post-quantum public key and classical public key from each other for subsequent signing and verification processes. The post-quantum public key has good resistance to quantum computing attacks, which can make the transmitted data have good resistance to quantum computing attacks.

[0020] In some embodiments, the quantum-resistant token request information includes an access random number, an identity random number, access token request information, identity token request information, a second post-quantum signature message, and a second classical signature message, and the method further includes:

[0021] Performing signature verification processing on the second post-quantum signature message according to the received second post-quantum public key to confirm the correctness of the access token request information and the access random number;

[0022] The second classic signature message is verified according to the received second classic public key to confirm the correctness of the identity token request information and the identity random number.

[0023] In this way, the server verifies the second post-quantum signature message according to the received second post-quantum public key to confirm the correctness of the access token request information and the access random number. Then, the server verifies the second classical signature message according to the received second classical public key to confirm the correctness of the identity token request information and the identity random number. In this way, through the verification process, it is confirmed that the received access token request information, access random number, identity token request information and identity random number are all from the client and have not been accessed without authorization.

[0024] In some embodiments, the quantum-resistant token request information includes an access random number, an identity random number, access token request information, and identity token request information, and generating an access token and an identity token according to the quantum-resistant token request information includes:

[0025] Generate the access token according to the access token request information, wherein the access token includes an access random number;

[0026] The identity token is generated according to the identity token request information, and the identity token includes an identity random number.

[0027] In this way, the server generates an access token according to the access token request information, and the access token includes an access random number. Then, the server generates an identity token according to the identity token request information, and the identity token includes an identity random number. In this way, both the access token and the identity token carry corresponding random numbers to maintain the uniqueness and freshness of the identity token and the access token.

[0028] In some embodiments, obtaining a quantum key identifier from a first network node connected to the server includes:

[0029] Sending a quantum key application to a first network node connected to the server;

[0030] A first quantum key and a quantum key identifier sent by the network node are received, where the quantum key identifier is obtained by the first network node performing identification processing on the first quantum key according to an identification code of the first network node.

[0031] In this way, the server sends a quantum key application to the first network node connected to the server. Then, the server receives the first quantum key and quantum key identifier sent by the network node. The quantum key identifier is obtained by the first network node identifying the first quantum key according to the identification code of the first network node. In this way, the server obtains the first quantum key and quantum key identifier. The first quantum key has good resistance to quantum computing attacks and can be used to make the communication between the server and the client have strong confidentiality. The quantum key identifier helps to manage and use quantum keys.

[0032] In some embodiments, the quantum-resistant token request information includes a second post-quantum signature message, and the encrypting the access token to generate a quantum-resistant access token includes:

[0033] Signing the access token according to the classic signature algorithm and the received first classic private key to obtain a first classic signature message;

[0034] The first classical signature message and the second post-quantum signature message are stored in the access token to obtain a quantum-resistant access token.

[0035] In this way, the server signs the access token according to the classical signature algorithm and the received first classical private key to obtain the first classical signature message. Then, the server stores the first classical signature message and the second post-quantum signature message in the access token to obtain a quantum-resistant access token. In this way, the server obtains a quantum-resistant access token with good quantum resistance, which can prevent data from being unauthorizedly accessed during the transmission of the quantum-resistant access token.

[0036] In certain embodiments, the method further comprises:

[0037] Encrypting the temporary private key according to the first quantum key to obtain an encrypted temporary private key;

[0038] The temporary private key is replaced with the encrypted temporary private key to obtain an encrypted temporary key pair.

[0039] In this way, the server encrypts the temporary private key according to the first quantum key to obtain an encrypted temporary private key. Then, the server replaces the temporary private key with the encrypted temporary private key to obtain an encrypted temporary key pair. In this way, by encrypting the temporary private key in the generated temporary key pair, the security and confidentiality of the temporary key pair are ensured to prevent it from being obtained by unauthorized parties during transmission and storage.

[0040] In some embodiments, the quantum-resistant token request information includes a second classical signature message, and the step of obtaining the quantum-resistant identity token according to the temporary key pair, the quantum key identifier, the post-quantum cryptographic algorithm, and the identity token includes:

[0041] Storing the encrypted temporary key pair and the quantum key identifier in the identity token to obtain an intermediate identity token;

[0042] Performing post-quantum signature processing on the intermediate identity token according to the first post-quantum private key of the server to obtain a first post-quantum signature message;

[0043] The first post-quantum signature message and the second classical signature message are stored in the intermediate identity token to obtain the quantum-resistant identity token.

[0044] In this way, the server stores the encrypted temporary key pair and the quantum key identifier in the identity token to obtain an intermediate identity token. Next, the server performs post-quantum signature processing on the intermediate identity token according to the server's first post-quantum private key to obtain a first post-quantum signature message. Finally, the server stores the first post-quantum signature message and the second classical signature message in the intermediate identity token to obtain a quantum-resistant identity token. In this way, the server can generate a quantum-resistant identity token that is both secure and resistant to quantum computing attacks, and can verify the integrity and authenticity of the quantum-resistant identity token to ensure that it has not been tampered with.

[0045] In some embodiments, the resource access request includes a first signature value, and the receiving the resource access request generated by the client according to the quantum-resistant access token and the quantum-resistant identity token, and confirming access rights to resources corresponding to the resource access request so that the client accesses resources to the server, includes:

[0046] Verifying the second post-quantum signature message according to the post-quantum signature algorithm and the received second post-quantum public key;

[0047] Verifying the first classic signature message according to the classic signature algorithm and the first classic public key of the server;

[0048] When the second post-quantum signature message is verified successfully and the first classical signature message is verified successfully, the quantum-resistant identity token and the first signature value are verified.

[0049] In this way, the server verifies the second post-quantum signature message according to the post-quantum signature algorithm and the received second post-quantum public key. Then, the server verifies the first classical signature message according to the classical signature algorithm and the first classical public key of the server. And when the second post-quantum signature message is verified and the first classical signature message is verified, the anti-quantum identity token and the first signature value are verified. In this way, through multiple signature verifications, the security and integrity of the identity token are ensured to prevent unauthorized access and potential attacks.

[0050] In some embodiments, the verifying the quantum-resistant identity token and the first signature value includes:

[0051] Verifying the first post-quantum signature message according to a post-quantum signature algorithm and a first post-quantum public key of the server;

[0052] Verifying the second classical signature message according to the classical signature algorithm and the received second classical public key;

[0053] Verifying the first signature value according to the temporary public key of the encrypted temporary key pair;

[0054] When the first post-quantum signature message is verified successfully, the second classical signature message is verified successfully, and the first signature value is verified successfully, the client is allowed to access the resource corresponding to the resource access request.

[0055] In this way, the server verifies the first post-quantum signature message according to the post-quantum signature algorithm and the first post-quantum public key of the server, confirms the integrity and authenticity of the first post-quantum signature message, and ensures that it has not been tampered with. Next, the server verifies the second classical signature message according to the classical signature algorithm and the received second classical public key, confirms the integrity and authenticity of the second classical signature message, and ensures that it has not been tampered with. Then, the server verifies the first signature value according to the temporary public key of the encrypted temporary key pair, confirms the validity of the first signature value, and ensures that it has not been tampered with. Finally, when the first post-quantum signature message is verified, the second classical signature message is verified, and the first signature value is verified, the server allows the client to access the resources corresponding to the resource access request. In this way, multi-layer signature verification can enhance the security of communication, prevent malicious attacks and data tampering, and ensure that the client can legally access the required resources.

[0056] The embodiment of the present application provides a method for enhancing the anti-quantum security of an open identity connection protocol of a communication network, wherein the communication network includes a server and a client, and the method is used for the client, and the method includes:

[0057] When the communication preprocessing is completed, sending anti-quantum token request information to the server;

[0058] Receiving a quantum-resistant access token and a quantum-resistant identity token sent by the server, wherein the quantum-resistant access token is generated by the server by encrypting the access token according to a post-quantum cryptographic algorithm, the quantum-resistant identity token is obtained by the server according to a temporary key pair, a quantum key identifier, a post-quantum cryptographic algorithm and an identity token, and the access token and the identity token are generated by the server according to the quantum-resistant token request information;

[0059] A resource access request is sent to the server according to the quantum-resistant access token and the quantum-resistant identity token, and the server confirms access rights to resources corresponding to the resource access request according to the resource access request, so that the client accesses resources to the server.

[0060] In this way, during the communication process in which the client applies for access to resources in the server, the client sends a quantum-resistant token request message to the server. After receiving the quantum-resistant token request message, the server applies for a quantum key, and uses the quantum key and post-quantum cryptographic algorithm to encrypt the access token and identity token generated according to the quantum-resistant token request message to generate a quantum-resistant access token and a quantum-resistant identity token that can resist quantum computing attacks. The post-quantum cryptographic algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good resistance to quantum computing attacks. Next, the client receives the quantum-resistant access token and quantum-resistant identity token sent by the server, and sends the resource access request generated according to the quantum-resistant access token and quantum-resistant identity token to the server. Then, the server verifies the validity of the quantum-resistant access token and the quantum-resistant identity token to determine whether the server can access the resources corresponding to the resource access request. In this way, the quantum key distribution technology and post-quantum cryptographic algorithm enhance the ability to resist quantum computing attacks in the communication process in which the client applies to access server resources.

[0061] In certain embodiments, the method further comprises:

[0062] Sending a registration request to the server, the registration request including the second post-quantum public key and the second classical public key of the client;

[0063] Receiving a registration response request generated according to the registration request and sent by the server, the registration response request including a first post-quantum public key and a first classical public key of the server;

[0064] Sending an authorization request to the server according to the registration response request;

[0065] Receive an authorization code generated by the client according to the authorization request.

[0066] In this way, the client sends a registration request to the server, and the registration request includes the client's second post-quantum public key and second classical public key. Then, the client receives a registration response request generated by the server according to the registration request, and the registration response request includes the server's first post-quantum public key and first classical public key. Then the client sends an authorization request to the server according to the registration response request. Finally, the client receives the authorization code generated by the client according to the authorization request. In this way, the server and the client can exchange keys securely, and the server and the client obtain the client's post-quantum public key and classical public key from each other for subsequent signing and verification processes. The post-quantum public key has good resistance to quantum computing attacks, which can make the transmitted data have good resistance to quantum computing attacks.

[0067] In some embodiments, sending the quantum-resistant token request information to the server includes:

[0068] Generate initial token request information according to the authorization code, wherein the initial token request information includes access token request information and identity token request information;

[0069] Performing post-quantum signature processing on the access token request information and the random access number randomly generated by the client according to the second post-quantum private key of the client to obtain a second post-quantum signature message;

[0070] The identity token request information and the identity random number randomly generated by the client are signed according to the second classic private key of the client to obtain a second classic signature message;

[0071] Storing the access random number, the identity random number, the second post-quantum signature message, and the second classical signature message in the initial token request information to obtain the quantum-resistant token request information;

[0072] The quantum-resistant token request information is sent to the server.

[0073] In this way, the client generates an initial token request information according to the authorization code, and the initial token request information includes access token request information and identity token request information. Then, the client performs post-quantum signature processing on the access token request information and the access random number randomly generated by the client according to the client's second post-quantum private key to obtain a second post-quantum signature message. Then, the client performs signature processing on the identity token request information and the identity random number randomly generated by the client according to the client's second classical private key to obtain a second classical signature message. Finally, the client stores the access random number, the identity random number, the second post-quantum signature message and the second classical signature message in the initial token request information to obtain anti-quantum token request information. And send the anti-quantum token request information to the server. In this way, the client generates anti-quantum token request information by using the post-quantum cryptographic algorithm to ensure the security and integrity of the anti-quantum token request information, so that the anti-quantum token request information has anti-quantum computing capabilities to prevent unauthorized access and potential attacks. And through the classical signature algorithm and the post-quantum signature algorithm, the anti-quantum token request information has double protection, which can enhance security.

[0074] In some embodiments, the quantum-resistant access token includes a first classical signed message, the quantum-resistant identity token includes a first post-quantum signed message, and the method further includes:

[0075] Performing signature verification on the first classical signature message according to the first classical public key to confirm that a correct quantum-resistant access token has been received;

[0076] The first post-quantum signature message is verified according to the first post-quantum public key to confirm that a correct quantum-resistant identity token has been received.

[0077] In this way, the client verifies the signature of the first classical signature message according to the first classical public key to confirm that the correct quantum-resistant access token has been received. Then, the client verifies the signature of the first post-quantum signature message according to the first post-quantum public key to confirm that the correct quantum-resistant identity token has been received. In this way, it is ensured that the quantum-resistant access token and quantum-resistant identity token received by the client are safe and legally issued by the server.

[0078] In certain embodiments, the quantum resistant identity token comprises a quantum key identifier, and the method further comprises:

[0079] Using a service node to inject multiple keys into the cryptographic module of the client;

[0080] Sending a quantum key application to the service node according to the quantum key identifier, wherein the quantum key application is protected by a protection key, and the protection key is a randomly used one from a plurality of keys injected into the cryptographic module;

[0081] receiving a quantum key encryption result obtained by the service node encrypting a second quantum key according to the protection key, where the second quantum key is generated by a first network node connected to the service node and distributed to the service node;

[0082] The quantum key encryption result is decrypted to obtain the second quantum key.

[0083] In this way, the client uses the service node to charge multiple keys into the client's cryptographic module. Next, the client sends a quantum key application to the service node based on the quantum key identifier received from the client. The quantum key application is protected by a protection key, which is a randomly used one of the multiple keys charged into the cryptographic module. Then, the client receives the quantum key encryption result obtained by the service node by encrypting the second quantum key according to the protection key. The second quantum key is generated by the second network node connected to the service node and distributed to the service node. Finally, the client decrypts the quantum key encryption result to obtain the second quantum key. In this way, the client obtains the second quantum key, which has good resistance to quantum computing attacks and can protect the communication between the server and the client with good resistance to quantum computing attacks.

[0084] In some embodiments, the quantum-resistant access token includes an access random number, the quantum-resistant identity token includes an identity random number and a cryptographic temporary key pair, the cryptographic temporary key pair includes a cryptographic temporary private key, and the method further includes:

[0085] Decrypting the encrypted temporary private key according to the second quantum key to obtain a temporary private key;

[0086] The verification random number, the access random number and the identity random number generated by the client at any time are concatenated to obtain a first concatenated body;

[0087] The first spliced ​​body is signed according to the temporary private key to obtain a first signature value.

[0088] In this way, the client decrypts the encrypted temporary private key according to the second quantum key to obtain the temporary private key. Then, the client concatenates the verification random number, access random number and identity random number generated by the client at any time to obtain the first concatenation. Finally, the client signs the first concatenation according to the temporary private key to obtain the first signature value. In this way, the user end obtains the first signature value and can verify the integrity and authenticity of the first concatenation, ensuring that it has not been tampered with and is indeed generated by the client.

[0089] In some embodiments, sending a resource access request to the server according to the quantum-resistant access token and the quantum-resistant identity token includes:

[0090] Send a resource access request to the server according to the first signature value, the quantum-resistant access token, and the quantum-resistant identity token.

[0091] In this way, the client sends a resource access request to the server based on the first signature value, the quantum-resistant access token, and the quantum-resistant identity token. In this way, the server can ensure that the resource access request is not accessed by unauthorized persons during transmission based on the first signature value sent by the client. The access rights of the resource access request are confirmed based on the quantum-resistant access token and the quantum-resistant identity token sent by the client.

[0092] Additional aspects and advantages of the embodiments of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the embodiments of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0093] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0094] Figure 1 It is one of the flow charts of the method of the implementation mode of the present application;

[0095] Figure 2 It is an architectural diagram of a method for implementing an embodiment of the present application;

[0096] Figure 3 This is the second flow chart of the method of the implementation mode of the present application;

[0097] Figure 4 This is the third flow chart of the method of the implementation mode of the present application;

[0098] Figure 5 This is the fourth flow chart of the method of the implementation mode of the present application;

[0099] Figure 6 This is the fifth flow chart of the method of the implementation mode of the present application;

[0100] Figure 7 This is the sixth flow chart of the method of the implementation mode of the present application;

[0101] Figure 8 This is the seventh flow chart of the method of the implementation mode of the present application;

[0102] Fig. 9 This is the eighth flow chart of the method of the implementation mode of the present application;

[0103] Fig.10 This is the ninth flow chart of the method of the implementation mode of the present application;

[0104] Fig.11 This is the tenth flowchart of the method of the implementation mode of the present application;

[0105] Fig.12 This is the eleventh flow chart of the method of the implementation mode of the present application;

[0106] Fig.13 This is the twelfth flow chart of the method of the implementation mode of the present application;

[0107] Fig.14 This is the thirteenth flow chart of the method of the implementation mode of the present application;

[0108] Fig.15 This is the fourteenth flow chart of the method of the implementation mode of the present application;

[0109] Fig.16 This is the fifteenth flowchart of the method of the implementation mode of the present application;

[0110] Fig.17 This is the sixteenth flow chart of the method of the implementation mode of the present application;

[0111] Fig.18 This is the seventeenth flow chart of the method of the implementation mode of the present application;

[0112] Fig.19 It is a signaling diagram of the method of an implementation mode of the present application. DETAILED DESCRIPTION

[0113] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals represent the same or similar elements or elements having the same or similar functions from beginning to end. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the embodiments of the present application, and cannot be understood as limiting the embodiments of the present application.

[0114] The leap in computing power represented by quantum computing has a significant impact on the security of related algorithms in classical cryptography. In other words, quantum computing poses a more direct and urgent threat to the cracking of classical cryptography. A series of classical algorithms, such as Diffie-Hellman, RSA, and elliptic curve (ECC), face greater security risks because the number theory problems they are based on, such as large prime number decomposition and discrete logarithms, are no longer difficult in the quantum era. Understandably, with the realization of large quantum computers, it will have a certain impact on key negotiation, encryption, signature and other applications in classical cryptography.

[0115] As a result, the security of the Internet, which uses classical cryptographic algorithms to protect the communication process, is deeply threatened by quantum computing attacks. For example, the OpenID Connect (OIDC) protocol is a secure authentication mechanism. Third-party applications connect to the identity authentication server (Identify Service) to obtain user information and return this information to the third-party application in a secure and reliable manner. The Open Identity Connect protocol extends the Open Authorization Protocol 2.0 version. Through the extended IDToken field, it provides basic user identity information. The ID Token is encapsulated in the JSON Web Token (JSON Web Token, JWT) format, providing self-contained and tamper-proof mechanisms. It can be safely passed to third-party applications and easily verified. JSON Web Token uses JSON Web Encryption (JSON Web Encryption, JWE) and JSON Web Signature (JSON Web Signature, JWS) to provide encryption and authentication security. Currently, JWE and JWS use classical digital signatures and encryption and decryption, hashing technology, and lack the ability to resist quantum computing attacks.

[0116] At present, the international technologies for dealing with the threat of quantum computing attacks are mainly divided into two categories: one is to use asymmetric algorithms for (symmetric) key negotiation and then encrypt and transmit through symmetric algorithms, and study the use of quantum key distribution (QKD) networks for symmetric key negotiation to protect the security of keys; the other is to study post-quantum cryptography (PQC) algorithms to directly replace existing asymmetric algorithms. Quantum key distribution technology uses the principles of quantum mechanics to generate keys that cannot be stolen by third parties, ensuring the security of key transmission. It is particularly suitable for key exchange scenarios and can replace existing asymmetric key negotiation algorithms, such as RSA or ECC, to improve the security of keys. However, quantum key distribution technology cannot currently completely replace all applications of asymmetric algorithms. For example, scenarios such as signature verification, integrity protection, and non-repudiation still require the use of asymmetric algorithms.

[0117] Post-quantum cryptographic algorithms are asymmetric cryptographic algorithms designed based on new mathematical problems, aiming to resist the possible threats posed by quantum computers. NIST has announced the first batch of four post-quantum cryptographic algorithms to be standardized, including Kyber, Dilithium, Falcon, and SPHINCS+. These algorithms cover a variety of technical routes to reduce the risk of a single technology being cracked. Post-quantum cryptographic algorithms can theoretically replace all asymmetric algorithms and are more general. However, the security of post-quantum cryptographic algorithms still depends on the complexity of computational problems, and may face new cracking methods in the future or become unsafe as computing power increases. In addition, the post-quantum cryptographic algorithm standard has not yet been officially announced, and the production and certification of related products also take time, so its large-scale application still requires a long period of time.

[0118] Both post-quantum cryptographic algorithms and quantum key distribution technologies have the ability to resist quantum computing attacks, but each has its limitations. Therefore, providing relatively low-cost and highly secure cryptographic technology that can resist quantum computing attacks has become an urgent problem to be solved.

[0119] Based on the above questions, please refer to Figure 1 The embodiment of the present application provides a method for enhancing the anti-quantum security of an open identity connection protocol of a communication network, wherein the communication network includes a server and a client, and the method is used for the server, and the method includes:

[0120] 011: After completing the communication preprocessing, receive the anti-quantum token request information sent by the client;

[0121] 012: Generate access token and identity token based on quantum-resistant token request information;

[0122] 013: Randomly generate a temporary key pair associated with the client, which includes a temporary public key and a temporary private key;

[0123] 014: Obtain a quantum key identifier from a first network node accessing the server;

[0124] 015: Encrypt the access token to generate a quantum-resistant access token;

[0125] 016: Obtain a quantum-resistant identity token based on the temporary key pair, the quantum key identifier, the post-quantum cryptographic algorithm and the identity token;

[0126] 017: Send quantum-resistant access token and quantum-resistant identity token to the client;

[0127] 018: Receive a resource access request generated by the client based on the quantum-resistant access token and the quantum-resistant identity token, and confirm the access rights of the resource corresponding to the resource access request so that the client can access the resource of the server.

[0128] The embodiment of the present application also provides a server, including a memory and a processor. The method of the embodiment of the present application can be implemented by the server of the embodiment of the present application. Specifically, a computer program is stored in the memory, and the processor is used to receive the anti-quantum token request information sent by the client after completing the communication preprocessing. The processor is also used to generate an access token and an identity token according to the anti-quantum token request information. And randomly generate a temporary key pair associated with the client, the temporary key pair includes a temporary public key and a temporary private key. And obtain a quantum key identifier from the first network node of the self-access server. The processor is also used to encrypt the access token to generate an anti-quantum access token. And obtain an anti-quantum identity token based on the temporary key pair, the quantum key identifier, the post-quantum cryptographic algorithm and the identity token. And send the anti-quantum access token and the anti-quantum identity token to the client and receive the resource access request generated by the client according to the anti-quantum access token and the anti-quantum identity token, confirm the access rights of the resources corresponding to the resource access request, so that the client can access the server resources.

[0129] The embodiment of the present application also provides a server security enhancement device. The method of the embodiment of the present application can be implemented by the server security enhancement device of the embodiment of the present application. Specifically, the server security enhancement device includes a receiving module, a sending module, a derivation module, an acquisition module, an encryption module and a processing module. The receiving module is also used to receive the anti-quantum token request information sent by the client after completing the communication preprocessing. The derivation module is used to generate an access token and an identity token according to the anti-quantum token request information. The derivation module is also used to randomly generate a temporary key pair associated with the client, and the temporary key pair includes a temporary public key and a temporary private key. The acquisition module is used to obtain a quantum key identifier from the first network node of the self-access server. The encryption module is used to encrypt the access token and generate an anti-quantum access token. The processing module is used to obtain an anti-quantum identity token based on the temporary key pair, the quantum key identifier, the post-quantum cryptographic algorithm and the identity token. The sending module is used to send the anti-quantum access token and the anti-quantum identity token to the client. The receiving module is used to receive the resource access request generated by the client according to the anti-quantum access token and the anti-quantum identity token, and confirm the access rights of the resources corresponding to the resource access request, so that the client can access the server.

[0130] The present application provides a communication system based on an open identity connection protocol, the communication system comprising a server, a client and a quantum key distribution network of the above-mentioned implementation mode, wherein the quantum key distribution network is configured to distribute quantum keys to the server or the client.

[0131] Specifically, the quantum key distribution network includes network nodes and a quantum network link control center. Network nodes are used to store and distribute quantum keys in the quantum key distribution network. The quantum network link center can establish quantum key distribution and relay links between network nodes according to the names of network nodes. Quantum key distribution and relay links are used for functions such as data transfer. The quantum key distribution network is used to realize services such as quantum key generation, quantum key relay, and quantum key provision.

[0132] See also Figure 2 In some embodiments, the client sends an authorization request to the server, and the server responds to the authorization request sent by the client. The server also sends an identity token request and an access token request to the client, and the client also responds to the identity token request and the access token request sent by the server. Through multiple request sending and response, the server and the client complete the generation and distribution of identity tokens and access tokens. The client accesses a service node, which is a transfer station used by the client to connect to the network node, used to inject keys into the client and transfer and store quantum keys. The simple process for the server and the client to obtain quantum keys is as follows: First, the server sends a quantum key application to the first network node accessing the server. Then, the first network node distributes the quantum key generated according to the quantum key application to the server. At the same time, the quantum network link control center synchronizes the second network node accessing the client to generate a quantum key, but the quantum key will not be distributed to the access server immediately, but will be stored in the network node first. The corresponding relationships between the above-mentioned servers, clients, service nodes and network nodes are all provided by the management and control platform.

[0133] It should be noted that the implementation method of this application uses FIPS203 Module-Lattice-based Key-Encapsulation Mechanism Standard as the PQC key encapsulation algorithm and FIPS 204 Module-Lattice-Based Digital Signature Standard as the PQC digital signature algorithm for explanation. The following descriptions of operations related to the PQC algorithm refer to the above FIPS standards. Of course, in other implementations, other algorithms such as the NewHope algorithm, Sidh algorithm, HQC algorithm, etc. can also be used as PQC related algorithms. It should also be noted that the embodiments of this application are for the Open Identity Connection Protocol (OpenID Connect, OIDC), hereinafter referred to as the OIDC protocol.

[0134] Specifically, after completing the communication preprocessing, the client sends an anti-quantum token request information to the server. The server receives the anti-quantum token request information sent by the client. The server then generates an access token and an identity token based on the anti-quantum token request information. And randomly generates a temporary key pair associated with the client, the temporary key pair includes a temporary public key and a temporary private key. Then obtain the quantum key identifier from the first network node that accesses the server. When the quantum key identifier is obtained, the server encrypts the access token to generate an anti-quantum access token. And obtain the anti-quantum identity token based on the temporary key pair, the quantum key identifier, the post-quantum cryptographic algorithm and the identity token. Then, the server sends the anti-quantum access token and the anti-quantum identity token to the client.

[0135] The client receives the quantum-resistant access token and quantum-resistant identity token sent by the server. Then, the client sends a resource access request to the server based on the quantum-resistant access token and quantum-resistant identity token. The server confirms the access rights to the resource corresponding to the resource access request based on the resource access request, so that the client can access the server's resources.

[0136] The server receives a resource access request generated by the client according to the quantum-resistant access token and the quantum-resistant identity token, and confirms the access rights of the resource corresponding to the resource access request, so that the client can access the resource of the server.

[0137] In summary, in the anti-quantum security enhancement method, communication system, server and client of the open identity connection protocol of the communication network of the implementation mode of the present application, for the communication process in which the client applies to access the resources in the server, the client sends an anti-quantum token request information to the server. After receiving the anti-quantum token request information, the server applies to obtain a quantum key, and uses the quantum key and the post-quantum cryptographic algorithm to encrypt the access token and identity token generated according to the anti-quantum token request information to generate an anti-quantum access token and an anti-quantum identity token that can resist quantum computing attacks. The post-quantum cryptographic algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good resistance to quantum computing attacks. Next, the client receives the anti-quantum access token and anti-quantum identity token sent by the server, and sends the resource access request generated according to the anti-quantum access token and the anti-quantum identity token to the server. Then, the server determines whether the server can access the resources corresponding to the resource access request by verifying the validity of the anti-quantum access token and the anti-quantum identity token. In this way, the anti-quantum computing attack capability of the communication process in which the client applies to access server resources is enhanced by quantum key distribution technology and post-quantum cryptographic algorithms.

[0138] See also Figure 3 In some embodiments, the method further comprises:

[0139] 019: Receive the registration request sent by the client;

[0140] 020: Send a registration response request generated according to the registration request;

[0141] 021: receiving the authorization request sent by the client according to the registration response request;

[0142] 022: Generate an authorization code based on the authorization request and send the authorization code to the client.

[0143] In some embodiments, the receiving module is used to receive a registration request sent by the client. The sending module is used to send a registration response request generated according to the registration request. The receiving module is also used to receive an authorization request sent by the client according to the registration response request. The sending module is also used to generate an authorization code according to the authorization request and send the authorization code to the client.

[0144] In some embodiments, the processor is further configured to receive a registration request sent by the client, and send a registration response request generated according to the registration request. The processor is further configured to receive an authorization request sent by the client according to the registration response request, and generate an authorization code according to the authorization request, and send the authorization code to the client.

[0145] Specifically, the server receives a registration request sent by the client, the registration request includes the client's second post-quantum public key and the second classical public key. Then, the server sends a registration response request generated according to the registration request, the registration response request includes the server's first post-quantum public key and the first classical public key. Then, the server receives an authorization request sent by the client according to the registration response request. Finally, the server generates an authorization code according to the authorization request and sends the authorization code to the client.

[0146] In this way, the server and the client can exchange keys securely. The server and the client obtain each other's post-quantum public key and classical public key for subsequent signing and verification processes. The post-quantum public key has good resistance to quantum computing attacks, which can make the transmitted data have good resistance to quantum computing attacks.

[0147] See also Figure 4 In some embodiments, the quantum-resistant token request information includes an access random number, an identity random number, an access token request information, an identity token request information, a second post-quantum signature message, and a second classical signature message, and the method further includes:

[0148] 023: Verify the second post-quantum signature message according to the received second post-quantum public key to confirm the correctness of the access token request information and the access random number;

[0149] 024: Verify the second classic signature message according to the received second classic public key to confirm the correctness of the identity token request information and the identity random number.

[0150] In some embodiments, the confirmation module is used to perform a signature verification process on the second post-quantum signature message according to the received second post-quantum public key to confirm the correctness of the access token request information and the access random number. The confirmation module is also used to perform a signature verification process on the second classical signature message according to the received second classical public key to confirm the correctness of the identity token request information and the identity random number.

[0151] In some embodiments, the processor is further configured to perform signature verification processing on the second post-quantum signature message according to the received second post-quantum public key to confirm the correctness of the access token request information and the access random number. And perform signature verification processing on the second classical signature message according to the received second classical public key to confirm the correctness of the identity token request information and the identity random number.

[0152] Specifically, the server verifies the second post-quantum signature message according to the received second post-quantum public key to confirm the correctness of the access token request information and the access random number. Then, the server verifies the second classical signature message according to the received second classical public key to confirm the correctness of the identity token request information and the identity random number.

[0153] In this way, through the signature verification process, it is confirmed that the received access token request information, access random number, identity token request information and identity random number all come from the client and are not accessed without authorization.

[0154] See also Figure 5 In some embodiments, the quantum-resistant token request information includes an access random number, an identity random number, access token request information, and identity token request information. Step 012 (generating an access token and an identity token according to the quantum-resistant token request information) includes:

[0155] 0121: Generate an access token according to the access token request information. The access token includes an access random number.

[0156] 0122: Generate an identity token according to the identity token request information, where the identity token includes an identity random number.

[0157] In some embodiments, the derivation module is used to generate an access token according to the access token request information, and the access token includes an access random number. The derivation module is also used to generate an identity token according to the identity token request information, and the identity token includes an identity random number.

[0158] In some embodiments, the processor is further configured to generate an access token according to the access token request information, the access token including an access random number, and to generate an identity token according to the identity token request information, the identity token including an identity random number.

[0159] Specifically, the server generates an access token according to the access token request information, and the access token includes an access random number. Then, the server generates an identity token according to the identity token request information, and the identity token includes an identity random number.

[0160] In this way, both the access token and the identity token carry corresponding random numbers to maintain the uniqueness and freshness of the identity token and the access token.

[0161] See also Figure 6 In some embodiments, step 014 (obtaining a quantum key identifier from a first network node accessing the server) includes:

[0162] 0141: Sending a quantum key application to the first network node accessing the server;

[0163] 0142: Receive the first quantum key and quantum key identifier sent by the network node.

[0164] In some embodiments, the sending module is used to send a quantum key application to a first network node of the access server. The receiving module is used to receive a first quantum key and a quantum key identifier sent by the network node.

[0165] In some embodiments, the processor is further configured to send a quantum key application to a first network node accessing the server, and receive a first quantum key and a quantum key identifier sent by the network node.

[0166] Specifically, the server sends a quantum key application to a first network node connected to the server. Then, the server receives a first quantum key and a quantum key identifier sent by the network node, where the quantum key identifier is obtained by the first network node identifying the first quantum key according to an identification code of the first network node.

[0167] In this way, the server obtains the first quantum key and the quantum key identifier, which has good resistance to quantum computing attacks and can be used to make the communication between the server and the client have strong confidentiality. The quantum key identifier helps to manage and use the quantum key.

[0168] See also Figure 7 In some embodiments, the quantum-resistant token request information includes a second post-quantum signature message, and step 015 (encrypting the access token to generate a quantum-resistant access token) includes:

[0169] 0151: Sign the access token according to the classic signature algorithm and the received first classic private key to obtain a first classic signature message;

[0170] 0152: Store the first classical signature message and the second post-quantum signature message in the access token to obtain a quantum-resistant access token.

[0171] In some embodiments, the signature module is used to sign the access token according to the classical signature algorithm and the received first classical private key to obtain a first classical signature message. The storage module is used to store the first classical signature message and the second post-quantum signature message in the access token to obtain a quantum-resistant access token.

[0172] In some embodiments, the processor is further configured to sign the access token according to the classical signature algorithm and the received first classical private key to obtain a first classical signature message, and store the first classical signature message and the second post-quantum signature message in the access token to obtain a quantum-resistant access token.

[0173] Specifically, the server signs the access token according to the classical signature algorithm and the received first classical private key to obtain a first classical signature message. Then, the server stores the first classical signature message and the second post-quantum signature message in the access token to obtain a quantum-resistant access token.

[0174] In this way, the server obtains a quantum-resistant access token with good quantum-resistant capabilities, which can prevent data from being unauthorizedly accessed during the transmission of the quantum-resistant access token.

[0175] See also Figure 8 In some embodiments, the method further comprises:

[0176] 025: Encrypt the temporary private key according to the first quantum key to obtain an encrypted temporary private key;

[0177] 026: Replace the temporary private key with the encrypted temporary private key to obtain an encrypted temporary key pair.

[0178] In some embodiments, the encryption module is used to encrypt the temporary private key according to the first quantum key to obtain an encrypted temporary private key. The replacement module is used to replace the temporary private key with the encrypted temporary private key to obtain an encrypted temporary key pair.

[0179] In some embodiments, the processor is further configured to encrypt the temporary private key according to the first quantum key to obtain an encrypted temporary private key, and replace the temporary private key with the encrypted temporary private key to obtain an encrypted temporary key pair.

[0180] Specifically, the server encrypts the temporary private key according to the first quantum key to obtain an encrypted temporary private key. Then, the server replaces the temporary private key with the encrypted temporary private key to obtain an encrypted temporary key pair.

[0181] In this way, by encrypting the temporary private key in the generated temporary key pair, the security and confidentiality of the temporary key pair are ensured to prevent it from being obtained by unauthorized parties during transmission and storage.

[0182] See also Fig. 9 In some embodiments, the quantum-resistant token request information includes a second classical signature message, and step 016 (obtaining a quantum-resistant identity token according to a temporary key pair, a quantum key identifier, a post-quantum cryptographic algorithm, and an identity token) includes:

[0183] 0161: Store the encrypted temporary key pair and the quantum key identifier in the identity token to obtain an intermediate identity token;

[0184] 0162: Perform post-quantum signature processing on the intermediate identity token according to the first post-quantum private key of the server to obtain a first post-quantum signature message;

[0185] 0163: Store the first post-quantum signature message and the second classical signature message in an intermediate identity token to obtain a quantum-resistant identity token.

[0186] In some embodiments, the storage module is used to store the encrypted temporary key pair and the quantum key identifier in the identity token to obtain an intermediate identity token. The signature module is used to perform post-quantum signature processing on the intermediate identity token according to the first post-quantum private key of the server to obtain a first post-quantum signature message. The storage module is also used to store the first post-quantum signature message and the second classical signature message in the intermediate identity token to obtain a quantum-resistant identity token.

[0187] In some embodiments, the processor is further configured to store the encrypted temporary key pair and the quantum key identifier in the identity token to obtain an intermediate identity token, and perform post-quantum signature processing on the intermediate identity token according to the first post-quantum private key of the server to obtain a first post-quantum signature message, and store the first post-quantum signature message and the second classical signature message in the intermediate identity token to obtain a quantum-resistant identity token.

[0188] Specifically, the server stores the encrypted temporary key pair and the quantum key identifier in the identity token to obtain an intermediate identity token. Then, the server performs post-quantum signature processing on the intermediate identity token according to the server's first post-quantum private key to obtain a first post-quantum signature message. Finally, the server stores the first post-quantum signature message and the second classical signature message in the intermediate identity token to obtain a quantum-resistant identity token.

[0189] In this way, the server is able to generate a quantum-resistant identity token that is both secure and resistant to quantum computing attacks, and is able to verify the integrity and authenticity of the quantum-resistant identity token to ensure that it has not been tampered with.

[0190] See also Fig.10 In some embodiments, the resource access request includes a first signature value, and step 018 (receiving a resource access request generated by a client according to a quantum-resistant access token and a quantum-resistant identity token, and confirming access rights to a resource corresponding to the resource access request so that the client can access the resource of the server) includes:

[0191] 0181: Verify the second post-quantum signature message according to the post-quantum signature algorithm and the received second post-quantum public key;

[0192] 0182: verify the first classic signature message according to the classic signature algorithm and the first classic public key of the server;

[0193] 0183: When the second post-quantum signature message is verified successfully and the first classical signature message is verified successfully, the anti-quantum identity token and the first signature value are verified.

[0194] In some embodiments, the verification module is used to verify the second post-quantum signature message according to the post-quantum signature algorithm and the received second post-quantum public key, and to verify the first classical signature message according to the classical signature algorithm and the first classical public key of the server, and to verify the anti-quantum identity token and the first signature value when the second post-quantum signature message is verified and the first classical signature message is verified.

[0195] In some embodiments, the processor is further configured to verify the second post-quantum signature message according to the post-quantum signature algorithm and the received second post-quantum public key, and to verify the first classical signature message according to the classical signature algorithm and the first classical public key of the server, and to verify the anti-quantum identity token and the first signature value when the second post-quantum signature message is verified and the first classical signature message is verified.

[0196] Specifically, the server verifies the second post-quantum signature message according to the post-quantum signature algorithm and the received second post-quantum public key. Then, the server verifies the first classical signature message according to the classical signature algorithm and the first classical public key of the server. And when the second post-quantum signature message is verified and the first classical signature message is verified, the anti-quantum identity token and the first signature value are verified.

[0197] In this way, the security and integrity of the identity token are ensured through multiple signature verifications, preventing unauthorized access and potential attacks.

[0198] See also Fig.11 In some embodiments, step 0183 (verifying the anti-quantum identity token and the first signature value) includes:

[0199] 01831: Verify the first post-quantum signature message according to the post-quantum signature algorithm and the first post-quantum public key of the server;

[0200] 01832: verify the second classical signature message according to the classical signature algorithm and the received second classical public key;

[0201] 01833: verify the first signature value according to the temporary public key of the encrypted temporary key pair;

[0202] 01834: When the first post-quantum signature message is verified successfully, the second classical signature message is verified successfully, and the first signature value is verified successfully, the client is allowed to access the resources corresponding to the resource access request.

[0203] In some embodiments, the verification module is used to verify the first post-quantum signature message according to the post-quantum signature algorithm and the first post-quantum public key of the server. And verify the second classical signature message according to the classical signature algorithm and the received second classical public key. And verify the first signature value according to the temporary public key of the encrypted temporary key pair. The processing module allows the client to access the resource corresponding to the resource access request when the first post-quantum signature message is verified, the second classical signature message is verified, and the first signature value is verified.

[0204] In some embodiments, the processor is further configured to verify the first post-quantum signature message according to the post-quantum signature algorithm and the first post-quantum public key of the server. And verify the second classical signature message according to the classical signature algorithm and the received second classical public key. The processor is further configured to verify the first signature value according to the temporary public key of the encrypted temporary key pair. And in the case where the first post-quantum signature message is verified successfully, the second classical signature message is verified successfully, and the first signature value is verified successfully, the client is allowed to access the resource corresponding to the resource access request.

[0205] Specifically, the server verifies the first post-quantum signature message according to the post-quantum signature algorithm and the server's first post-quantum public key, confirms the integrity and authenticity of the first post-quantum signature message, and ensures that it has not been tampered with. Next, the server verifies the second classical signature message according to the classical signature algorithm and the received second classical public key, confirms the integrity and authenticity of the second classical signature message, and ensures that it has not been tampered with. Then, the server verifies the first signature value according to the temporary public key of the encrypted temporary key pair, confirms the validity of the first signature value, and ensures that it has not been tampered with. Finally, if the first post-quantum signature message is verified, the second classical signature message is verified, and the first signature value is verified, the server allows the client to access the resources corresponding to the resource access request.

[0206] In this way, multi-layer signature verification can enhance security, prevent malicious attacks and data tampering, and ensure that clients can legally access the required resources.

[0207] See also Fig.12 The embodiment of the present application provides a method for enhancing the anti-quantum security of an open identity connection protocol of a communication network, wherein the communication network includes a server and a client, and the method is used for the client, and the method includes:

[0208] 031: After completing the communication preprocessing, send the anti-quantum token request information to the server;

[0209] 032: Receive the quantum-resistant access token and quantum-resistant identity token sent by the server;

[0210] 033: Send a resource access request to the server based on the quantum-resistant access token and the quantum-resistant identity token. The server confirms the access rights to the resource corresponding to the resource access request based on the resource access request, so that the client can access the resource of the server.

[0211] The embodiment of the present application also provides a client, including a memory and a processor. The method of the embodiment of the present application can be implemented by the client of the embodiment of the present application. Specifically, a computer program is stored in the memory, and the processor is used to send anti-quantum token request information to the server after completing communication preprocessing. And receive the anti-quantum access token and anti-quantum identity token sent by the server. And send a resource access request to the server according to the anti-quantum access token and the anti-quantum identity token, and the server confirms the access rights of the resources corresponding to the resource access request according to the resource access request, so that the client can access the resources of the server.

[0212] The embodiment of the present application also provides a client security enhancement device. The method of the embodiment of the present application can be implemented by the client security enhancement device of the embodiment of the present application. Specifically, the client security enhancement device includes a sending module and a receiving module. The sending module is used to send anti-quantum token request information to the server when the communication preprocessing is completed. The receiving module is used to receive the anti-quantum access token and the anti-quantum identity token sent by the server. The sending module is also used to send a resource access request to the server according to the anti-quantum access token and the anti-quantum identity token, and the server confirms the access rights of the resource corresponding to the resource access request according to the resource access request, so that the client can access the resources of the server.

[0213] The present application provides a communication system based on an open identity connection protocol, the communication system comprising a client, a server and a quantum key distribution network of the above-mentioned implementation mode, wherein the quantum key distribution network is configured to distribute quantum keys to the server or the client.

[0214] Specifically, the anti-quantum security enhancement method of this embodiment is basically the same as the anti-quantum security enhancement method of the aforementioned embodiment with the server as the execution object. For details, please refer to the explanation of the corresponding part. The difference is that this embodiment takes the client as the execution object, which will not be repeated here.

[0215] In summary, in the anti-quantum security enhancement method, communication system, server and client of the open identity connection protocol of the communication network of the implementation mode of the present application, for the communication process in which the client applies to access the resources in the server, the client sends an anti-quantum token request information to the server. After receiving the anti-quantum token request information, the server applies to obtain a quantum key, and uses the quantum key and the post-quantum cryptographic algorithm to encrypt the access token and identity token generated according to the anti-quantum token request information to generate an anti-quantum access token and an anti-quantum identity token that can resist quantum computing attacks. The post-quantum cryptographic algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good resistance to quantum computing attacks. Next, the client receives the anti-quantum access token and anti-quantum identity token sent by the server, and sends the resource access request generated according to the anti-quantum access token and the anti-quantum identity token to the server. Then, the server determines whether the server can access the resources corresponding to the resource access request by verifying the validity of the anti-quantum access token and the anti-quantum identity token. In this way, the anti-quantum computing attack capability of the communication process in which the client applies to access server resources is enhanced by quantum key distribution technology and post-quantum cryptographic algorithms.

[0216] See also Fig.13 In some embodiments, the method further comprises:

[0217] 034: Send a registration request to the server;

[0218] 035: receiving a registration response request generated according to the registration request and sent by the server;

[0219] 036: Send an authorization request to the server according to the registration response request;

[0220] 037: Receive the authorization code generated by the client based on the authorization request.

[0221] In some embodiments, the sending module is used to send a registration request to the server. The receiving module is used to receive a registration response request generated by the server according to the registration request. The sending module is also used to send an authorization request to the server according to the registration response request. The receiving module is also used to receive an authorization code generated by the client according to the authorization request.

[0222] In some embodiments, the processor is further configured to send a registration request to the server, and receive a registration response request generated by the server according to the registration request. The processor is further configured to send an authorization request to the server according to the registration response request, and receive an authorization code generated by the client according to the authorization request.

[0223] Specifically, the client sends a registration request to the server, and the registration request includes the client's second post-quantum public key and the second classical public key. Then, the client receives a registration response request generated by the server according to the registration request, and the registration response request includes the server's first post-quantum public key and the first classical public key. Then the client sends an authorization request to the server according to the registration response request. Finally, the client receives the authorization code generated by the client according to the authorization request.

[0224] In this way, the server and the client can exchange keys securely. The server and the client obtain each other's post-quantum public key and classical public key for subsequent signing and verification processes. The post-quantum public key has good resistance to quantum computing attacks, which can make the transmitted data have good resistance to quantum computing attacks.

[0225] See also Fig.14 In some embodiments, step 031 (sending quantum-resistant token request information to the server) includes:

[0226] 0311: Generate initial token request information according to the authorization code. The initial token request information includes access token request information and identity token request information.

[0227] 0312: Perform post-quantum signature processing on the access token request information and the random access number randomly generated by the client according to the second post-quantum private key of the client to obtain a second post-quantum signature message;

[0228] 0313: The identity token request information and the identity random number randomly generated by the client are signed according to the second classic private key of the client to obtain a second classic signature message;

[0229] 0314: storing the access random number, the identity random number, the second post-quantum signature message and the second classical signature message in the initial token request information to obtain the quantum-resistant token request information;

[0230] 0315: Send the quantum-resistant token request information to the server.

[0231] In some embodiments, the derivation module is used to generate an initial token request message based on the authorization code. The signature module is used to perform post-quantum signature processing on the access token request message and the access random number randomly generated by the client according to the second post-quantum private key of the client to obtain a second post-quantum signature message. The signature module is also used to perform signature processing on the identity token request message and the identity random number randomly generated by the client according to the second classical private key of the client to obtain a second classical signature message. The storage module is used to store the access random number, the identity random number, the second post-quantum signature message and the second classical signature message in the initial token request message to obtain the anti-quantum token request message. The sending module is used to send the anti-quantum token request message to the server.

[0232] In some embodiments, the processor is further configured to generate initial token request information based on the authorization code. And perform post-quantum signature processing on the access token request information and the access random number randomly generated by the client according to the second post-quantum private key of the client to obtain a second post-quantum signature message. And perform signature processing on the identity token request information and the identity random number randomly generated by the client according to the second classical private key of the client to obtain a second classical signature message. The processor is further configured to store the access random number, the identity random number, the second post-quantum signature message, and the second classical signature message in the initial token request information to obtain quantum-resistant token request information. And send the quantum-resistant token request information to the server.

[0233] Specifically, the client generates an initial token request information based on the authorization code, and the initial token request information includes access token request information and identity token request information. Then, the client performs post-quantum signature processing on the access token request information and the access random number randomly generated by the client according to the client's second post-quantum private key to obtain a second post-quantum signature message. Then, the client performs signature processing on the identity token request information and the identity random number randomly generated by the client according to the client's second classical private key to obtain a second classical signature message. Finally, the client stores the access random number, the identity random number, the second post-quantum signature message and the second classical signature message in the initial token request information to obtain the anti-quantum token request information. And send the anti-quantum token request information to the server.

[0234] In this way, the client generates quantum-resistant token request information by using post-quantum cryptographic algorithms to ensure the security and integrity of quantum-resistant token request information, making it quantum-resistant and preventing unauthorized access and potential attacks. Through the classical signature algorithm and the post-quantum signature algorithm, the quantum-resistant token request information has dual protection, which can enhance security.

[0235] See also Fig.15 In some embodiments, the quantum-resistant access token includes a first classical signed message, the quantum-resistant identity token includes a first post-quantum signed message, and the method further includes:

[0236] 038: Verify the first classical signature message according to the first classical public key to confirm that the correct quantum-resistant access token has been received;

[0237] 039: Verify the first post-quantum signature message according to the first post-quantum public key to confirm that the correct quantum-resistant identity token has been received.

[0238] In some embodiments, the signature verification module is used to perform signature verification processing on the first classical signature message according to the first classical public key to confirm that the correct quantum-resistant access token is received. The signature verification module is also used to perform signature verification processing on the first post-quantum signature message according to the first post-quantum public key to confirm that the correct quantum-resistant identity token is received.

[0239] In some embodiments, the processor is further configured to perform a signature verification process on the first classical signature message according to the first classical public key to confirm that a correct quantum-resistant access token has been received, and perform a signature verification process on the first post-quantum signature message according to the first post-quantum public key to confirm that a correct quantum-resistant identity token has been received.

[0240] Specifically, the client verifies the first classical signature message according to the first classical public key to confirm that the correct quantum-resistant access token has been received. Then, the client verifies the first post-quantum signature message according to the first post-quantum public key to confirm that the correct quantum-resistant identity token has been received.

[0241] In this way, it is ensured that the quantum-resistant access token and quantum-resistant identity token received by the client are secure, have not been tampered with, and are legally issued by the server.

[0242] See also Fig.16 In certain embodiments, the quantum resistant identity token includes a quantum key identifier, and the method further includes:

[0243] 040: Use the service node to inject multiple keys into the client's cryptographic module;

[0244] 041: Send a quantum key application to the service node according to the quantum key identifier. The quantum key application is protected by a protection key, which is a randomly used key from multiple keys injected into the cryptographic module.

[0245] 042: receiving a quantum key encryption result obtained by the service node encrypting the second quantum key according to the protection key, where the second quantum key is generated by the first network node accessing the service node and distributed to the service node;

[0246] 043: Decrypt the quantum key encryption result to obtain a second quantum key.

[0247] In some embodiments, the charging module is further used to charge a plurality of keys to the cryptographic module of the client using the service node. The sending module is used to send a quantum key application to the service node according to the quantum key identifier. The receiving module is used to receive a quantum key encryption result obtained by the service node encrypting the second quantum key according to the protection key. The decryption module is used to decrypt the quantum key encryption result to obtain the second quantum key.

[0248] In some embodiments, the processor is further configured to use the service node to inject multiple keys into the cryptographic module of the client, and send a quantum key application to the service node according to the quantum key identifier. The processor is also configured to receive a quantum key encryption result obtained by the service node encrypting the second quantum key according to the protection key, and decrypt the quantum key encryption result to obtain the second quantum key.

[0249] Specifically, the client uses the service node to charge multiple keys into the client's cryptographic module. Then, the client sends a quantum key application to the service node based on the quantum key identifier sent by the client. The quantum key application is protected by a protection key, which is a randomly used one of the multiple keys charged into the cryptographic module. Then, the client receives the quantum key encryption result obtained by the service node by encrypting the second quantum key according to the protection key. The second quantum key is generated by the second network node connected to the service node and distributed to the service node. Finally, the client decrypts the quantum key encryption result to obtain the second quantum key.

[0250] In this way, the client obtains the second quantum key, which has good resistance to quantum computing attacks and can protect the communication between the server and the client.

[0251] See also Fig.17 In some embodiments, the quantum-resistant access token includes an access random number, the quantum-resistant identity token includes an identity random number and a cryptographic temporary key pair, the cryptographic temporary key pair includes a cryptographic temporary private key, and the method further includes:

[0252] 044: Decrypt the encrypted temporary private key according to the second quantum key to obtain a temporary private key;

[0253] 045: concatenate the verification random number, access random number and identity random number generated by the client at any time to obtain a first concatenated body;

[0254] 046: Sign the first spliced ​​body according to the temporary private key to obtain a first signature value.

[0255] In some embodiments, the decryption module is used to decrypt the encrypted temporary private key according to the second quantum key to obtain the temporary private key. The splicing module is also used to splice the verification random number, access random number and identity random number generated by the client at any time to obtain a first spliced ​​body. The signature module is also used to sign the first spliced ​​body according to the temporary private key to obtain a first signature value.

[0256] In some embodiments, the processor is further configured to decrypt the encrypted temporary private key according to the second quantum key to obtain a temporary private key, and to concatenate the verification random number, access random number, and identity random number generated by the client at any time to obtain a first concatenation, and to sign the first concatenation according to the temporary private key to obtain a first signature value.

[0257] Specifically, the client decrypts the encrypted temporary private key according to the second quantum key to obtain the temporary private key. Then, the client concatenates the verification random number, access random number and identity random number generated by the client at any time to obtain the first concatenation. Finally, the client signs the first concatenation according to the temporary private key to obtain the first signature value.

[0258] In this way, the user end obtains the first signature value and can verify the integrity and authenticity of the first spliced ​​body, ensuring that it has not been tampered with and is indeed generated by the client.

[0259] See also Fig.18 In some embodiments, step 033 (sending a resource access request to a server based on the quantum-resistant access token and the quantum-resistant identity token) includes:

[0260] 0331: Send a resource access request to the server according to the first signature value, the quantum-resistant access token, and the quantum-resistant identity token.

[0261] In some embodiments, the sending module is used to send a resource access request to the server according to the first signature value, the quantum-resistant access token, and the quantum-resistant identity token.

[0262] In some embodiments, the processor is further configured to send a resource access request to the server based on the first signature value, the quantum-resistant access token, and the quantum-resistant identity token.

[0263] Specifically, the client sends a resource access request to the server according to the first signature value, the quantum-resistant access token, and the quantum-resistant identity token.

[0264] In this way, the server can ensure that the resource access request is not accessed by unauthorized persons during transmission according to the first signature value sent by the client. The access rights of the resource access request are confirmed according to the quantum-resistant access token and quantum-resistant identity token sent by the client.

[0265] The following is an example to illustrate the method of implementing the present application. In the embodiment of the present application, the client is a client of the OIDC protocol, and is a third-party application that needs to access relevant resources in the OIDC application scenario. The client includes a resource owner, and the resource owner authorizes the resource access rights owned by the third-party application that needs to access the resource in the OIDC application scenario. The server includes an authentication server and a resource server. The authentication server is a server used to process authentication requests and issue tokens and user identity tokens for authorized access to relevant resources in the OIDC application scenario. The resource server is a server that provides relevant resources and their services. The resource server and the authentication server can be the same server or different servers. The same or different servers have no substantial impact on the anti-quantum enhancement method of the present application. In actual applications, the choice of the same server or different servers depends on specific needs, security considerations and budgets. In the embodiment of the present application, the resource server and the authentication server are deployed at different locations on the same server.

[0266] The quantum network node is a network node that stores and provides the generated quantum key to the server through a trusted channel or provides the generated quantum key to the client through a key service node. The key service node is a service node that is used to connect to the quantum network node and provide pre-shared key injection and quantum key services to multiple clients.

[0267] See also Fig.19 The classic public key can be a public key in a classic encryption algorithm such as the ECC algorithm and the RSA algorithm. The implementation of this application takes the ECC public key as an example. The access token request information is the main parameter for generating an access token, and the identity token request information is the main parameter for generating an identity token. The quantum-resistant token request information is the token request content and the client authentication content.

[0268] Before the client and the server communicate, the authentication server accesses the first quantum network node with the closest physical distance and completed authorization through a trusted channel. The trusted channel refers to a mechanism or protocol that provides a secure communication path between two communicating entities. One way to establish it is that the authentication server and the first quantum network node are in the same cabinet and directly connected by a shielded network cable. This channel ensures the confidentiality, integrity and availability of data during transmission, and prevents unauthorized access, tampering or eavesdropping. The client uses the key service node to charge the pre-shared key of the personal password module of the resource owner in the client, with a total of 1M bits of 128-bit key. The personal password module includes but is not limited to the smart password key (HSM) and the virtual security module (VSM).

[0269] In addition, before the client sends an authorization request to the server, the client sends a registration request to the authentication server in accordance with the standard document RFC7591 (OAuth 2.0 Dynamic Registration) published by the Internet Engineering Task Force (IETF), and submits the client's own PQC public key and ECC public key in the registration request. Then, the client receives the registration response request generated by the authentication server based on the registration request, and the successfully returned registration response request carries the authentication server's ECC public key and PQC public key.

[0270] The client sends an authorization request to the authentication server to access resources in the resource server. When the authentication server receives the authorization request sent by the client, it redirects the authorization request to the resource owner. When the resource owner approves the authorization request, the authentication server generates an authorization code and returns the authorization code to the client in the authorization response.

[0271] The client receives the authorization code Authorization Code generated by the authentication server according to the authorization request Authorization Request, and generates the token request information TokenRequest according to the authorization code Authorization Code, including the access token request information and the identity token request information. Specifically, the client generates the main parameters of the access token (Access Token-1) according to the demand for resources and attaches the randomly generated access random number R1. One way of attaching is to splice the main parameters and the access random number R1. In addition, the client generates the main parameters of the identity token (ID Token-1) according to the user's identity information and attaches the randomly generated identity random number R2. Then, the client uses the post-quantum signature algorithm and its own second post-quantum signature private key to perform post-quantum signature processing on the main parameters of the access token (Access Token-1) and the attached access random number R1 to obtain the second post-quantum signature message M1. The client also uses the ECC signature algorithm and its own ECC signature private key to perform classical signature processing on the main parameters of the identity token (ID Token-1) and the attached identity random number R2 to obtain the second classical signature message M2. The token request content and the client authentication content are sent to the authentication server. Among them, the token request content includes the main parameters for generating the access token (Access Token-1), the accompanying access random number R1, the main parameters for generating the identity token (ID Token-1) and the accompanying identity random number R2, and the client authentication content includes the second post-quantum signature message M1 and the second classical signature message M2.

[0272] After receiving the token request content and client authentication content sent by the client, the authentication server uses the client's second post-quantum public key and the second classical public key to verify the client authentication content. Specifically, the authentication server uses the second post-quantum public key to verify the second post-quantum signature message M1, and uses the second classical public key to verify the second classical signature message M2, so as to confirm that the main parameters for generating the access token (Access Token-1), the accompanying access random number R1, the main parameters for generating the identity token (ID Token-1), and the accompanying identity random number R2 have not been unauthorizedly accessed and tampered with during the transmission process. Then, the authentication server verifies the user's identity based on the main parameters for generating the identity token (IDToken-1) in the token request content to confirm that the user is legitimate. After confirming that the user is legitimate, confirm that the client's token parameters can be authorized based on the user's identity information and the corresponding access control policy.

[0273] After the authentication server confirms that the token parameters of the client can be authorized, the authentication server generates an access token (Access Token-1) based on the main parameters of the access token (Access Token-1). During the communication process, the access token always carries the access random number R1 to keep the access token fresh. The access token is signed using the ECC algorithm using the authentication server's own ECC private key to obtain the first classic signature message M3. After that, the authentication server stores the first classic signature message M3 and the second post-quantum signature message M1 in the access token (Access Token-1) to obtain the quantum-resistant access token Access Token.

[0274] The authentication server randomly generates a temporary ECC key pair T_ECC, which is bound to the client that initiates the token request information Token Request, that is, it is only used when the client accesses resources. The authentication server sends a quantum key application to the first quantum network node that is connected. Then, the authentication server receives the first quantum key QK_UUID-1 (more than 128 bits) and the quantum key identifier UUID_QK sent by the first quantum network node according to the quantum key application. The quantum key identifier UUID_QK is obtained by the first quantum network node identifying the first quantum key QK_UUID-1 according to the unique universal identification code of the first quantum network node. After obtaining the first quantum key QK_UUID-1, the authentication server uses the first quantum key QK_UUID-1 to encrypt the private key T_ECC_priv in the temporary key T_ECC to obtain a temporary encrypted private key. And replace the private key T_ECC_priv with the temporary encrypted private key to obtain an encrypted temporary key pair.

[0275] The authentication server generates an identity token (IDToken-1) based on the main parameters for generating the identity token (ID Token-1). During the communication process, the identity token always carries the identity random number R2 to keep the identity token fresh. The authentication server stores the encryption key pair and the quantum key identifier UUID_QK in the identity token to obtain an intermediate identity token. The authentication server then uses its own first post-quantum private key to perform post-quantum signature processing on the intermediate identity token to obtain the first post-quantum signature message M4. Next, the authentication server stores the first post-quantum signature message M4 and the second classical signature message M2 in the intermediate identity token to obtain a quantum-resistant identity token. Both the quantum-resistant identity token and the quantum-resistant access token are returned to the client.

[0276] After receiving the quantum-resistant identity token and quantum-resistant access token, the client uses the first classical public key ECC public key of the authentication server to verify the quantum-resistant access token and confirm the correctness of the quantum-resistant access token. The client also uses the first post-quantum public key of the authentication server to verify the quantum-resistant identity token and confirm the correctness of the quantum-resistant identity token.

[0277] After confirming that the correct quantum-resistant identity token and quantum-resistant access token have been received, the client sends a quantum key application to the key service node based on the quantum key identifier UUID_QK in the quantum-resistant identity token, and randomly uses a key in the smart password key as the protection key. The client performs a hash operation (Hash-based Message Authentication Code, HMAC) on the key ID and the application content by using the SM3 algorithm and the protection key. Afterwards, the key service node also performs a hash operation on the key ID and the application content by using the SM3 algorithm and the protection key to verify the integrity and authenticity of the data. HMAC is a method that uses hash functions and keys to provide data integrity and source authentication.

[0278] After the quantum key application is confirmed successfully, the client receives the quantum key encryption result obtained by the key service node by encrypting the second quantum key QK_UUID-2 according to the protection key. The second quantum key QK_UUID-2 is generated by the second quantum network node connected to the key service node and distributed to the key service node. The client then decrypts the quantum key encryption result according to the protection key to obtain the second quantum key QK_UUID-2.

[0279] After obtaining the second quantum key QK_UUID-2, the client uses the second quantum key QK_UUID-2 to decrypt the encrypted temporary key pair in the quantum-resistant identity token to obtain the ECC private key T_ECC_priv. Then the client accesses the protected resources in the resource server according to the resource access request generated by the quantum-resistant access token Access Token and the quantum-resistant identity token ID Token. In addition, the resource access request includes the first signature value of the client, which is generated by the following method: the client generates a 256-bit verification random number R3, and then uses the ECC private key T_ECC_priv to calculate the ECC signature of the verification random number R3, the access random number R1 in the access token, and the identity random number R2 in the identity token to obtain the first signature value.

[0280] After receiving the resource access request, the resource server submits the first signature value, quantum-resistant access token Access Token and quantum-resistant identity token ID Token in the resource access request to the authentication server for verification.

[0281] The authentication server uses the PQC algorithm and the ECC algorithm to double-verify the second post-quantum signature message M1 of the client in the quantum-resistant access token Access Token and the first classical signature message M3 of the authentication server, and uses the ECC algorithm and the PQC algorithm to double-verify the second classical signature message M2 of the client in the identity token (ID Token) and the first post-quantum signature message M4 of the authentication server. After that, the authentication server verifies the first signature value according to the temporary public key of the encrypted temporary key pair. After the double verification of the two tokens passes and the first signature value passes, the resource server is notified to allow the resource access request according to the authorization information of the quantum-resistant access token.

[0282] The present application also provides a computer-readable storage medium containing a computer program. When the computer program is executed by one or more processors, the one or more processors execute the method of the present application.

[0283] It is understood that a computer program includes computer program code. The computer program code may be in source code form, object code form, executable file or some intermediate form. Computer readable storage media may include: any entity or device capable of carrying computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution medium.

[0284] In the description of this specification, the descriptions with reference to the terms "specifically", "further", "particularly", "understandably", etc. are intended to mean that the specific features, structures, materials or characteristics described in conjunction with the embodiments or examples are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms are not intended to refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0285] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0286] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A method for enhancing quantum security of an open identity connection protocol of a communication network, characterized in that: The communication network includes a server and a client, and the method is used for the server, and the method includes: When the communication preprocessing is completed, receiving the anti-quantum token request information sent by the client; Generate an access token and an identity token according to the quantum-resistant token request information; Randomly generate a temporary key pair associated with the client, the temporary key pair comprising a temporary public key and a temporary private key; Obtaining a quantum key identifier from a first network node connected to the server; Encrypting the access token to generate a quantum-resistant access token; Obtain a quantum-resistant identity token according to the temporary key pair, the quantum key identifier, the post-quantum cryptographic algorithm, and the identity token; Sending the quantum-resistant access token and the quantum-resistant identity token to the client; A resource access request generated by the client according to the quantum-resistant access token and the quantum-resistant identity token is received, and access rights to resources corresponding to the resource access request are confirmed so that the client can access resources on the server.

2. The method according to claim 1, characterized in that The method further comprises: Receiving a registration request sent by the client, wherein the registration request includes a second post-quantum public key and a second classical public key of the client; Sending a registration response request generated according to the registration request, wherein the registration response request includes a first post-quantum public key and a first classical public key of the server; Receiving an authorization request sent by the client obtained according to the registration response request; An authorization code is generated according to the authorization request, and the authorization code is sent to the client.

3. The method according to claim 1, characterized in that The quantum-resistant token request information includes an access random number, an identity random number, access token request information, identity token request information, a second post-quantum signature message, and a second classical signature message, and the method further includes: Performing signature verification processing on the second post-quantum signature message according to the received second post-quantum public key to confirm the correctness of the access token request information and the access random number; The second classic signature message is verified according to the received second classic public key to confirm the correctness of the identity token request information and the identity random number.

4. The method according to claim 1, characterized in that The quantum-resistant token request information includes an access random number, an identity random number, access token request information, and identity token request information. The step of generating an access token and an identity token according to the quantum-resistant token request information includes: Generate the access token according to the access token request information, wherein the access token includes an access random number; The identity token is generated according to the identity token request information, and the identity token includes an identity random number.

5. The method according to claim 1, characterized in that The obtaining of a quantum key identifier from a first network node connected to the server includes: Sending a quantum key application to a first network node connected to the server; A first quantum key and a quantum key identifier sent by the network node are received, where the quantum key identifier is obtained by the first network node performing identification processing on the first quantum key according to an identification code of the first network node.

6. The method according to claim 5, characterized in that The quantum-resistant token request information includes a second post-quantum signature message, and the encrypting the access token to generate a quantum-resistant access token includes: Signing the access token according to the classic signature algorithm and the received first classic private key to obtain a first classic signature message; The first classical signature message and the second post-quantum signature message are stored in the access token to obtain a quantum-resistant access token.

7. The method according to claim 6, characterized in that The method further comprises: Encrypting the temporary private key according to the first quantum key to obtain an encrypted temporary private key; The temporary private key is replaced with the encrypted temporary private key to obtain an encrypted temporary key pair.

8. The method according to claim 7, characterized in that The quantum-resistant token request information includes a second classical signature message, and obtaining the quantum-resistant identity token according to the temporary key pair, the quantum key identifier, the post-quantum cryptographic algorithm and the identity token includes: Storing the encrypted temporary key pair and the quantum key identifier in the identity token to obtain an intermediate identity token; Performing post-quantum signature processing on the intermediate identity token according to the first post-quantum private key of the server to obtain a first post-quantum signature message; The first post-quantum signature message and the second classical signature message are stored in the intermediate identity token to obtain the quantum-resistant identity token.

9. The method according to claim 8, characterized in that The resource access request includes a first signature value, and the receiving the resource access request generated by the client according to the quantum-resistant access token and the quantum-resistant identity token, and confirming access rights to resources corresponding to the resource access request so that the client accesses resources to the server, includes: Verifying the second post-quantum signature message according to the post-quantum signature algorithm and the received second post-quantum public key; Verifying the first classic signature message according to the classic signature algorithm and the first classic public key of the server; When the second post-quantum signature message is verified successfully and the first classical signature message is verified successfully, the quantum-resistant identity token and the first signature value are verified.

10. The method according to claim 9, characterized in that The verifying the quantum-resistant identity token and the first signature value comprises: Verifying the first post-quantum signature message according to a post-quantum signature algorithm and a first post-quantum public key of the server; Verifying the second classical signature message according to the classical signature algorithm and the received second classical public key; Verifying the first signature value according to the temporary public key of the encrypted temporary key pair; When the first post-quantum signature message is verified successfully, the second classical signature message is verified successfully, and the first signature value is verified successfully, the client is allowed to access the resource corresponding to the resource access request.

11. A method for enhancing quantum security of an open identity connection protocol of a communication network, characterized in that: The communication network includes a server and a client, the method is used for the client, and the method includes: When the communication preprocessing is completed, sending anti-quantum token request information to the server; Receiving a quantum-resistant access token and a quantum-resistant identity token sent by the server, wherein the quantum-resistant access token is generated by the server by encrypting the access token according to a post-quantum cryptographic algorithm, the quantum-resistant identity token is obtained by the server according to a temporary key pair, a quantum key identifier, a post-quantum cryptographic algorithm and an identity token, and the access token and the identity token are generated by the server according to the quantum-resistant token request information; A resource access request is sent to the server according to the quantum-resistant access token and the quantum-resistant identity token, and the server confirms access rights to resources corresponding to the resource access request according to the resource access request, so that the client accesses resources to the server.

12. The method according to claim 11, characterized in that The method further comprises: Sending a registration request to the server, the registration request including the second post-quantum public key and the second classical public key of the client; Receiving a registration response request generated according to the registration request and sent by the server, the registration response request including a first post-quantum public key and a first classical public key of the server; Sending an authorization request to the server according to the registration response request; Receive an authorization code generated by the client according to the authorization request.

13. The method according to claim 12, characterized in that The sending of quantum-resistant token request information to the server includes: Generate initial token request information according to the authorization code, wherein the initial token request information includes access token request information and identity token request information; Performing post-quantum signature processing on the access token request information and the access random number randomly generated by the client according to the second post-quantum private key of the client to obtain a second post-quantum signature message; The identity token request information and the identity random number randomly generated by the client are signed according to the second classic private key of the client to obtain a second classic signature message; Storing the access random number, the identity random number, the second post-quantum signature message, and the second classical signature message in the initial token request information to obtain the quantum-resistant token request information; The quantum-resistant token request information is sent to the server.

14. The method according to claim 12, characterized in that The quantum-resistant access token includes a first classical signature message, the quantum-resistant identity token includes a first post-quantum signature message, and the method further includes: Performing signature verification on the first classical signature message according to the first classical public key to confirm that a correct quantum-resistant access token has been received; The first post-quantum signature message is verified according to the first post-quantum public key to confirm that a correct quantum-resistant identity token has been received.

15. The method according to claim 14, characterized in that The quantum resistant identity token includes a quantum key identifier, and the method further includes: Using a service node to inject multiple keys into the cryptographic module of the client; Sending a quantum key application to the service node according to the quantum key identifier, wherein the quantum key application is protected by a protection key, and the protection key is a randomly used one from a plurality of keys injected into the cryptographic module; receiving a quantum key encryption result obtained by the service node encrypting a second quantum key according to the protection key, where the second quantum key is generated by a first network node connected to the service node and distributed to the service node; The quantum key encryption result is decrypted to obtain the second quantum key.

16. The method according to claim 15, characterized in that The quantum-resistant access token includes an access random number, the quantum-resistant identity token includes an identity random number and an encrypted temporary key pair, the encrypted temporary key pair includes a temporary public key and an encrypted temporary private key, and the method further includes: Decrypting the encrypted temporary private key according to the second quantum key to obtain a temporary private key; The verification random number, the access random number and the identity random number generated by the client at any time are concatenated to obtain a first concatenated body; The first spliced ​​body is signed according to the temporary private key to obtain a first signature value.

17. The method according to claim 16, characterized in that The sending a resource access request to the server according to the quantum-resistant access token and the quantum-resistant identity token comprises: Send a resource access request to the server according to the first signature value, the quantum-resistant access token, and the quantum-resistant identity token.

Images