Communication data transmission method, device, equipment and storage medium

Abstract

The present application discloses a communication data transmission method, device, equipment and storage medium, which relates to the field of information security technology, including: sending the first security alliance load determined based on the pre-quantum cryptographic algorithm, the post-quantum cryptographic algorithm and the hybrid mode recommended load to the responder through the initiator, so that the responder can send the second security alliance load; if it is a spliced ​​hybrid mode, the pre-quantum double certificate and the post-quantum double certificate are sent to the initiator through the responder, and if it is a nested hybrid mode, the pre-quantum and post-quantum hybrid double certificates are sent to the initiator through the responder; the identity authentication of the two communicating parties and the generation of the target key parameters are performed, and after the authentication is successful, the target key parameters are verified; if the verification is successful, the key exchange is performed based on the target key parameters and the post-quantum cryptographic algorithm, the session key is determined, and the communication data transmission is performed according to the security message protocol and the session key. The quantum security enhancement of the national secret Internet security protocol is realized.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a communication data transmission method, device, equipment and storage medium. Background Art

[0002] The IPSec (Internet Protocol Security) protocol is one of the important technologies for building a virtual private network (VPN). It is a group of secure communication protocols based on the network layer and applied cryptography. It provides confidentiality, authenticity and integrity security for network communication data by establishing an IPSec tunnel between specific communication parties and using technical means such as public key cryptography, symmetric cryptography and hash cryptography. The rapid development of quantum computing and the introduction of quantum algorithms such as Shor and Grover have brought great threats and challenges to current cryptography, resulting in the possibility of cracking the current domestic public key cryptography algorithms SM2 and SM9, and the security of the current symmetric and hash algorithms SM3 and SM4 has been halved. The substantial progress in the international standardization of post-quantum cryptographic algorithms has accelerated the work of post-quantum cryptographic migration. The protocols based on the current domestic commercial cryptographic algorithms will lose their security value due to quantum computing attacks. Therefore, the protocols need to gradually transition to quantum-safe cryptographic algorithms, and at the same time have the ability to migrate and update to subsequent cryptographic technologies.

[0003] The national secret IPSec protocol generally refers to and follows the specifications of the international IPSec protocol, but it still has characteristics that conform to commercial cryptographic technology. There have been many attempts and practices in the international IPSec protocol's post-quantum cryptographic migration, but the quantum security enhancement method for the national secret IPSec protocol has not yet been clarified. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a communication data transmission method, device, equipment and storage medium, which can realize quantum security enhancement of the national secret Internet security protocol. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a communication data transmission method, comprising:

[0006] The initiator sends a first security association payload determined based on a pre-quantum cryptographic algorithm, a post-quantum cryptographic algorithm, and a payload for suggesting a hybrid mode of a key exchange protocol to the responder, so that the responder sends a second security association payload for determining a target hybrid mode to the initiator based on the first security association payload; the pre-quantum cryptographic algorithm is an SM2 algorithm;

[0007] If the target hybrid mode is a preset splicing hybrid mode, the pre-quantum dual certificate and the post-quantum dual certificate are sent to the initiator through the responder; if the target hybrid mode is a preset nested hybrid mode, the pre-quantum and post-quantum hybrid dual certificates are sent to the initiator through the responder; the pre-quantum and post-quantum hybrid dual certificates are dual certificates obtained by mixing the pre-quantum dual certificate with the post-quantum dual certificate;

[0008] The communication parties authenticate their identities and generate their own target key parameters based on their local dual certificates and exchange data sent to each other, and after successful authentication, verify the target key parameters corresponding to the communication parties respectively;

[0009] If the target key parameter verification is successful, key exchange is performed based on the target key parameters, post-quantum symmetric cryptographic algorithm and post-quantum hash cryptographic algorithm to determine the session key, and communication data transmission is performed between the communicating parties according to the secure message protocol and the session key.

[0010] Optionally, the pre-quantum dual certificate includes an SM2 encryption certificate and an SM2 digital signature certificate; the post-quantum dual certificate includes a post-quantum digital signature certificate and a post-quantum key encapsulation certificate; the pre-quantum and post-quantum hybrid dual certificate includes a digital signature certificate and an encryption key encapsulation certificate obtained by mixing the pre-quantum dual certificate and the post-quantum dual certificate.

[0011] Optionally, the identity authentication of the communicating parties and the generation of their own target key parameters are performed by the communicating parties based on their own local dual certificates and exchange data sent to each other, including:

[0012] The communicating parties respectively perform decryption and signature verification calculations on the exchanged data sent to each other based on their own local dual certificates to obtain corresponding calculation results;

[0013] Comparing the calculation results obtained by each of the communicating parties with their own local preset data respectively;

[0014] If the calculation results corresponding to the two communicating parties are the same as their own local preset data, the identity authentication of the two communicating parties is completed, and the two communicating parties generate corresponding target key parameters based on their own local dual certificates, the exchanged data, and the pre-quantum cryptographic algorithm and / or the post-quantum cryptographic algorithm;

[0015] Otherwise, just end it.

[0016] Optionally, the verifying the target key parameters corresponding to the two communicating parties respectively includes:

[0017] The initiator uses the post-quantum hash cryptographic algorithm to perform hash load calculation on the target key parameter corresponding to the initiator to obtain a first hash value, and encrypts the first hash value based on the post-quantum symmetric cryptographic algorithm and sends it to the responder;

[0018] The responder performs hash load calculation on the target key parameter corresponding to the responder by using the post-quantum hash cryptographic algorithm to obtain a second hash value, and encrypts the second hash value based on the post-quantum symmetric cryptographic algorithm and sends it to the initiator;

[0019] After the communicating parties each receive the hash value sent by the other party, comparing the first hash value with the second hash value;

[0020] If the first hash values ​​of the communicating parties are equal to the second hash values, the target key parameter verification is successful.

[0021] Optionally, after verifying the target key parameters corresponding to the two communicating parties respectively, the method further includes:

[0022] If the first hash value and the second hash value of the communicating parties are not equal, an error message is sent and the communication ends directly.

[0023] Optionally, before transmitting the communication data between the two communicating parties according to the secure message protocol and the session key, the method further includes:

[0024] The negotiation of parameters and security policies is completed through data exchange between the communicating parties, so that communication data transmission between the communicating parties is carried out based on the parameters and security policies; the security policies include any one or a combination of encryption algorithms, encapsulation protocols, encapsulation modes and key expiration dates.

[0025] Optionally, the transmitting of communication data between the communicating parties according to the secure message protocol and the session key includes:

[0026] deriving the target key parameters to determine an encryption key and an integrity key;

[0027] Determining an authentication header protocol using the encryption key and determining an encapsulating security payload protocol based on the integrity key;

[0028] Determining the pre-negotiated secure message protocol;

[0029] If the secure message protocol is the authentication header protocol, communication data transmission between the communicating parties is performed based on a post-quantum symmetric cryptographic algorithm and the session key;

[0030] If the secure message protocol is the Encapsulating Security Payload protocol, communication data transmission between the communicating parties is performed based on a post-quantum hash cryptographic algorithm and the session key;

[0031] If the security message protocol is the authentication header protocol and the encapsulating security payload protocol, communication data transmission between the communicating parties is performed based on the post-quantum symmetric cryptographic algorithm, the post-quantum hash cryptographic algorithm and the session key.

[0032] In a second aspect, the present application discloses a communication data transmission device, comprising:

[0033] A security association payload sending module, configured to send, through an initiator, a first security association payload determined based on a pre-quantum cryptographic algorithm, a post-quantum cryptographic algorithm, and a payload for suggesting a hybrid mode of a key exchange protocol to a responder, so that the responder sends a second security association payload for determining a target hybrid mode to the initiator based on the first security association payload; the pre-quantum cryptographic algorithm is an SM2 algorithm;

[0034] A certificate sending module, for sending the pre-quantum dual certificate and the post-quantum dual certificate to the initiator through the responder if the target hybrid mode is a preset splicing hybrid mode, and for sending the pre-quantum and post-quantum hybrid dual certificates to the initiator through the responder if the target hybrid mode is a preset nested hybrid mode; the pre-quantum and post-quantum hybrid dual certificates are dual certificates obtained by mixing the pre-quantum dual certificates with the post-quantum dual certificates;

[0035] An identity authentication module, used to authenticate the identities of both parties and generate their own target key parameters based on their local dual certificates and exchanged data sent to each other;

[0036] A key parameter verification module, used to verify the target key parameters corresponding to the two communicating parties respectively after successful authentication;

[0037] A communication data transmission module is used to perform key exchange based on the target key parameters, post-quantum symmetric cryptographic algorithm and post-quantum hash cryptographic algorithm to determine the session key if the target key parameter verification is successful, and to perform communication data transmission between the communicating parties according to the secure message protocol and the session key.

[0038] In a third aspect, the present application discloses an electronic device, comprising:

[0039] Memory, used to store computer programs;

[0040] A processor is used to execute the computer program to implement the communication data transmission method as described above.

[0041] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the communication data transmission method as described above.

[0042] When the present application performs communication data transmission, the initiator first sends a first security association payload determined based on a pre-quantum cryptographic algorithm, a post-quantum cryptographic algorithm, and a payload for suggesting a hybrid mode of a key exchange protocol to the responder, so that the responder sends a second security association payload for determining a target hybrid mode to the initiator based on the first security association payload; the pre-quantum cryptographic algorithm is the SM2 algorithm; then the target hybrid mode is determined, and if the target hybrid mode is a preset spliced ​​hybrid mode, the pre-quantum dual certificate and the post-quantum dual certificate are sent to the initiator by the responder, and if the target hybrid mode is a preset nested hybrid mode, the pre-quantum dual certificate and the post-quantum dual certificate are sent to the initiator by the responder. The book is sent to the initiator; the front-to-back quantum hybrid double certificate is a double certificate obtained by mixing the front-to-back quantum double certificate with the post-to-back quantum double certificate; after determination, the communication parties are authenticated based on their own local double certificates and the exchanged data sent to each other, and the target key parameters of the communication parties are generated, and after the authentication is successful, the target key parameters corresponding to the communication parties are verified; finally, if the target key parameter verification is successful, the key exchange is performed based on the target key parameter, the post-quantum symmetric cryptographic algorithm and the post-quantum hash cryptographic algorithm to determine the session key, and the communication data between the communication parties is transmitted according to the secure message protocol and the session key. It can be seen that this application constructs a quantum-safe national secret IPSec protocol through a post-quantum cryptographic algorithm, and proposes a post-quantum double certificate system in a pure post-quantum cryptographic mode and a hybrid double certificate system in a front-to-back quantum hybrid mode. By adopting different modes of mixing front-to-back quantum cryptography, the quantum security of the key exchange protocol is enhanced, and the migration properties of the protocol such as quantum security, forward compatibility, and backward compatibility are met; the pure post-quantum cryptographic mode is adopted to enhance the quantum security of the secure message protocol. The introduction of post-quantum cryptographic algorithms makes the protocol quantum-safe. The hybrid mode of forward and backward quantum splicing of the key exchange protocol not only supports the cryptographic agility of multi-key exchange, but also supports the forward and backward compatibility of the protocol. During the transition period of post-quantum cryptographic migration, it can effectively support the migration verification of the national secret IPSec protocol in different scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0044] Figure 1 A flow chart of a communication data transmission method disclosed in this application;

[0045] Figure 2 A relationship diagram of two phases of a key exchange protocol disclosed in this application;

[0046] Figure 3 A schematic diagram of a post-quantum dual-certificate system disclosed in this application;

[0047] Figure 4 A schematic diagram of a front-to-back quantum hybrid dual certificate system disclosed in this application;

[0048] Figure 5 A schematic diagram of a post-quantum key encapsulation certificate format disclosed in this application;

[0049] Figure 6 A schematic diagram of a forward and backward quantum hybrid signature certificate format disclosed in this application;

[0050] Figure 7 A schematic diagram of an encryption-key encapsulation certificate format disclosed in this application;

[0051] Figure 8 This is a schematic diagram of the structure of a communication data transmission device disclosed in this application;

[0052] Fig. 9 This is a structural diagram of an electronic device disclosed in this application.

[0053] Reference numerals:

[0054] 11-security alliance payload sending module; 12-certificate sending module; 13 identity authentication module; 14-key parameter verification module; 15-communication data transmission module; 20-electronic device; 21-processor; 22-memory; 23-power supply; 24-communication interface; 25-input and output interface; 26-communication bus; 221-operating system; 222-computer program. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] The existing national secret IPSec protocol has the following problems in the post-quantum era: First, the national secret IPSec protocol using the current domestic commercial cryptographic algorithm is difficult to resist quantum computing attacks; second, the public key cryptographic algorithm in the national secret IPSec protocol is replaced by a pure post-quantum public key cryptographic algorithm. Although it can resist quantum computing attacks, it cannot be forward compatible, and it is difficult to achieve the smooth and agile transition of the national secret IPSec protocol to post-quantum cryptography; third, the existing post-quantum cryptographic algorithm to be standardized has a single function, only a key encapsulation algorithm and a digital signature algorithm, and lacks a public key encryption and decryption algorithm, so it is impossible to construct a post-quantum encryption certificate to meet the dual certificate system of the national secret PKI (Public Key Infrastructure). In order to solve the above technical problems, this application discloses a communication data transmission method that can resist quantum computing attacks, and can also achieve forward compatibility, backward compatibility and multi-key attributes, effectively maintain the original interaction framework of the protocol, and achieve a smooth transition of the national secret IPSec protocol to post-quantum cryptography.

[0057] See also Figure 1 As shown, an embodiment of the present invention discloses a communication data transmission method, including:

[0058] Step S11: The initiator sends a first security association payload determined based on a pre-quantum cryptographic algorithm, a post-quantum cryptographic algorithm, and a payload for suggesting a hybrid mode of a key exchange protocol to the responder, so that the responder sends a second security association payload for determining a target hybrid mode to the initiator based on the first security association payload; the pre-quantum cryptographic algorithm is an SM2 algorithm.

[0059] In this embodiment, when the two communicating parties communicate, there will be transmission of communication data. IPSec works at the network layer. The IPSec protocol is actually a set of IP cryptographic protocols, which is generally used for communication between two subnets, called site-to-site communication. It provides a complete set of security architecture for communication data on the network layer, including: IKE (Internet KeyExchange, key exchange) protocol, authentication header (AH, Authentication Header) protocol, Encapsulating Security Payload (ESP, Encapsulating Security Payload) protocol and some algorithms for network identity authentication and encryption. The main workflow of the National Secret IPSec Protocol can be understood as two major steps: First, the communicating parties execute the key exchange protocol (two stages and two modes: the first stage-main mode and the second stage-quick mode), and second, the communicating parties execute the security message protocol (including AH and ESP protocols). Among them, the communicating parties execute the key exchange protocol in the first stage main mode, such as Figure 2As shown, the initiator first sends a SA (Security Association) payload encapsulating the pre-quantum cryptographic algorithm, the post-quantum cryptographic algorithm and the hybrid mode suggestion payload to the responder. Then the responder sends the SA payload of the algorithm proposal it accepts. It should be noted that the definition of the SA attribute for the hybrid mode can follow the following method, NEGOTIATE_MODE_XX. Specifically, the SA attribute values ​​for the spliced ​​hybrid mode and the nested hybrid mode mentioned above can be defined as NEGOTIATE_MODE_SPLICE and NEGOTIATE_MODE_NEST. For the definition of the algorithm SA attribute value in the hybrid mode, you can refer to the following method: For pure post-quantum cryptographic algorithm, define it according to ENC_ALG_XXX (post-quantum algorithm identifier), HASH_ALG_XXX (post-quantum algorithm identifier), and ASYMMETRIC_XXX (post-quantum algorithm identifier). For example, for the post-quantum digital signature algorithm, it can be defined as: ASYMMETRIC_DILITHIUM2 / 3 / 5, ASYMMETRIC_SPHINCS+128 / 256, etc.; for the post-quantum key encapsulation algorithm, it can be defined as: ASYMMETRIC_KYBER512 / 768 / 1024, etc. For pre-quantum and post-quantum hybrid cryptographic algorithms, they are defined as ENC_ALG_XXX (pre-quantum algorithm identifier)_XXX (post-quantum algorithm identifier), HASH_ALG_XXX (pre-quantum algorithm identifier)_XXX (post-quantum algorithm identifier), and ASYMMETRIC_XXX (pre-quantum algorithm identifier)_XXX (post-quantum algorithm identifier). For example, for pre-quantum and post-quantum digital signature algorithms, they can be defined as ASYMMETRIC_SM2_DILITHIUM2, and for key exchange algorithms, they can be defined as ASYMMETRIC_SM2_KYBER512, etc. In the multi-key exchange scenario, the SA attribute definition is spliced ​​in the order of series connection, such as ASYMMETRIC_SM2_KYBER512_KYBER768, which means that three key exchanges are performed according to the SM2 key exchange, KYBER512, and KYBER768 algorithms, and then the key materials obtained each time are negotiated and calculated according to the subsequent key derivation method for the final key.

[0060] Step S12: If the target hybrid mode is a preset splicing hybrid mode, the pre-quantum dual certificate and the post-quantum dual certificate are sent to the initiator through the responder; if the target hybrid mode is a preset nested hybrid mode, the pre-quantum and post-quantum hybrid dual certificates are sent to the initiator through the responder; the pre-quantum and post-quantum hybrid dual certificates are dual certificates obtained by mixing the pre-quantum dual certificate with the post-quantum dual certificate.

[0061] In this embodiment, for the construction method of the front-to-back quantum hybrid mode in the key exchange protocol, two construction methods, namely the splicing hybrid mode and the nested hybrid mode, can be proposed. If the splicing hybrid mode is adopted, the responder sends the front-to-back quantum dual certificate and the post-quantum dual certificate to the initiator; if the nested hybrid mode is adopted, the responder sends the front-to-back quantum hybrid dual certificate to the initiator. Among them, the front-to-back quantum dual certificate includes an SM2 encryption certificate and an SM2 digital signature certificate; the post-quantum dual certificate includes a post-quantum digital signature certificate and a post-quantum key encapsulation certificate; the front-to-back quantum hybrid dual certificate includes a digital signature certificate and an encryption key encapsulation certificate obtained by mixing the front-to-back quantum dual certificate and the post-quantum dual certificate. It can be seen that the present application proposes a post-quantum dual certificate system in a pure post-quantum cryptographic mode and a hybrid dual certificate system in a front-to-back quantum hybrid mode. By adopting different modes of mixing front-to-back quantum cryptography, the quantum security of the key exchange protocol is enhanced to meet the migration properties of the protocol such as quantum security, forward compatibility, and backward compatibility; the pure post-quantum cryptographic mode is adopted to enhance the quantum security of the secure message protocol.

[0062] Step S13: The communicating parties authenticate their identities and generate their own target key parameters based on their local dual certificates and the exchanged data sent to each other. After successful authentication, the target key parameters corresponding to the communicating parties are verified.

[0063] In this embodiment, after sending the dual certificates according to the current hybrid mode, the identity authentication of the communicating parties will be further performed. Here, the communicating parties perform decryption and signature verification calculations on the exchanged data sent to each other based on their own local dual certificates to obtain corresponding calculation results. Specifically, in the splicing hybrid mode, the initiator sends the exchanged data to the responder, and the exchanged data is calculated as follows: XCHi =Asymmetric_Encrypt(Ski,pub_r)|Symmetric_Encrypt(Ni,Ski)|Symmetric_Encrypt(IDi,Ski)|CERT_sig_i|CERT_enc_i|PQC_KEM_enc(pqcpub_r)|PQCCERT_sig_i|PQCCERT_kem_i (Pre-quantum digital envelope | Pre-quantum dual certificate | Post-quantum key encapsulation | Post-quantum certificate (signature + key encapsulation)); SIGi_b = Asymmetric_Sign(Ski_b | Ni_b | IDi_b | CERT_enc_i_b | Ki_b | PQCCERT_kem_i_b, priv_i) (Pre-quantum signature (post-quantum certificate added to the signature content)); PQCSIGi_b = Asymmetric_Sign(Ski_b | Ni_b | IDi_b | CERT_enc_i_b | Ki_b | PQCCERT_kem_i_b, pqcpriv_i) (Post-quantum signature). The responder sends exchange data to the initiator, and the exchange data is calculated as follows: XCHr = Asymmetric_Encrypt(Skr,pub_i) | Symmetric_Encrypt(Nr,Skr) | Sym_Encrypt(IDr,Skr) | PQC_KEM_enc(pub_i) (pre-quantum digital envelope | post-quantum key encapsulation); SIGr_b = Asymmetric_Sign(Skr_b|Nr_b|IDr_b|CERT_enc_r_b|Kr_b|PQCCERT_kem_i_b,priv_r) (pre-quantum signature); PQCSIGr_b = Asymmetric_Sign(Skr_b | Nr_b | IDr_b | CERT_enc_r_b | Kr_b|PQCCERT_kem_i_b, pqcpriv_r) (post-quantum signature) to obtain the corresponding calculation results.

[0064] In the nested hybrid mode, the initiator sends exchange data to the responder, and the exchange data is calculated as follows: XCHi=Asymmetric_Encrypt(Ski,pub_r)|Symmetric_Encrypt(PQC_KEM_encaps(pqcpub_r)|Ni,Ski)|Symmetric_Encrypt(IDi,Ski)|CERT_sig_i|CERT_enc_kem_i (pre-quantum digital envelope| post-quantum key encapsulation and symmetric encryption| pre- and post-quantum signature certificates| pre- and post-quantum encryption-key encapsulation certificates); PQCSIGi_b=Asymmetric_Sign(Ski_b|Ki_b|Ni_b|IDi_b|CERT_enc_kem_i_b, pqcpriv_i) (post-quantum signature); SIGi_b = Asymmetric_Sign(PQCCERT_sig_i_b, priv_i) (pre-quantum signature, (pre-quantum signature and then pre-quantum signature)). The responder sends exchange data to the initiator, and the exchange data is calculated as follows: XCHr=Asymmetric_Encrypt(Skr,pub_i)|Symmetric_Encrypt(PQC_KEM_enc(Kr,pqcpub_i)|Nr,Skr)|Sym_Encrypt(IDr,Skr) (pre-quantum digital envelope | post-quantum key encapsulation and symmetric encryption); PQCSIGr_b=Asymmetric_Sign(Skr_b|Kr_b|Nr_b|IDr_b|CERT_enc_kem_r_b, pqcpriv_r) (post-quantum signature); SIGr_b = Asymmetric_Sign(PQCSIGr_b, priv_r) (pre-quantum signature, (first quantum signature and then pre-quantum signature)), in order to obtain the corresponding calculation results.

[0065] After obtaining the calculation results respectively, the calculation results obtained by the communicating parties are compared with their own local preset data to authenticate their identities. If the calculation results corresponding to the communicating parties are the same as their own local preset data, the identity authentication of the communicating parties is completed, that is, the identities of the communicating parties have passed the authentication of the other party. Then, the communicating parties each generate corresponding target key parameters based on their own local dual certificates, exchanged data, and pre-quantum cryptographic algorithms and / or post-quantum cryptographic algorithms; the specific generation method is as follows: SKEYID = PRF (HASH (Ni_b | Nr_b | Ki_b | Kr_b), CKY-I, CKY-R); PRF and HASH refer to the use of pre- / post-quantum cryptographic algorithms as needed; Ki_b is the encapsulation key of the responder; Kr_b is the encapsulation key of the initiator; other working keys are calculated as follows: SKEYID_d = PRF (SKEYID, CKY-I | CKY-R | 0) This is used for session key generation; SKEYID_a = PRF (SKEYID, SKEYID_d | CKY-I | CKY-R | 1) is used for the generation of integrity protection keys; SKEYID_e = PRF (SKEYID, SKEYID_a | CKY-I | CKY-R | 2) is used for the generation of confidentiality protection keys. In addition, if the identity authentication of the two communicating parties fails, the communication ends directly.

[0066] At the same time, after the identity authentication of the two communicating parties is successful, the target key parameters corresponding to the two communicating parties are verified. The initiator uses the post-quantum hash cryptographic algorithm to perform hash load calculation on the target key parameters corresponding to the initiator to obtain the first hash value, and encrypts the first hash value based on the post-quantum symmetric cryptographic algorithm and sends it to the responder; the responder uses the post-quantum hash cryptographic algorithm to perform hash load calculation on the target key parameters corresponding to the responder to obtain the second hash value, and encrypts the second hash value based on the post-quantum symmetric cryptographic algorithm and sends it to the initiator; after the two communicating parties receive the hash value sent by each other, the first hash value is compared with the second hash value; if the first hash value of the two communicating parties is equal to the second hash value, the target key parameter verification is successful. If the first hash value of the two communicating parties is not equal to the second hash value, an error message is sent and the process ends directly. During the calculation of the above process, the message is encrypted by the post-quantum symmetric cryptographic algorithm, and the key uses the target key parameter, and then the hash load calculation is performed.

[0067] Step S14: If the target key parameter verification is successful, key exchange is performed based on the target key parameters, post-quantum symmetric cryptographic algorithm and post-quantum hash cryptographic algorithm to determine the session key, and communication data transmission is performed between the communicating parties according to the secure message protocol and the session key.

[0068] In this embodiment, if the target key parameter verification is successful, the communicating parties perform key exchange based on the target key parameters, the post-quantum symmetric cryptographic algorithm, and the post-quantum hash cryptographic algorithm to determine the session key, and then perform communication data transmission between the communicating parties according to the secure message protocol and the session key. However, before the communication data between the communicating parties is transmitted according to the secure message protocol and the session key, the negotiation of parameters and security policies is completed through data exchange between the communicating parties, so that the communication data between the communicating parties is transmitted based on the parameters and the security policy; the security policy includes any one or a combination of encryption algorithms, encapsulation protocols, encapsulation modes, and key expiration periods. That is, the negotiation of parameters and security policies is completed. Then the communicating parties execute the secure message protocol (including AH and ESP protocols) to realize the secure transmission of communication data between the initiator and the responder (symmetric encryption of the data and HMAC calculation based on SM3, the cryptographic operation here will use the key generated by the previous key exchange protocol). Specifically, the target key parameters are derived to determine the encryption key and the integrity key; the authentication header protocol is determined by the encryption key, and the encapsulated security payload protocol is determined based on the integrity key; the pre-negotiated security message protocol is determined; if the security message protocol is the authentication header protocol, the communication data transmission between the communicating parties is based on the post-quantum symmetric cryptographic algorithm and the session key; if the security message protocol is the encapsulated security payload protocol, the communication data transmission between the communicating parties is based on the post-quantum hash cryptographic algorithm and the session key; if the security message protocol is the authentication header protocol and the encapsulated security payload protocol, the communication data transmission between the communicating parties is based on the post-quantum symmetric cryptographic algorithm, the post-quantum hash cryptographic algorithm and the session key.

[0069] It should be made clear that the quantum-safe secure message protocol includes the authentication header AH and the encapsulated security payload ESP protocol, which mainly revolves around the confidentiality and integrity functions of communication messages. The quantum security enhancement design of the secure message protocol adopts a pure post-quantum cryptographic mode, that is, if confidentiality protection is required, the post-quantum symmetric cryptographic algorithm is used to replace the commercial secret SM4 algorithm, and the data encapsulation format is expanded according to the key length or packet length of the post-quantum symmetric cryptographic algorithm; if integrity protection is performed, the post-quantum hash cryptographic algorithm is used to replace the commercial secret SM3 algorithm, and the data encapsulation format is expanded according to the hash value length of the post-quantum hash cryptographic algorithm. In this way, this application for the front- and back-quantum splicing hybrid mode of the key exchange protocol not only supports the cryptographic agility of multi-key exchange, but also supports the forward and backward compatibility of the protocol. During the transition stage of post-quantum cryptographic migration, it can effectively support the migration verification of the national secret IPSec protocol in different scenarios.

[0070] In summary, when the present application performs communication data transmission, the initiator first sends a first security association payload determined based on a pre-quantum cryptographic algorithm, a post-quantum cryptographic algorithm, and a payload for recommending a hybrid mode of a key exchange protocol to the responder, so that the responder sends a second security association payload for determining a target hybrid mode to the initiator based on the first security association payload; the pre-quantum cryptographic algorithm is the SM2 algorithm; then the target hybrid mode is determined, and if the target hybrid mode is a preset spliced ​​hybrid mode, the pre-quantum dual certificate and the post-quantum dual certificate are sent to the initiator by the responder, and if the target hybrid mode is a preset nested hybrid mode, the pre-quantum dual certificate and the post-quantum dual certificate are sent to the initiator by the responder, and if the target hybrid mode is a preset nested hybrid mode, the pre-quantum dual certificate and the post-quantum dual certificate are sent to the initiator by the responder. The double certificate is sent to the initiator; the front-to-back quantum hybrid double certificate is a double certificate obtained by mixing the front-to-back quantum double certificate with the post-to-back quantum double certificate; after the determination, the communication parties are authenticated based on their own local double certificates and the exchanged data sent to each other, and the target key parameters of the communication parties are generated, and after the authentication is successful, the target key parameters corresponding to the communication parties are verified; finally, if the target key parameter verification is successful, the key exchange is performed based on the target key parameter, the post-quantum symmetric cryptographic algorithm and the post-quantum hash cryptographic algorithm to determine the session key, and the communication data transmission between the communication parties is performed according to the secure message protocol and the session key. It can be seen that this application constructs a quantum-safe national secret IPSec protocol through a post-quantum cryptographic algorithm, and proposes a post-quantum double certificate system in a pure post-quantum cryptographic mode and a hybrid double certificate system in a front-to-back quantum hybrid mode. By adopting different modes of mixing front-to-back quantum cryptography, the quantum security of the key exchange protocol is enhanced, and the migration properties of the protocol such as quantum security, forward compatibility, and backward compatibility are met; the pure post-quantum cryptographic mode is adopted to enhance the quantum security of the secure message protocol. The introduction of post-quantum cryptographic algorithms makes the protocol quantum-safe. The hybrid mode of forward and backward quantum splicing of the key exchange protocol not only supports the cryptographic agility of multi-key exchange, but also supports the forward and backward compatibility of the protocol. During the transition period of post-quantum cryptographic migration, it can effectively support the migration verification of the national secret IPSec protocol in different scenarios.

[0071] Based on the previous embodiment, the present application proposes a post-quantum dual certificate system in a pure post-quantum cryptographic mode and a hybrid dual certificate system in a front-to-back quantum hybrid mode. A hybrid mode construction method for a quantum-safe key exchange protocol includes a splicing hybrid mode and a nested hybrid mode construction method. By introducing the negotiation of quantum-safe splicing hybrid mode and nested hybrid mode in the first phase of the key exchange protocol, the mode of adding a post-quantum cryptographic algorithm is adaptively selected without changing the protocol interaction framework. Next, the construction of the post-quantum dual certificate system and the construction of the front-to-back quantum hybrid dual certificate system will be described in detail.

[0072] To enhance the quantum security of the national PKI (Public Key Infrastructure) CA system, there are two methods to construct a "dual certificate" system based on post-quantum cryptographic algorithms: Figure 3 and Figure 4 As shown. Figure 3 In a pure post-quantum dual-certificate system, a post-quantum digital signature root CA (Certificate Authority) issues post-quantum digital signature certificates and key encapsulation certificates to the next level of users. The issuance process and use of post-quantum digital signature certificates are consistent with the current standards GM / T 0043 (Digital Certificate Format Specification Based on SM2 Cryptographic Algorithm) and GM / T 0037 National Secret Digital Certificate, except that the algorithm replaces the current digital signature SM2 algorithm with the post-quantum digital signature algorithm. The post-quantum key encapsulation certificate is equivalent to the encryption certificate currently in use and is only used for online key exchange between the communicating parties. The cryptographic algorithm used is the post-quantum key encapsulation algorithm, and the key encapsulation certificate is issued by the signature private key corresponding to the post-quantum digital signature root certificate. The overall format of the key encapsulation certificate follows the format of the GM / T 0015 standard, as shown below. Figure 5 shown.

[0073] For Figure 4 The dual certificate system of pre-quantum hybrid and post-quantum hybrid shown in the figure is issued by the pre-quantum digital signature root CA to the next-level users. The issuance process and use are consistent with the national secret digital certificates of the current standards GM / T 0043 and GM / T 0037. The packaging of the digital certificate format follows the GM / T 0015 standard as a whole, and adopts the "first before last" method to encapsulate the corresponding attributes of the post-quantum cryptographic algorithm into the extension items of the corresponding certificate. The specific formats of the pre-quantum hybrid signature certificate and encryption-key encapsulation certificate are as follows: Figure 6 and Figure 7 shown.

[0074] In this way, by using the equivalence of the key encapsulation algorithm and the public key encryption and decryption algorithm in the protocol interaction, while maintaining the consistency of the certificate issuance process and certificate format, an independent post-quantum key encapsulation certificate is added to replace the function of the pre-quantum encryption certificate. Under the premise of changing the protocol interaction framework, the post-quantum cryptographic algorithm is introduced to make the protocol quantum secure; the design idea of ​​the national secret dual certificate system is retained, and the key encapsulation certificate technology is proposed based on the post-quantum key encapsulation algorithm, which functionally makes up for the single function of the existing post-quantum cryptographic algorithm and the lack of a public key encryption and decryption algorithm.

[0075] See also Figure 8As shown, an embodiment of the present invention discloses a communication data transmission device, including:

[0076] A security association payload sending module 11 is used to send a first security association payload determined based on a pre-quantum cryptographic algorithm, a post-quantum cryptographic algorithm, and a payload for suggesting a hybrid mode of a key exchange protocol to a responder through an initiator, so that the responder sends a second security association payload for determining a target hybrid mode to the initiator based on the first security association payload; the pre-quantum cryptographic algorithm is an SM2 algorithm;

[0077] The certificate sending module 12 is used for sending the pre-quantum dual certificate and the post-quantum dual certificate to the initiator through the responder if the target hybrid mode is a preset splicing hybrid mode, and for sending the pre-quantum and post-quantum hybrid dual certificates to the initiator through the responder if the target hybrid mode is a preset nested hybrid mode; the pre-quantum and post-quantum hybrid dual certificates are dual certificates obtained by mixing the pre-quantum dual certificates with the post-quantum dual certificates;

[0078] The identity authentication module 13 is used to authenticate the identities of both parties and generate their own target key parameters based on their local dual certificates and exchange data sent to each other;

[0079] The key parameter verification module 14 is used to verify the target key parameters corresponding to the two communicating parties respectively after the authentication is successful;

[0080] The communication data transmission module 15 is used to perform key exchange based on the target key parameters, post-quantum symmetric cryptographic algorithm and post-quantum hash cryptographic algorithm to determine the session key if the target key parameter verification is successful, and perform communication data transmission between the communicating parties according to the secure message protocol and the session key.

[0081] When the present application performs communication data transmission, the initiator first sends a first security association payload determined based on a pre-quantum cryptographic algorithm, a post-quantum cryptographic algorithm, and a payload for suggesting a hybrid mode of a key exchange protocol to the responder, so that the responder sends a second security association payload for determining a target hybrid mode to the initiator based on the first security association payload; the pre-quantum cryptographic algorithm is the SM2 algorithm; then the target hybrid mode is determined, and if the target hybrid mode is a preset spliced ​​hybrid mode, the pre-quantum dual certificate and the post-quantum dual certificate are sent to the initiator by the responder, and if the target hybrid mode is a preset nested hybrid mode, the pre-quantum dual certificate and the post-quantum dual certificate are sent to the initiator by the responder. The book is sent to the initiator; the front-to-back quantum hybrid double certificate is a double certificate obtained by mixing the front-to-back quantum double certificate with the post-to-back quantum double certificate; after determination, the communication parties are authenticated based on their own local double certificates and the exchanged data sent to each other, and the target key parameters of the communication parties are generated, and after the authentication is successful, the target key parameters corresponding to the communication parties are verified; finally, if the target key parameter verification is successful, the key exchange is performed based on the target key parameter, the post-quantum symmetric cryptographic algorithm and the post-quantum hash cryptographic algorithm to determine the session key, and the communication data between the communication parties is transmitted according to the secure message protocol and the session key. It can be seen that this application constructs a quantum-safe national secret IPSec protocol through a post-quantum cryptographic algorithm, and proposes a post-quantum double certificate system in a pure post-quantum cryptographic mode and a hybrid double certificate system in a front-to-back quantum hybrid mode. By adopting different modes of mixing front-to-back quantum cryptography, the quantum security of the key exchange protocol is enhanced, and the migration properties of the protocol such as quantum security, forward compatibility, and backward compatibility are met; the pure post-quantum cryptographic mode is adopted to enhance the quantum security of the secure message protocol. The introduction of post-quantum cryptographic algorithms makes the protocol quantum-safe. The hybrid mode of forward and backward quantum splicing of the key exchange protocol not only supports the cryptographic agility of multi-key exchange, but also supports the forward and backward compatibility of the protocol. During the transition period of post-quantum cryptographic migration, it can effectively support the migration verification of the national secret IPSec protocol in different scenarios.

[0082] In some specific embodiments, the pre-quantum dual certificate includes an SM2 encryption certificate and an SM2 digital signature certificate; the post-quantum dual certificate includes a post-quantum digital signature certificate and a post-quantum key encapsulation certificate; the pre-quantum and post-quantum hybrid dual certificate includes a digital signature certificate and an encryption key encapsulation certificate obtained by mixing the pre-quantum dual certificate and the post-quantum dual certificate.

[0083] In some specific embodiments, the identity authentication module 13 can be specifically used to perform decryption and signature verification calculations on the exchanged data sent to each other by the communicating parties based on their own local dual certificates to obtain corresponding calculation results; compare the calculation results obtained by each of the communicating parties with their own local preset data; if the calculation results corresponding to each of the communicating parties are the same as their own local preset data, the identity authentication of the communicating parties is completed, and the communicating parties each generate corresponding target key parameters based on their own local dual certificates, the exchanged data, and the pre-quantum cryptographic algorithm and / or the post-quantum cryptographic algorithm; otherwise, end directly.

[0084] In some specific embodiments, the key parameter verification module 14 can be specifically used to perform hash load calculation on the target key parameters corresponding to the initiator by the initiator using the post-quantum hash cryptographic algorithm to obtain a first hash value, and encrypt the first hash value based on the post-quantum symmetric cryptographic algorithm and send it to the responder; perform hash load calculation on the target key parameters corresponding to the responder by the responder using the post-quantum hash cryptographic algorithm to obtain a second hash value, and encrypt the second hash value based on the post-quantum symmetric cryptographic algorithm and send it to the initiator; after the communicating parties each receive the hash value sent by the other party, the first hash value is compared with the second hash value; if the first hash values ​​of the communicating parties are equal to the second hash value, the target key parameter verification is successful.

[0085] In some specific embodiments, the device may also be used to send an error message and directly end the communication if the first hash value and the second hash value of the communicating parties are not equal.

[0086] In some specific embodiments, the device can also be used to complete the negotiation of parameters and security policies through data exchange between the communicating parties, so as to transmit communication data between the communicating parties based on the parameters and security policies; the security policy includes any one or a combination of encryption algorithms, encapsulation protocols, encapsulation modes and key expiration dates.

[0087] In some specific embodiments, the communication data transmission module 15 can be specifically used to derive the target key parameters to determine the encryption key and the integrity key; determine the authentication header protocol through the encryption key, and determine the encapsulated security payload protocol based on the integrity key; determine the pre-negotiated security message protocol; if the security message protocol is the authentication header protocol, the communication data transmission between the communicating parties is based on the post-quantum symmetric cryptographic algorithm and the session key; if the security message protocol is the encapsulated security payload protocol, the communication data transmission between the communicating parties is based on the post-quantum hash cryptographic algorithm and the session key; if the security message protocol is the authentication header protocol and the encapsulated security payload protocol, the communication data transmission between the communicating parties is based on the post-quantum symmetric cryptographic algorithm, the post-quantum hash cryptographic algorithm and the session key.

[0088] Furthermore, the present application also discloses an electronic device. Fig. 9 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0089] Fig. 9 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the communication data transmission method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0090] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0091] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0092] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs that can be used to complete the communication data transmission method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs that can be used to complete other specific tasks.

[0093] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed communication data transmission method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0094] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0095] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0096] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0097] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0098] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A communication data transmission method, characterized in that: include: The initiator sends a first security association payload determined based on a pre-quantum cryptographic algorithm, a post-quantum cryptographic algorithm, and a payload for suggesting a hybrid mode of a key exchange protocol to the responder, so that the responder sends a second security association payload for determining a target hybrid mode to the initiator based on the first security association payload; The pre-quantum cryptographic algorithm is the SM2 algorithm; If the target hybrid mode is a preset splicing hybrid mode, the responder sends the pre-quantum dual certificate and the post-quantum dual certificate to the initiator; if the target hybrid mode is a preset nested hybrid mode, the responder sends the pre-quantum dual certificate to the initiator; the pre-quantum dual certificate is a dual certificate obtained by mixing the pre-quantum dual certificate with the post-quantum dual certificate; wherein, if the target hybrid mode is a preset splicing hybrid mode, the initiator sequentially splices the pre-quantum digital envelope, the pre-quantum dual certificate, the post-quantum key encapsulation and the post-quantum certificate based on a preset order to obtain exchange data; if the target hybrid mode is a preset nested hybrid mode, the initiator calculates the pre-quantum signature certificate according to the post-quantum signature certificate to determine the pre-quantum signature certificate, and determines the pre-quantum digital envelope based on the post-quantum key encapsulation, and determines the exchange data according to the pre-quantum signature certificate and the pre-quantum digital envelope; The communication parties authenticate their identities and generate their own target key parameters based on their local dual certificates and exchange data sent to each other, and after successful authentication, verify the target key parameters corresponding to the communication parties respectively; If the target key parameter verification is successful, key exchange is performed based on the target key parameters, post-quantum symmetric cryptographic algorithm and post-quantum hash cryptographic algorithm to determine the session key, and communication data transmission is performed between the communicating parties according to the secure message protocol and the session key.

2. The communication data transmission method according to claim 1, characterized in that: The pre-quantum dual certificate includes an SM2 encryption certificate and an SM2 digital signature certificate; the post-quantum dual certificate includes a post-quantum digital signature certificate and a post-quantum key encapsulation certificate; the pre-quantum and post-quantum hybrid dual certificate includes a digital signature certificate and an encryption key encapsulation certificate obtained by mixing the pre-quantum dual certificate and the post-quantum dual certificate.

3. The communication data transmission method according to claim 1, characterized in that: The identity authentication of both parties and the generation of their own target key parameters are performed by both parties based on their own local dual certificates and exchange data sent to each other, including: The communicating parties respectively perform decryption and signature verification calculations on the exchanged data sent to each other based on their own local dual certificates to obtain corresponding calculation results; Comparing the calculation results obtained by each of the communicating parties with their own local preset data respectively; If the calculation results corresponding to the two communicating parties are the same as their own local preset data, the identity authentication of the two communicating parties is completed, and the two communicating parties generate corresponding target key parameters based on their own local dual certificates, the exchanged data, and the pre-quantum cryptographic algorithm and / or the post-quantum cryptographic algorithm; Otherwise, just end it.

4. The communication data transmission method according to claim 1, characterized in that: The verifying of the target key parameters respectively corresponding to the two communicating parties includes: The initiator uses the post-quantum hash cryptographic algorithm to perform hash load calculation on the target key parameter corresponding to the initiator to obtain a first hash value, and encrypts the first hash value based on the post-quantum symmetric cryptographic algorithm and sends it to the responder; The responder performs hash load calculation on the target key parameter corresponding to the responder by using the post-quantum hash cryptographic algorithm to obtain a second hash value, and encrypts the second hash value based on the post-quantum symmetric cryptographic algorithm and sends it to the initiator; After the communicating parties each receive the hash value sent by the other party, comparing the first hash value with the second hash value; If the first hash values ​​of the communicating parties are equal to the second hash values, the target key parameter verification is successful.

5. The communication data transmission method according to claim 4, characterized in that: After verifying the target key parameters corresponding to the two communicating parties respectively, the method further includes: If the first hash value and the second hash value of the communicating parties are not equal, an error message is sent and the communication ends directly.

6. The communication data transmission method according to claim 1, characterized in that: Before transmitting the communication data between the two communicating parties according to the secure message protocol and the session key, the method further includes: The negotiation of parameters and security policies is completed through data exchange between the communicating parties, so that communication data transmission between the communicating parties is carried out based on the parameters and security policies; the security policies include any one or a combination of encryption algorithms, encapsulation protocols, encapsulation modes and key expiration dates.

7. The communication data transmission method according to any one of claims 1 to 6, characterized in that: The communication data transmission between the two communicating parties according to the secure message protocol and the session key includes: deriving the target key parameters to determine an encryption key and an integrity key; Determining an authentication header protocol using the encryption key and determining an encapsulating security payload protocol based on the integrity key; Determining the pre-negotiated secure message protocol; If the secure message protocol is the authentication header protocol, communication data transmission between the communicating parties is performed based on a post-quantum symmetric cryptographic algorithm and the session key; If the secure message protocol is the Encapsulating Security Payload protocol, communication data transmission between the communicating parties is performed based on a post-quantum hash cryptographic algorithm and the session key; If the security message protocol is the authentication header protocol and the encapsulating security payload protocol, communication data transmission between the communicating parties is performed based on the post-quantum symmetric cryptographic algorithm, the post-quantum hash cryptographic algorithm and the session key.

8. A communication data transmission device, characterized in that: include: A security association payload sending module, configured to send, through an initiator, a first security association payload determined based on a pre-quantum cryptographic algorithm, a post-quantum cryptographic algorithm, and a payload for suggesting a hybrid mode of a key exchange protocol to a responder, so that the responder sends a second security association payload for determining a target hybrid mode to the initiator based on the first security association payload; The pre-quantum cryptographic algorithm is the SM2 algorithm; A certificate sending module, for sending the pre-quantum dual certificate and the post-quantum dual certificate to the initiator through the responder if the target hybrid mode is a preset splicing hybrid mode, and for sending the pre-quantum dual certificate and the post-quantum dual certificate to the initiator through the responder if the target hybrid mode is a preset nested hybrid mode; the pre-quantum dual certificate and the post-quantum dual certificate are dual certificates obtained by mixing the pre-quantum dual certificate and the post-quantum dual certificate; wherein, if the target hybrid mode is a preset splicing hybrid mode, the initiator sequentially splices the pre-quantum digital envelope, the pre-quantum dual certificate, the post-quantum key encapsulation and the post-quantum certificate based on a preset order to obtain exchange data; if the target hybrid mode is a preset nested hybrid mode, the initiator calculates the pre-quantum signature certificate according to the post-quantum signature certificate to determine the pre-quantum signature certificate, and determines the pre-quantum digital envelope based on the post-quantum key encapsulation, and determines the exchange data according to the pre-quantum signature certificate and the pre-quantum digital envelope; An identity authentication module, used to authenticate the identities of both parties and generate their own target key parameters based on their local dual certificates and exchanged data sent to each other; A key parameter verification module, used to verify the target key parameters corresponding to the two communicating parties respectively after successful authentication; A communication data transmission module is used to perform key exchange based on the target key parameters, post-quantum symmetric cryptographic algorithm and post-quantum hash cryptographic algorithm to determine the session key if the target key parameter verification is successful, and to perform communication data transmission between the communicating parties according to the secure message protocol and the session key.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the communication data transmission method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, which, when executed by a processor, implements the communication data transmission method according to any one of claims 1 to 7.

Images