Quantum security timestamp issuing networking system and working method thereof

Abstract

The invention discloses a quantum security timestamp issuing networking system and a working method thereof, the system comprises a national time service center, a first-level timestamp server, a first-level verification server group and a first-level user group, the national time service center is connected with the first-level timestamp server, and the first-level user group is connected with the first-level verification server group; the first-level timestamp server, the first-level verification server group and the first-level user group are connected in pairs. According to the system, only when the quantum digital signature process of three parties is executed, the verification server participating in the quantum digital signature process is determined, and each selection is unpredictable before the quantum digital signature starts, so that the possibility that a bad third party counterfeits the verification server to participate in the quantum digital signature is avoided; and meanwhile, each time of timestamp issuing or time value issuing process depends on quantum digital signatures of three parties, so that tampering prevention, non-repudiation and unconditional security in the timestamp issuing and time value transmitting process are ensured.

Description

Technical Field

[0001] The present invention relates to the field of timestamps, and in particular to a quantum secure timestamp issuance networking system and a working method thereof. Background Art

[0002] Many applications, such as networked applications, rely on timestamping information (e.g., packet timestamping information provided by a network interface) to indicate the time of an event. A timestamp is a trusted time mark provided by a trusted third-party timestamp issuance system, which is mainly used to prove that an electronic document existed before a certain moment. The system uses a trusted time source to collect time, and uses the corresponding timestamp protocol and timestamp mechanism to issue timestamps. The existence of timestamps can effectively prevent the forgery and tampering of the content of electronic documents.

[0003] The patent with application number 202111606979.3 proposes "A method and system for issuing unconditionally trusted timestamps". The timestamp server in the system for issuing unconditionally trusted timestamps proposed in the article is directly connected to the National Time Service Center to obtain the time value from the National Time Service Center as the basis for generating timestamps. According to the system proposed in the patent, the National Time Service Center, as the only time value issuing agency, bears a huge load pressure, and it is very easy for the output line to be blocked and the response to be untimely.

[0004] In view of this, with the current large number of users, there is an urgent need for a network that issues timestamps to alleviate the pressure on the National Time Service Center to issue time values ​​​​in a single manner. In this network, the transmission of time values ​​​​should be quantum secure to cope with the threat of cracking traditional encryption algorithms posed by the current increase in computing power. Summary of the invention

[0005] Purpose of the invention: The purpose of the present invention is to provide a quantum secure timestamp issuance networking system and its working method, which solves the problem that the national time service center in the existing timestamp issuance networking has a great load pressure on issuing time values, is very prone to output line blockage, and responds untimely; it also solves the problem that the transmission security of time values ​​is threatened.

[0006] Technical solution: The present invention provides a quantum-safe timestamp issuance networking system, which includes: a national time service center, a primary timestamp server, a primary verification server group, and a primary user group, wherein the national time service center is connected to the primary timestamp server, and the primary timestamp server, the primary verification server group, and the primary user group are connected in pairs;

[0007] The National Time Service Center is used to transmit time values ​​to the primary timestamp server;

[0008] The first-level timestamp server is used to receive the time value issued by the National Time Service Center; and to generate a timestamp file for the file doc that applies for a timestamp in the first-level user group within the jurisdiction of the first-level timestamp server, and to perform a three-party quantum digital signature on the timestamp file with the first-level user who applies for the timestamp and the first-level verification server, and to issue the timestamp that has passed the quantum digital signature verification to the first-level user who applies for the timestamp; it is also used to provide time values ​​for the next-level timestamp server;

[0009] The first-level user group is a collection of first-level users within the jurisdiction of the first-level timestamp server. Each first-level user requests a timestamp from the first-level timestamp server according to its own needs, and performs a three-party quantum digital signature on the timestamp file with the first-level timestamp server and the first-level verification server, and finally accepts the timestamp;

[0010] The first-level verification server group is a collection of verification servers under the jurisdiction of the first-level timestamp server. The verification server is used to authenticate the file doc with the first-level user who applies for the timestamp, and to perform a three-party quantum digital signature on the timestamp file between the first-level timestamp server and the first-level user who applies for the timestamp.

[0011] Further, the primary timestamp server is also connected to the secondary timestamp server, the secondary timestamp server is respectively connected to the secondary user group and the secondary verification server group, and the secondary verification server group is respectively connected to the primary timestamp server and the secondary user group; the secondary timestamp server is also connected to the tertiary timestamp server, the tertiary timestamp server is respectively connected to the tertiary user group and the tertiary verification server group, and the tertiary verification server group is respectively connected to the secondary timestamp server and the tertiary user group; and so on, the N-1 level timestamp server is also connected to the N-level timestamp server, the N-level timestamp server is respectively connected to the N-level user group and the N-level verification server group, and the N-level verification server group is respectively connected to the N-1 level timestamp server and the N-level user group;

[0012] The N-level timestamp server is used to receive the time value issued by the N-1-level timestamp server; and to generate a timestamp file for the file doc that applies for a timestamp in the N-level user group within the jurisdiction of the current-level timestamp server, and to perform a three-party quantum digital signature on the timestamp file with the N-level user who applies for the timestamp and the N-level verification server, and to issue the timestamp that has passed the quantum digital signature verification to the N-level user who applies for the timestamp; and to provide a time value for the next-level timestamp server;

[0013] The N-level user group is a collection of N-level users within the jurisdiction of the N-level timestamp server. Each N-level user requests a timestamp from the N-level timestamp server according to its own needs, and performs a three-party quantum digital signature on the timestamp file with the N-level timestamp server and the N-level verification server, and finally accepts the timestamp;

[0014] The N-level verification server group is a collection of verification servers under the jurisdiction of the N-level timestamp server. The verification server is used to authenticate the file doc with the N-level user who applies for the timestamp, and to perform a three-party quantum digital signature on the timestamp file between the N-level timestamp server and the N-level user who applies for the timestamp; and to perform a three-party quantum digital signature on the time value issued by the N-1-level timestamp server between the N-level timestamp server and the N-level timestamp server.

[0015] The present invention also includes a quantum-safe timestamp issuance networking system, which includes: a national time service center, a first-level timestamp server, first to M-th first-level verification servers and first to M-th groups of first-level users, wherein the national time service center is connected to the first-level timestamp server, and the first-level timestamp server, the first-level verification server and the first group of first-level users are connected in pairs; the first-level timestamp server, the second-level verification server and the second group of first-level users are connected in pairs; and so on, the first-level timestamp server, the M-th first-level verification server and the M-th group of first-level users are connected in pairs;

[0016] The National Time Service Center is used to transmit time values ​​to the primary timestamp server;

[0017] The first-level timestamp server is used to receive the time value issued by the National Time Service Center; and to generate a timestamp file for the file doc that applies for a timestamp in the first-level user within the jurisdiction of the first-level timestamp server, and to perform a three-party quantum digital signature on the timestamp file between the first-level user who applies for the timestamp and the first-level verification server connected to the first-level user who applies for the timestamp, and to issue the timestamp that has passed the quantum digital signature verification to the first-level user who applies for the timestamp; it is also used to provide time values ​​for the next-level timestamp server;

[0018] The first to Mth groups of first-level users are a collection of first-level users within the jurisdiction of the first-level timestamp server. Each first-level user requests a timestamp from the first-level timestamp server according to its own needs, and performs a three-party quantum digital signature on the timestamp file between the first-level timestamp server and the first-level verification server connected to the first-level user who applied for the timestamp, and finally accepts the timestamp;

[0019] The first to Mth first-level verification servers are a collection of verification servers under the jurisdiction of the first-level timestamp server. The verification server connected to the first-level user who applies for a timestamp is used to authenticate the file doc with the first-level user who applies for a timestamp, and perform a three-party quantum digital signature on the timestamp file between the first-level timestamp server and the first-level user who applies for a timestamp.

[0020] Furthermore, the first-level timestamp server is also connected to the second-level timestamp server, and the second-level timestamp server is respectively connected to the first and second-level verification servers and the first group of second-level users, and the first and second-level verification servers are respectively connected to the first-level timestamp server and the first group of second-level users; the second-level timestamp server is also respectively connected to the second and second-level verification servers and the second group of second-level users, and the second and second-level verification servers are respectively connected to the first-level timestamp server and the second group of second-level users; similarly, the second-level timestamp server is also respectively connected to the Lth and Lth groups of second-level users, and the Lth and Lth second-level verification servers are respectively connected to the first-level timestamp server and the Lth group of second-level users; and so on. , the A-1 level timestamp server is also connected to the A level timestamp server, the A level timestamp server is respectively connected to the first A level verification server and the first group of A level users, the first A level verification server is respectively connected to the A-1 level timestamp server and the first group of A level users; the A level timestamp server is also respectively connected to the second A level verification server and the second group of A level users, the second A level verification server is respectively connected to the A-1 level timestamp server and the second group of A level users; similarly, the A level timestamp server is also respectively connected to the SA level verification server and the S group of A level users, the SA level verification server is respectively connected to the A-1 level timestamp server and the S group of A level users;

[0021] The A-level timestamp server is used to receive the time value issued by the A-1-level timestamp server; and to generate a timestamp file for the file doc that the A-level user who applies for the timestamp is under the jurisdiction of the current-level timestamp server, and to perform a three-party quantum digital signature on the timestamp file between the A-level user who applies for the timestamp and the A-level verification server connected to the A-level user who applies for the timestamp, and to issue the timestamp that has passed the quantum digital signature verification to the A-level user who applies for the timestamp; and also to provide a time value for the next-level timestamp server;

[0022] The first to Sth groups of Class A users are a collection of Class A users within the jurisdiction of the Class A timestamp server. Each Class A user requests a timestamp from the Class A timestamp server according to its own needs, and performs a three-party quantum digital signature on the timestamp file between the Class A timestamp server and the Class A verification server connected to the Class A user who applied for the timestamp, and finally accepts the timestamp;

[0023] The first to SA-level verification servers are a collection of verification servers under the jurisdiction of the A-level timestamp server. The verification server connected to the A-level user who applies for a timestamp is used to authenticate the file doc with the A-level user who applies for a timestamp, and perform a three-party quantum digital signature on the timestamp file between the A-level timestamp server and the A-level user who applies for a timestamp.

[0024] Furthermore, each time stamp server includes a communication unit, a quantum security unit, a time stamp application unit and a time value transfer unit; the quantum security unit is connected to the communication unit, the time stamp application unit and the time value transfer unit respectively;

[0025] The communication unit is used to realize the connection and communication interaction between the timestamp server and other external systems;

[0026] The quantum security unit includes a hash algorithm module, an encryption and decryption module and a key storage module connected in pairs, and the key storage module is connected to a true quantum random number generator module; the hash algorithm module is used to generate a hash function to perform hash calculation on information; the encryption and decryption module is used to decrypt information received by the timestamp server and encrypt information sent by the timestamp server; the key storage module is used to store keys and send the keys to the hash algorithm module or the encryption and decryption module for use; the true quantum random number generator module is used to generate true quantum random numbers, and send the generated true quantum random numbers as keys to the key storage module for storage;

[0027] The timestamp application unit comprises a time value receiving module, a timestamp generating module and a timestamp issuing module connected in sequence, wherein the timestamp generating module is also connected to the file receiving module and the first quantum digital signature module; the time value module is used to receive the time value issued by the upper-level timestamp server, and convert the received time value into time information according to the region where the timestamp server of this level is located; the file receiving module is used to receive the file to be timestamped, and authenticate the integrity of the received file; the timestamp generating module is used to obtain the time value from the time value receiving module, and obtain the file doc to be timestamped from the file receiving module, and generate a timestamp file and a timestamp based on the time value and the file doc; the first quantum digital signature module is used to perform quantum digital signature for the generated timestamp file; the timestamp issuing module is used to issue the timestamp that passes the quantum digital signature verification to the user who applies for the timestamp;

[0028] The time value transmission unit includes a time value authentication module, a second quantum digital signature module and a time value sending module connected in sequence; the time value authentication module is used to verify the quantum digital signature of the previous level timestamp server; the second quantum digital signature module is used to perform quantum digital signature on the time value again; the time value sending module is used to send the time value with quantum digital signature to the next level timestamp server.

[0029] The present invention also includes a quantum-safe timestamp issuance working method, comprising the following steps:

[0030] (1) The timestamp server at this level receives the request and confirms the type of the request received. When the request type is the first request req1, the server performs step (2); when the request type is the second request req2, the server performs step (3);

[0031] (2) In response to the request received by the time stamp server at the same level being the first request req1, the time stamp server at the same level, the user at the same level, and the verification server at the same level execute a time stamp issuance process;

[0032] (3) In response to the request received by the timestamp server at this level being the second request req2, the timestamp server at the previous level, the timestamp server at this level, the verification server at this level, the timestamp server at the next level, and the verification server at the next level jointly execute a process of sending the time value.

[0033] Furthermore, the request type includes a first request req1 for applying for a timestamp issued by a user at the same level and a second request req2 for applying for a time value issued by a timestamp server at a next level.

[0034] Furthermore, the issuance process of the timestamp by the timestamp server at this level, the user at this level and the verification server at this level is specifically as follows:

[0035] 1) The local user who has the file doc to be timestamped selects one local verification server from the local verification server group to authenticate the file doc, and records the device information ver-ser of the selected local verification server; after the authentication is passed, the local user and the selected local verification server both retain the hash value h1(doc) of the file doc;

[0036] 2) The timestamp generation module in the timestamp application unit of the timestamp server at this level generates a timestamp file timestamp(doc)=(h1(doc),T,No,nonce,user,time-ser,ver-ser) for the file doc, where h1(doc) is the hash value of the file doc received by the file receiving module of the timestamp server at this level from the user at this level, T is the time value received by the time value receiving module of the timestamp server at this level from the timestamp server at the previous level, No is the serial number generated by the timestamp generation module for this timestamp issuance process, nonce is a true random number obtained by the timestamp generation module from the key storage module, user is the identity information of the user at this level who applies for the timestamp, time-ser is the device information of the timestamp server at this level, and ver-ser is the device information of the verification server at this level selected to participate in this timestamp issuance process;

[0037] 3) The timestamp server at this level, the user at this level and the selected verification server at this level perform a three-party quantum digital signature on the generated timestamp file timestamp(doc), wherein the timestamp server at this level is the signing party, and the user at this level and the selected verification server at this level are the verification parties; when the selected verification server at this level and the user at this level both pass the signature verification, the timestamp generation module in the timestamp application unit of the timestamp server at this level confirms that the hash value h2(timestamp(doc)) in the process of quantum digital signature is the timestamp in the process of timestamp issuance, and the timestamp issuance module in the timestamp application unit of the timestamp server at this level issues the timestamp h2(timestamp(doc)) to the user at this level, and the timestamp issuance is successful; otherwise, the signature verification fails, and the timestamp issuance fails, and the process of timestamp issuance is re-executed by returning to step 1).

[0038] Furthermore, the process of sending the execution time value is specifically as follows:

[0039] S1: The timestamp server at this level initiates a third request req3 for applying for a time value to the timestamp server at the next higher level based on the second request req2;

[0040] S2: The previous level timestamp server responds to the third request req3, and the time value transmission unit of the previous level timestamp server executes the time value transmission to the current level timestamp server: first, the previous level timestamp server selects a current level verification server from the current level verification server group, and then the previous level timestamp server, the current level timestamp server and the selected current level verification server perform a three-party quantum digital signature process for the time value, wherein the previous level timestamp server is the signing party, and the current level timestamp server and the selected current level verification server are the verification parties. When the current level timestamp server and the selected current level verification server both pass the verification, the current level timestamp server accepts and saves the time value; otherwise, the time value is not accepted, and the previous level timestamp server re-sends the time value;

[0041] S3: The time value transmission unit of the timestamp server at this level executes the time value transmission to the timestamp server at the next level: first, the timestamp server at this level selects a next-level verification server from the next-level verification server group, and then the timestamp server at this level, the next-level timestamp server and the selected next-level verification server perform a three-party quantum digital signature process for the time value, where the timestamp server at this level is the signing party, the next-level timestamp server and the selected next-level verification server are the verification parties, and when the next-level timestamp server and the selected next-level verification server both pass the verification, the next-level timestamp server accepts and saves the time value.

[0042] Furthermore, the previous level timestamp server, the current level timestamp server and the selected current level verification server perform a three-party quantum digital signature process for the time value as follows:

[0043] A1: The upper-level timestamp server obtains a set of keys from the local key storage module to generate an irreducible polynomial q(x). After obtaining the irreducible polynomial, the string consisting of the coefficients of each term except the highest term in the irreducible polynomial q(x) is recorded as str1;

[0044] A2: The previous level timestamp server negotiates keys with the current level timestamp server and obtains shared keys u1 and v1 respectively; the previous level timestamp server negotiates keys with the selected current level verification server and obtains shared keys u2 and v2 respectively; the lengths of u1 and u2 are the same, the lengths of v1 and v2 are the same, and the length of v1 is twice the length of u1; the previous level timestamp server performs an XOR operation on the keys u1, v1, u2 and v2 it owns, and obtains keys u=u1⊕u2 and v=v1⊕v2;

[0045] A3: The upper-level timestamp server selects the irreducible polynomial q(x) and the key u as the input random number to generate the hash function h q,u , using the hash function hq,u Perform a hash operation on the time value T issued to obtain the hash value h q,u (T); The previous level timestamp server uses the key v to hash the value h q,u (T) and string str1 are encrypted, and the encrypted value (h q,u (T), str1)⊕v and the time value T are transmitted to the selected verification server and the time stamp server at this level through the time value sending module, wherein the time value authentication module of the time stamp server at this level receives the encrypted value (h q,u (T),str1)⊕v and time value T;

[0046] A4: The selected verification server at this level sends its own keys u2 and v2 to the timestamp server at this level, and the timestamp server at this level sends its own keys u1 and v1 to the selected verification server at this level. The two parties exchange keys so that the selected verification server at this level and the timestamp server at this level both have keys u1, v1, u2, v2 and the encrypted value (h q,u (T),str1)⊕v, time value T;

[0047] A5: The selected authentication server at this level performs an XOR operation on the keys u1, v1, u2 and v2 it possesses, and obtains keys u′=u1⊕u2 and v′=v1⊕v2;

[0048] The selected authentication server at this level uses the key v′ to decrypt the encrypted value and obtain the time value T′, the string str1′ and h q,u (T)′, then use each bit of the string str1′ to correspond to the coefficients of each term of the polynomial except the highest term, generate an irreducible polynomial q′(x) with the highest term coefficient as 1, select the irreducible polynomial q′(x) and the key u′ as the input random number to generate the hash function h q′,u′ , using the hash function h q′,u′ Perform a hash operation on the time value T′ to obtain the hash value h q′,u′ (T′), compare the calculated hash value h q′,u′ (T′) and the decrypted h q,u (T)′ are equal, if they are equal, the signature verification passes; otherwise, the signature verification fails;

[0049] A6: The time value authentication module of the timestamp server at this level uses the same method as the selected verification server at this level to verify the signature;

[0050] A7: When the selected verification server at this level and the timestamp server at this level both pass the signature verification, the timestamp server at this level accepts and saves the time value T′; otherwise, the time value T′ is not accepted, and the timestamp server at the previous level re-issues the time value.

[0051] Beneficial effects of the present invention:

[0052] (1) The quantum-safe timestamp issuance networking system and its working method proposed in the present invention can be applied to the situation of executing quantum-safe timestamp issuance for a large number of users. Each timestamp issuance or time value delivery process relies on the quantum digital signature of three parties, which ensures that the timestamp issuance and time value transmission process cannot be tampered with, cannot be denied, and is unconditionally secure.

[0053] (2) In the networking system proposed by the present invention, each level of timestamp server has multiple verification servers under its jurisdiction. Only when the three-party quantum digital signature process is executed, the verification server participating in the quantum digital signature process will be determined. Each selection is unpredictable before the quantum digital signature begins, thus avoiding the possibility of a bad third party forging a verification server to participate in the quantum digital signature. The three-party quantum digital signature involved in the present invention can ensure that the entire networking system is quantum secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A connection diagram of the networking system for issuing timestamps in Example 1;

[0055] Figure 2 It is a schematic diagram of the structure of the timestamp server of the present invention;

[0056] Figure 3 This is a schematic diagram of the working process of the networking system of Example 1;

[0057] Figure 4 This is a connection diagram of the timestamp issuance networking system of Example 2. DETAILED DESCRIPTION

[0058] The present invention will be further described below in conjunction with the accompanying drawings and embodiments:

[0059] Example 1

[0060] As mentioned in the background technology, although the National Time Service Center is the best trusted time source for timestamps, its uniqueness also makes it bear a huge load pressure, and it is easy to be unable to respond. Therefore, how to ensure the safe issuance of timestamps while alleviating its load pressure has become a technical problem that the industry urgently needs to solve.

[0061] In view of this, the present application proposes a quantum-safe timestamp issuance networking system for issuing quantum-safe timestamps. Figure 1 The system comprises: a national time service center 1, a first-level time stamp server 11, a first-level verification server group 12 and a first-level user group 13, wherein the national time service center 1 is connected to the first-level time stamp server 11, and the first-level time stamp server 11, the first-level verification server group 12 and the first-level user group 13 are connected in pairs;

[0062] The national time service center 1 is used to transmit time values ​​to the primary time stamp server 11;

[0063] The first-level timestamp server 11 is used to receive the time value issued by the National Time Service Center 1; and to generate a timestamp file for the file doc that applies for a timestamp in the first-level user group 13 within the jurisdiction of the first-level timestamp server, and to perform a three-party quantum digital signature on the timestamp file with the first-level user who applies for the timestamp and the first-level verification server, and to issue the timestamp that has passed the quantum digital signature verification to the first-level user who applies for the timestamp; and also to provide a time value for the next-level timestamp server;

[0064] The first-level user group 13 is a collection of first-level users within the jurisdiction of the first-level timestamp server 11, including the first-level user 131, the second-level user 132, etc. Each first-level user requests a timestamp from the first-level timestamp server 11 according to its own needs, and performs a three-party quantum digital signature on the timestamp file with the first-level timestamp server 11 and the first-level verification server, and finally receives the timestamp;

[0065] The first-level verification server group 12 is a collection of verification servers under the jurisdiction of the first-level timestamp server 11, including a first-level verification server 121, a second-level verification server 122, etc. The verification server is used to authenticate the file doc with the first-level user who applies for the timestamp, and perform a three-party quantum digital signature on the timestamp file between the first-level timestamp server 11 and the first-level user who applies for the timestamp.

[0066] The primary time stamp server 11 may also be connected to a secondary time stamp server 21, the secondary time stamp server 21 is respectively connected to a secondary user group 23 and a secondary verification server group 22, and the secondary verification server group 22 is respectively connected to the primary time stamp server 11 and the secondary user group 23;

[0067] The secondary timestamp server 21 is used to receive the time value issued by the primary timestamp server 11; generate a timestamp file for the user file doc that applies for a timestamp in the secondary user group 23 within the jurisdiction of the current timestamp server, and perform a three-party quantum digital signature on the timestamp file with the secondary user who applies for the timestamp and the secondary verification server, and issue the timestamp that passes the quantum digital signature verification to the secondary user who applies for the timestamp; and provide a time value for the next-level timestamp server;

[0068] The secondary user group 23 is a collection of secondary users within the jurisdiction of the secondary timestamp server 21, including the first secondary user 231, the second secondary user 232, etc. Each secondary user requests a timestamp from the secondary timestamp server 21 according to its own needs, performs a three-party quantum digital signature on the timestamp file with the secondary timestamp server 21 and the secondary verification server, and finally receives the timestamp;

[0069] The secondary verification server group 22 is a collection of verification servers under the jurisdiction of the secondary timestamp server 11, including a first secondary verification server 221, a second secondary verification server 222, etc. The verification server is used to authenticate the file doc with the secondary user who applies for the timestamp, perform a three-party quantum digital signature on the timestamp file with the secondary timestamp server 21 and the secondary user who applies for the timestamp, and perform a three-party quantum digital signature on the time value issued by the primary timestamp server 11 with the primary timestamp server 11 and the secondary timestamp server 21.

[0070] The secondary timestamp server 21 can also be connected to the tertiary timestamp server, the tertiary timestamp server is respectively connected to the tertiary user group and the tertiary verification server group, and the tertiary verification server group is respectively connected to the secondary timestamp server and the tertiary user group; by analogy, the N-1 level timestamp server is also connected to the N-level timestamp server, the N-level timestamp server is respectively connected to the N-level user group and the N-level verification server group, and the N-level verification server group is respectively connected to the N-1 level timestamp server and the N-level user group; that is, the timestamp server of this level is connected to the user group of this level and the verification server group of this level in pairs, and is respectively connected to the timestamp server of the previous level and the timestamp server of the next level, and the verification server of this level is also connected to the timestamp server of the previous level, until the network can serve all users who need timestamp services. For example, the primary timestamp server 11 can be a timestamp server with jurisdiction over the provincial level, the secondary timestamp server 21 can be a timestamp server with jurisdiction over the municipal level, and the tertiary timestamp server can be a timestamp server with jurisdiction over the district level.

[0071] The N-level timestamp server is used to receive the time value issued by the N-1-level timestamp server; and to generate a timestamp file for the file doc that applies for a timestamp in the N-level user group within the jurisdiction of the current-level timestamp server, and to perform a three-party quantum digital signature on the timestamp file with the N-level user who applies for the timestamp and the N-level verification server, and to issue the timestamp that has passed the quantum digital signature verification to the N-level user who applies for the timestamp; and to provide a time value for the next-level timestamp server;

[0072] The N-level user group is a collection of N-level users within the jurisdiction of the N-level timestamp server. Each N-level user requests a timestamp from the N-level timestamp server according to its own needs, and performs a three-party quantum digital signature on the timestamp file with the N-level timestamp server and the N-level verification server, and finally accepts the timestamp;

[0073] The N-level verification server group is a collection of verification servers under the jurisdiction of the N-level timestamp server. The verification server is used to authenticate the file doc with the N-level user who applies for the timestamp, and to perform a three-party quantum digital signature on the timestamp file between the N-level timestamp server and the N-level user who applies for the timestamp; and to perform a three-party quantum digital signature on the time value issued by the N-1-level timestamp server between the N-level timestamp server and the N-level timestamp server.

[0074] In this embodiment 1, the timestamp servers at all levels have the same structure, which is as follows: Figure 2 As shown. Each time stamp server includes a communication unit 211, a quantum security unit 212, a time stamp application unit 213 and a time value transfer unit 214; wherein the quantum security unit 212 is connected to the communication unit 211, the time stamp application unit 213 and the time value transfer unit 214 respectively;

[0075] The communication unit 211 is used to realize the connection and communication interaction between the timestamp server and other external systems, such as other timestamp servers, verification servers, users, etc.;

[0076] The quantum security unit 212 is used to provide the timestamp server with functions such as random numbers, keys, encryption and decryption, etc., which include a hash algorithm module 2121, an encryption and decryption module 2122 and a key storage module 2123 connected in pairs, and the key storage module 2123 is connected to a true quantum random number generator module 2124; the hash algorithm module 2121 is used to generate a hash function to perform hash calculations on information, and the information includes but is not limited to the timestamp that needs to be sent, the time value of sending or receiving, etc.; the encryption and decryption module 2122 is used to decrypt the information received by the timestamp server and encrypt the information sent by the timestamp server; the key storage module 2123 is used to store keys, that is, to store local random numbers used as keys, and to send the keys to the hash algorithm module 2121 or the encryption and decryption module 2122 for use; the true quantum random number generator module 2124 is used to generate true quantum random numbers, and send the generated true quantum random numbers as keys to the key storage module 2123 for storage;

[0077] The timestamp application unit 213 is used to generate and issue a timestamp for the file doc owned by the user who applies for the timestamp, and includes a time value receiving module 2131, a timestamp generating module 2133 and a timestamp issuing module 2135 connected in sequence. The timestamp generating module 2133 is also connected to the file receiving module 2132 and the first quantum digital signature module 2134; the time value module 2131 is used to receive the time value issued by the upper-level timestamp server, and convert the received time value into time information according to the region where the timestamp server of this level is located. For example, the original time value issued by the National Time Service Center 1 is the time value of the East Eight Zone. The time value receiving module 2131 can convert the time information on the received time value according to the time zone information to obtain the time value of the current time zone. For the primary timestamp server 11, the time value module 2131 is used to receive the time value issued by the national time service center 1. At present, when maintaining real-time time or processing timestamps, a 125MHz clock is usually used to sample the second pulse signal (1PPS) or PTP (Precision Time Protocol) message to send and receive the frame positioning identification signal (FP); the file receiving module 2132 is used to receive the file to be timestamped and authenticate the integrity of the received file; the timestamp generating module 2133 is used to obtain the time value from the time value receiving module 2131, and obtain the file doc to be timestamped from the file receiving module 2132, and generate a timestamp file and a timestamp based on the time value and the file doc; the first quantum digital signature module 2134 is used to perform quantum digital signature on the generated timestamp file; the timestamp issuing module 2135 is used to issue the timestamp that passes the quantum digital signature verification to the user who applied for the timestamp;

[0078] The time value transmission unit 214 is used to receive the time value sent by the upper-level time stamp server and send the time value to the lower-level time stamp server. It includes a time value authentication module 2141, a second quantum digital signature module 2142 and a time value sending module 2143 connected in sequence; the time value authentication module 2141 is used to verify the quantum digital signature of the upper-level time stamp server; the second quantum digital signature module 2142 is used to perform quantum digital signature on the time value again; the time value sending module 2143 is used to send the time value with quantum digital signature to the lower-level time stamp server.

[0079] like Figure 3 As shown, based on the above-mentioned networking system for issuing timestamps and timestamp servers, this embodiment also proposes a working method of a quantum-safe timestamp issuing networking system, which includes the following steps:

[0080] (1) The timestamp server at this level receives the request and confirms the type of the request received. When the request type is the first request req1, the server performs step (2); when the request type is the second request req2, the server performs step (3);

[0081] The request types include: a first request req1 for applying for a timestamp issued by a user at the same level and a second request req2 for applying for a time value issued by a timestamp server at a next level.

[0082] Specifically, the step of confirming the request type can be performed by the communication unit 211 of the timestamp server. The confirmation step can be determined according to the information of the requester. When the communication unit 211 detects that the source of the request is the user, the request is confirmed as the first request req1. When the communication unit 211 detects that the source of the request is the next-level timestamp server, the request is confirmed as the second request req2.

[0083] (2) In response to the request received by the time stamp server at the same level being the first request req1, the time stamp application unit 213 in the time stamp server at the same level starts working, and the time stamp server at the same level, the user at the same level, and the verification server at the same level execute the time stamp issuance process. The issuance process is as follows:

[0084] 1) The user at this level who has the file doc to be timestamped selects one of the verification servers at this level from the verification server group at this level to authenticate the file doc, and records the device information ver-ser of the selected verification server at this level, so as to find the verification server at this level through the device information to perform the three-party quantum digital signature process; after the authentication is passed, the user at this level and the selected verification server at this level both retain the hash value h1(doc) of the file doc; the hash calculation process during the authentication process can be executed by calling the hash algorithm module 2121 in the quantum security unit 212;

[0085] The authentication method for the file doc in this step can use, for example, the file authentication method proposed in the patent "A method and system for issuing unconditionally trusted timestamps" with application number 202111606979.3.

[0086] 2) The timestamp generation module 2133 in the timestamp application unit 213 of the timestamp server at this level generates a timestamp file timestamp(doc)=(h1(doc),T,No,nonce,user,time-ser,ver-ser) for the file doc, wherein h1(doc) is the hash value of the file doc received by the file receiving module 2132 of the timestamp server at this level from the user at this level, T is the time value received by the time value receiving module 2131 of the timestamp server at this level from the timestamp server at the previous level, No is the serial number generated by the timestamp generation module 2133 for this timestamp issuance process, nonce is a true random number obtained by the timestamp generation module 2133 from the key storage module 2123, user is the identity information of the user at this level who applies for the timestamp, time-ser is the device information of the timestamp server at this level, and ver-ser is the device information of the verification server at this level selected to participate in this timestamp issuance process;

[0087] 3) The timestamp server at this level, the user at this level and the selected verification server at this level perform a three-party quantum digital signature on the generated timestamp file timestamp(doc), wherein the timestamp server at this level is the signing party, and the user at this level and the selected verification server at this level are the verification parties; when the selected verification server at this level and the user at this level both pass the verification, the timestamp generation module 2133 in the timestamp application unit of the timestamp server at this level confirms that the hash value h2(timestamp(doc)) in the process of performing the quantum digital signature this time is the timestamp in the process of issuing the timestamp this time, and the timestamp issuance module 2135 in the timestamp application unit of the timestamp server at this level issues the timestamp h2(timestamp(doc)) to the user at this level, and the timestamp issuance is successful; otherwise, the verification fails, regardless of whether the selected verification server at this level or the user at this level fails the verification, the timestamp issuance fails this time, and the process of issuing the timestamp is re-executed by returning to step 1). The process of the three-party quantum digital signature in this step is performed by the first quantum digital signature module 2134, and the hash calculation process involved in the process can be executed by calling the hash algorithm module 2121 in the quantum security unit 212. The method of the three-party quantum digital signature in this step can use, for example, the quantum digital signature method proposed in the patent "A method and system for issuing unconditionally trusted timestamps" with application number 202111606979.3.

[0088] (3) In response to the request received by the current-level timestamp server being the second request req2, the time value transmission unit 214 in the current-level timestamp server works, and the previous-level timestamp server, the current-level timestamp server, the current-level verification server, the next-level timestamp server, and the next-level verification server jointly execute the time value issuance process; the following takes the third-level timestamp server 31 initiating the second request req2 for applying for the time value to the second-level timestamp server 21 as an example to illustrate the time value issuance process in the above-mentioned networking system for issuing timestamps, specifically:

[0089] S1: The secondary timestamp server 21 initiates a third request req3 for a time value to the primary timestamp server 11 based on the second request req2;

[0090] S2: The primary timestamp server 11 responds to the third request req3, and the time value transmission unit 214 of the primary timestamp server 11 sends the time value to the secondary timestamp server: first, the primary timestamp server 11 selects one secondary verification server from the secondary verification server group 22, for example, the first and second verification servers 221 are selected, and then the primary timestamp server 11, the secondary timestamp server 21 and the first and second verification servers 221 perform a three-party quantum digital signature process for the time value, wherein the primary timestamp server 11 is the signer, and the second quantum digital signature module 2142 of the primary timestamp server 11 performs the signing operation, the secondary timestamp server 21 and the first and second verification servers 221 are the signature verification parties, and the time value authentication module 2141 in the secondary timestamp server 21 performs the signature verification operation; when the secondary timestamp server 21 and the first and second verification servers 221 both pass the signature verification, the secondary timestamp server 21 accepts and saves the time value; otherwise, the time value is not accepted, and the primary timestamp server 11 re-sends the time value;

[0091] In this step, the first-level timestamp server 11, the second-level timestamp server 21 and the first and second-level verification servers 221 perform the three-party quantum digital signature process for the time value as follows:

[0092] A1: The primary timestamp server 11 obtains a set of keys from the local key storage module 2123 for generating an irreducible polynomial q(x). After obtaining the irreducible polynomial, the string consisting of the coefficients of each term except the highest term in the irreducible polynomial q(x) is recorded as str1;

[0093] A2: The primary timestamp server 11 negotiates keys with the secondary timestamp server 21, and obtains shared keys u1 and v1 respectively; the primary timestamp server 11 negotiates keys with the first and second verification servers 221, and obtains shared keys u2 and v2 respectively; wherein, the lengths of u1 and u2 are the same, the lengths of v1 and v2 are the same, and the length of v1 is twice the length of u1; the primary timestamp server 11 performs an XOR operation on the keys u1, v1, u2, and v2 it possesses, and obtains keys u=u1⊕u2 and v=v1⊕v2;

[0094] A3: The primary timestamp server 11 selects the irreducible polynomial q(x) and the key u as the input random number to generate the hash function h q,u , using the hash function h q,u Perform a hash operation on the time value T issued to obtain the hash value h q,u (T); The primary timestamp server 11 uses the key v to hash the value h q,u (T) and string str1 are encrypted, and the encrypted value (h q,u(T), str1)⊕v and the time value T are transmitted to the first and second level verification servers 221 and the second level timestamp server 21 via the time value sending module 2143, wherein the time value authentication module 2141 of the second level timestamp server 21 receives the encrypted value (h q,u (T),str1)⊕v and time value T;

[0095] A4: The first and second level authentication server 221 sends its own keys u2 and v2 to the second level timestamp server 21, and the second level timestamp server 21 sends its own keys u1 and v1 to the first and second level authentication server 221. The two parties exchange keys so that the first and second level authentication server 221 and the second level timestamp server 21 both have keys u1, v1, u2, v2 and the encrypted value (h q,u (T),str1)⊕v, time value T;

[0096] A5: The first and second level authentication server 221 performs an XOR operation on the keys u1, v1, u2 and v2 it possesses, and obtains keys u′=u1⊕u2 and v′=v1⊕v2;

[0097] The first and second level verification servers 221 use the key v′ to decrypt the encrypted value and obtain the time value T′, the string str1′ and h q,u (T)′, then use each bit of the string str1′ to correspond to the coefficients of each term of the polynomial except the highest term, generate an irreducible polynomial q′(x) with the highest term coefficient as 1, select the irreducible polynomial q′(x) and the key u′ as the input random number to generate the hash function h q′,u′ , using the hash function h q′,u′ Perform a hash operation on the time value T′ to obtain the hash value h q′,u′ (T′), compare the calculated hash value h q′,u′ (T′) and the decrypted h q,u (T)′ are equal, if they are equal, the signature verification passes; otherwise, the signature verification fails;

[0098] A6: The time value authentication module 2141 of the secondary time stamp server 21 uses the same method as the first and second level authentication server 221 to perform signature verification;

[0099] A7: When both the first and second level verification servers 221 and the second level timestamp server 21 pass the signature verification, the second level timestamp server 21 accepts and saves the time value T′; otherwise, the time value T′ is not accepted, and the first level timestamp server 11 re-issues the time value.

[0100] S3: The time value transmission unit of the secondary time stamp server 21 executes the time value transmission to the tertiary time stamp server: First, the secondary time stamp server 21 selects a third-level verification server from the third-level verification server group, and then the secondary time stamp server 21, the third-level time stamp server 31 and the selected third-level verification server perform a three-party quantum digital signature process for the time value, wherein the secondary time stamp server 21 is the signing party, the third-level time stamp server 31 and the selected third-level verification server are the signature verification parties, and when the third-level time stamp server 31 and the selected third-level verification server both pass the signature verification, the third-level time stamp server 31 accepts and saves the time value. The time value received by the third-level time stamp server 31 can be stored in the time value receiving module 2131 for the generation of the timestamp, or can be stored in the time value authentication module 2141 for continuing to send the time value to the fourth-level time stamp server.

[0101] In this embodiment, each level of timestamp server has multiple verification servers at the same level. Only when the three-party quantum digital signature process is executed will the verification server participating in the quantum digital signature process be determined. Each selection is unpredictable before the quantum digital signature begins, avoiding the possibility of a bad third party forging a verification server to participate in the quantum digital signature.

[0102] Example 2

[0103] For a timestamp server serving a relatively large jurisdiction, since there are many users in the jurisdiction, there will be a large number of users in the user group at this level and verification servers in the verification server group at this level connected to the timestamp server at this level. In Example 1, there is no definite corresponding relationship between the users at this level and the verification servers at this level. They are all verification servers temporarily selected when implementing quantum digital signatures, resulting in the need to address the corresponding verification server according to the information of the verification server each time the signature is verified.

[0104] like Figure 4 As shown, this embodiment proposes another quantum secure timestamp issuance networking system, which is different from the one in Embodiment 1 in that:

[0105] The system includes: a national time service center 1, a first-level time stamp server 11, first to M-th first-level verification servers and first to M-th groups of first-level users, the national time service center 1 is connected to the first-level time stamp server 11, the first-level time stamp server 11, the first-level verification server 141 and the first group of first-level users 151 are connected in pairs; the first-level time stamp server 11, the second-level verification server 142 and the second group of first-level users 152 are connected in pairs; and so on, the first-level time stamp server 11, the M-th first-level verification server and the M-th group of first-level users are connected in pairs;

[0106] The authentication server at this level establishes a binding relationship with a group of users at this level. For example, the system specifically includes first to second first-level authentication servers and first to second groups of first-level users. The first first-level authentication server 141 establishes a binding relationship with the first group of first-level users 151, and the first-level timestamp server 11, the first first-level authentication server 141 and the first group of first-level users 151 are connected in pairs; the second first-level authentication server 142 establishes a binding relationship with the second group of first-level users 152, and the first-level timestamp server 11, the second first-level authentication server 142 and the second group of first-level users 152 are connected in pairs.

[0107] The national time service center 1 is used to transmit time values ​​to the primary time stamp server 11;

[0108] The first-level timestamp server 11 is used to receive the time value issued by the National Time Service Center 1; and to generate a timestamp file for the file doc that applies for a timestamp in the first-level user within the jurisdiction of the first-level timestamp server, and to perform a three-party quantum digital signature on the timestamp file between the first-level user who applies for the timestamp and the first-level verification server connected to the first-level user who applies for the timestamp, and to issue the timestamp that passes the quantum digital signature verification to the first-level user who applies for the timestamp; and also to provide a time value for the next-level timestamp server;

[0109] The first to Mth groups of primary users are a collection of primary users within the jurisdiction of the primary timestamp server 11. Each primary user requests a timestamp from the primary timestamp server 11 according to its own needs, and performs a three-party quantum digital signature on the timestamp file between the primary timestamp server 11 and the primary verification server connected to the primary user applying for the timestamp, and finally accepts the timestamp;

[0110] The first to Mth first-level verification servers are a collection of verification servers under the jurisdiction of the first-level timestamp server 11. The verification server connected to the first-level user who applies for a timestamp is used to authenticate the file doc with the first-level user who applies for a timestamp, and perform a three-party quantum digital signature on the timestamp file between the first-level timestamp server 11 and the first-level user who applies for a timestamp.

[0111] The first-level timestamp server 11 can also be connected to the second-level timestamp server 21, and the second-level timestamp server 21 is respectively connected to the first and second-level verification servers 241 and the first group of second-level users 251, and the first and second-level verification servers 241 are respectively connected to the first-level timestamp server 11 and the first group of second-level users 251; the second-level timestamp server 21 is also respectively connected to the second and second-level verification servers 242 and the second group of second-level users 252, and the second and second-level verification servers 242 are respectively connected to the first-level timestamp server 11 and the second group of second-level users 252; similarly, the second-level timestamp server is also respectively connected to the Lth and Lth groups of second-level users, and the Lth and second-level verification servers are respectively connected to the first-level timestamp server and the Lth group of second-level users; this embodiment 2 takes the connection between the first and second-level verification servers 241 and the second and second-level verification servers 242 as an example, and the structure of the timestamp server in this embodiment 2 is the same as the structure of the timestamp server in embodiment 1, which will not be repeated here.

[0112] The secondary timestamp server 21 is used to receive the time value issued by the primary timestamp server 11; and generate a timestamp file for the file doc that the secondary user applies for a timestamp within the jurisdiction of the current timestamp server, and perform a three-party quantum digital signature on the timestamp file between the secondary user who applies for the timestamp and the secondary verification server connected to the secondary user who applies for the timestamp, and issue the timestamp that passes the quantum digital signature verification to the secondary user who applies for the timestamp; and also provide a time value for the next-level timestamp server;

[0113] The first to second groups of secondary users are a collection of secondary users within the jurisdiction of the secondary timestamp server 21. Each secondary user requests a timestamp from the secondary timestamp server 21 according to its own needs, and performs a three-party quantum digital signature on the timestamp file between the secondary timestamp server 21 and the secondary verification server connected to the secondary user applying for the timestamp, and finally accepts the timestamp;

[0114] The first to second secondary verification servers are a collection of verification servers under the jurisdiction of the secondary timestamp server. The verification server connected to the secondary user who applies for the timestamp is used to authenticate the file doc with the secondary user who applies for the timestamp, and perform a three-party quantum digital signature on the timestamp file between the secondary timestamp server and the secondary user who applies for the timestamp.

[0115] Compared with the system proposed in Example 1, the timestamp issuance networking system in Example 2 is different from the uncertain corresponding relationship between the local users and the local verification servers in Example 1. In Example 2, each local verification server under the local timestamp server is bound to a group of local users. Through this binding relationship, the verification operation of the timestamp applied by any one of the group of local users connected to the local verification server is directly performed by the local verification server, which reduces the time of searching for the verification server according to the device information of the verification server.

Claims

1. A quantum secure timestamp issuance networking system, characterized in that: The system comprises: a national time service center, a first-level time stamp server, a first-level verification server group and a first-level user group, wherein the national time service center is connected to the first-level time stamp server, and the first-level time stamp server, the first-level verification server group and the first-level user group are connected in pairs; The National Time Service Center is used to transmit time values ​​to the primary timestamp server; The first-level timestamp server is used to receive the time value issued by the National Time Service Center; and to generate a timestamp file for the file doc that applies for a timestamp in the first-level user group within the jurisdiction of the first-level timestamp server, and to perform a three-party quantum digital signature on the timestamp file with the first-level user who applies for the timestamp and the first-level verification server, and to issue the timestamp that has passed the quantum digital signature verification to the first-level user who applies for the timestamp; it is also used to provide time values ​​for the next-level timestamp server; The first-level user group is a collection of first-level users within the jurisdiction of the first-level timestamp server. Each first-level user requests a timestamp from the first-level timestamp server according to its own needs, and performs a three-party quantum digital signature on the timestamp file with the first-level timestamp server and the first-level verification server, and finally accepts the timestamp; The first-level verification server group is a collection of verification servers under the jurisdiction of the first-level timestamp server. The verification server is used to authenticate the file doc with the first-level user who applies for the timestamp, and to perform a three-party quantum digital signature on the timestamp file between the first-level timestamp server and the first-level user who applies for the timestamp.

2. A quantum secure timestamp issuance networking system according to claim 1, characterized in that: The primary timestamp server is also connected to the secondary timestamp server, the secondary timestamp server is respectively connected to the secondary user group and the secondary verification server group, and the secondary verification server group is respectively connected to the primary timestamp server and the secondary user group; The secondary timestamp server is also connected to the tertiary timestamp server, the tertiary timestamp server is respectively connected to the tertiary user group and the tertiary verification server group, the tertiary verification server group is respectively connected to the secondary timestamp server and the tertiary user group; by analogy, the N-1 level timestamp server is also connected to the N-level timestamp server, the N-level timestamp server is respectively connected to the N-level user group and the N-level verification server group, the N-level verification server group is respectively connected to the N-1 level timestamp server and the N-level user group; The N-level timestamp server is used to receive the time value issued by the N-1-level timestamp server; and generate a timestamp file for the file doc that applies for a timestamp in the N-level user group within the jurisdiction of this-level timestamp server, and perform a three-party quantum digital signature on the timestamp file with the N-level user who applies for the timestamp and the N-level verification server, and issue the timestamp that passes the quantum digital signature verification to the N-level user who applies for the timestamp; It is also used to provide time values ​​to the next level timestamp server; The N-level user group is a collection of N-level users within the jurisdiction of the N-level timestamp server. Each N-level user requests a timestamp from the N-level timestamp server according to its own needs, and performs a three-party quantum digital signature on the timestamp file with the N-level timestamp server and the N-level verification server, and finally accepts the timestamp; The N-level verification server group is a collection of verification servers under the jurisdiction of the N-level timestamp server. The verification server is used to authenticate the file doc with the N-level user who applies for the timestamp, and to perform a three-party quantum digital signature on the timestamp file between the N-level timestamp server and the N-level user who applies for the timestamp; and to perform a three-party quantum digital signature on the time value issued by the N-1-level timestamp server between the N-level timestamp server and the N-level timestamp server.

3. A quantum secure timestamp issuance networking system, characterized in that: The system comprises: a national time service center, a first-level time stamp server, first to M-th first-level verification servers and first to M-th groups of first-level users, wherein the national time service center is connected to the first-level time stamp server, and the first-level time stamp server, the first-level verification server and the first group of first-level users are connected in pairs; the first-level time stamp server, the second-level verification server and the second group of first-level users are connected in pairs; and so on, the first-level time stamp server, the M-th first-level verification server and the M-th group of first-level users are connected in pairs; The National Time Service Center is used to transmit time values ​​to the primary timestamp server; The first-level timestamp server is used to receive the time value issued by the National Time Service Center; and to generate a timestamp file for the file doc that applies for a timestamp in the first-level user within the jurisdiction of the first-level timestamp server, and to perform a three-party quantum digital signature on the timestamp file between the first-level user who applies for the timestamp and the first-level verification server connected to the first-level user who applies for the timestamp, and to issue the timestamp that has passed the quantum digital signature verification to the first-level user who applies for the timestamp; it is also used to provide time values ​​for the next-level timestamp server; The first to Mth groups of first-level users are a collection of first-level users within the jurisdiction of the first-level timestamp server. Each first-level user requests a timestamp from the first-level timestamp server according to its own needs, and performs a three-party quantum digital signature on the timestamp file between the first-level timestamp server and the first-level verification server connected to the first-level user who applied for the timestamp, and finally accepts the timestamp; The first to Mth first-level verification servers are a collection of verification servers under the jurisdiction of the first-level timestamp server. The verification server connected to the first-level user who applies for a timestamp is used to authenticate the file doc with the first-level user who applies for a timestamp, and perform a three-party quantum digital signature on the timestamp file between the first-level timestamp server and the first-level user who applies for a timestamp.

4. A quantum secure timestamp issuance networking system according to claim 3, characterized in that: The primary timestamp server is also connected to the secondary timestamp server, the secondary timestamp server is respectively connected to the first and second verification servers and the first group of secondary users, and the first and second verification servers are respectively connected to the primary timestamp server and the first group of secondary users; The secondary timestamp server is also connected to the second secondary authentication server and the second group of secondary users, respectively, and the second secondary authentication server is connected to the first time stamp server and the second group of secondary users, respectively; similarly, the secondary timestamp server is also connected to the Lth secondary authentication server and the Lth group of secondary users, respectively, and the Lth secondary authentication server is connected to the first time stamp server and the Lth group of secondary users, respectively; and so on, the A-1 level timestamp server is also connected to the A level timestamp server, and the A level timestamp server is connected to the first A level authentication server and the first group of A level users, respectively, and the first A level authentication server is connected to the A-1 level timestamp server and the first group of A level users, respectively; the A level timestamp server is also connected to the second A level authentication server and the second group of A level users, respectively, and the second A level authentication server is connected to the A-1 level timestamp server and the second group of A level users, respectively; similarly, the A level timestamp server is also connected to the SA level authentication server and the Sth group of A level users, respectively, and the SA level authentication server is connected to the A-1 level timestamp server and the Sth group of A level users, respectively; The A-level timestamp server is used to receive the time value issued by the A-1-level timestamp server; and to generate a timestamp file for the file doc that the A-level user who applies for the timestamp is under the jurisdiction of the current-level timestamp server, and to perform a three-party quantum digital signature on the timestamp file between the A-level user who applies for the timestamp and the A-level verification server connected to the A-level user who applies for the timestamp, and to issue the timestamp that has passed the quantum digital signature verification to the A-level user who applies for the timestamp; and also to provide a time value for the next-level timestamp server; The first to Sth groups of Class A users are a collection of Class A users within the jurisdiction of the Class A timestamp server. Each Class A user requests a timestamp from the Class A timestamp server according to its own needs, and performs a three-party quantum digital signature on the timestamp file between the Class A timestamp server and the Class A verification server connected to the Class A user who applied for the timestamp, and finally accepts the timestamp; The first to SA-level verification servers are a collection of verification servers under the jurisdiction of the A-level timestamp server. The verification server connected to the A-level user who applies for a timestamp is used to authenticate the file doc with the A-level user who applies for a timestamp, and perform a three-party quantum digital signature on the timestamp file between the A-level timestamp server and the A-level user who applies for a timestamp.

5. A quantum secure timestamp issuance networking system according to any one of claims 1 to 4, characterized in that: Each time stamp server includes a communication unit, a quantum security unit, a time stamp application unit and a time value transfer unit; the quantum security unit is connected to the communication unit, the time stamp application unit and the time value transfer unit respectively; The communication unit is used to realize the connection and communication interaction between the timestamp server and other external systems; The quantum security unit includes a hash algorithm module, an encryption and decryption module and a key storage module connected in pairs, and the key storage module is connected to the true quantum random number generator module; the hash algorithm module is used to generate a hash function to perform hash calculation on information; the encryption and decryption module is used to decrypt information received by the timestamp server and encrypt information sent by the timestamp server; the key storage module is used to store keys and send keys to the hash algorithm module or the encryption and decryption module for use; The true quantum random number generator module is used to generate true quantum random numbers, and send the generated true quantum random numbers as keys to the key storage module for storage; The timestamp application unit includes a time value receiving module, a timestamp generating module and a timestamp issuing module connected in sequence, wherein the timestamp generating module is also connected to the file receiving module and the first quantum digital signature module; the time value module is used to receive the time value issued by the upper-level timestamp server, and convert the received time value into time information according to the region where the timestamp server of this level is located; The file receiving module is used to receive the file to be timestamped and authenticate the integrity of the received file; The timestamp generation module is used to obtain the time value from the time value receiving module, and obtain the file doc to be timestamped from the file receiving module, and generate a timestamp file and a timestamp based on the time value and the file doc; The first quantum digital signature module is used to perform quantum digital signature on the generated timestamp file; the timestamp issuance module is used to issue the timestamp that has passed the quantum digital signature verification to the user who applied for the timestamp; The time value transmission unit includes a time value authentication module, a second quantum digital signature module and a time value sending module connected in sequence; the time value authentication module is used to verify the quantum digital signature of the previous level timestamp server; the second quantum digital signature module is used to perform quantum digital signature on the time value again; the time value sending module is used to send the time value with quantum digital signature to the next level timestamp server.

6. A quantum-safe timestamp issuance method, characterized in that: The following steps are involved: (1) The timestamp server at this level receives the request and confirms the type of the request received. When the request type is the first request req1, the server performs step (2); when the request type is the second request req2, the server performs step (3); (2) In response to the request received by the time stamp server at the same level being the first request req1, the time stamp server at the same level, the user at the same level, and the verification server at the same level execute a time stamp issuance process; (3) In response to the request received by the timestamp server at this level being the second request req2, the timestamp server at the previous level, the timestamp server at this level, the verification server at this level, the timestamp server at the next level, and the verification server at the next level jointly execute a process of sending the time value.

7. A quantum-safe timestamp issuance method according to claim 6, characterized in that: The request types include a first request req1 for requesting a timestamp issued by a user at the same level and a second request req2 for requesting a time value issued by a timestamp server at a next level.

8. A quantum secure timestamp issuance method according to claim 6, characterized in that: The specific process of issuing timestamps by the timestamp server at this level, the user at this level and the verification server at this level is as follows: 1) The local user who has the file doc to be timestamped selects one local verification server from the local verification server group to authenticate the file doc, and records the device information ver-ser of the selected local verification server; after the authentication is passed, the local user and the selected local verification server both retain the hash value h1(doc) of the file doc; 2) The timestamp generation module in the timestamp application unit of the timestamp server at this level generates a timestamp file timestamp(doc)=(h1(doc),T,No,nonce,user,time-ser,ver-ser) for the file doc, where h1(doc) is the hash value of the file doc received by the file receiving module of the timestamp server at this level from the user at this level, T is the time value received by the time value receiving module of the timestamp server at this level from the timestamp server at the previous level, No is the serial number generated by the timestamp generation module for this timestamp issuance process, nonce is a true random number obtained by the timestamp generation module from the key storage module, user is the identity information of the user at this level who applies for the timestamp, time-ser is the device information of the timestamp server at this level, and ver-ser is the device information of the verification server at this level selected to participate in this timestamp issuance process; 3) The timestamp server at this level, the user at this level and the selected verification server at this level perform a three-party quantum digital signature on the generated timestamp file timestamp(doc), where the timestamp server at this level is the signing party, and the user at this level and the selected verification server at this level are the verification parties; When the selected verification server at this level and the user at this level have passed the signature verification, the timestamp generation module in the timestamp application unit of the timestamp server at this level confirms that the hash value h2(timestamp(doc)) in the quantum digital signature process is the timestamp in the timestamp issuance process, and the timestamp issuance module in the timestamp application unit of the timestamp server at this level issues the timestamp h2(timestamp(doc)) to the user at this level, and the timestamp issuance is successful; otherwise, the signature verification fails, and the timestamp issuance fails, and the process of issuing the timestamp is returned to step 1) to re-execute the timestamp issuance process.

9. A quantum-safe timestamp issuance method according to claim 6, characterized in that: The specific process of sending the execution time value is as follows: S1: The timestamp server at this level initiates a third request req3 for applying for a time value to the timestamp server at the next higher level based on the second request req2; S2: The previous level timestamp server responds to the third request req3, and the time value transmission unit of the previous level timestamp server executes the time value transmission to the current level timestamp server: first, the previous level timestamp server selects a current level verification server from the current level verification server group, and then the previous level timestamp server, the current level timestamp server and the selected current level verification server perform a three-party quantum digital signature process for the time value, wherein the previous level timestamp server is the signing party, and the current level timestamp server and the selected current level verification server are the verification parties. When the current level timestamp server and the selected current level verification server both pass the verification, the current level timestamp server accepts and saves the time value; otherwise, the time value is not accepted, and the previous level timestamp server re-sends the time value; S3: The time value transmission unit of the timestamp server at this level executes the time value transmission to the timestamp server at the next level: first, the timestamp server at this level selects a next-level verification server from the next-level verification server group, and then the timestamp server at this level, the next-level timestamp server and the selected next-level verification server perform a three-party quantum digital signature process for the time value, where the timestamp server at this level is the signing party, the next-level timestamp server and the selected next-level verification server are the verification parties, and when the next-level timestamp server and the selected next-level verification server both pass the verification, the next-level timestamp server accepts and saves the time value.

10. A quantum-safe timestamp issuance method according to claim 9, characterized in that: The quantum digital signature process of the previous level timestamp server, the current level timestamp server and the selected current level verification server for the time value is specifically as follows: A1: The upper-level timestamp server obtains a set of keys from the local key storage module to generate an irreducible polynomial q(x). After obtaining the irreducible polynomial, the string consisting of the coefficients of each term except the highest term in the irreducible polynomial q(x) is recorded as str1; A2: The previous level timestamp server negotiates keys with the current level timestamp server and obtains shared keys u1 and v1 respectively; the previous level timestamp server negotiates keys with the selected current level verification server and obtains shared keys u2 and v2 respectively; Among them, the lengths of u1 and u2 are the same, the lengths of v1 and v2 are the same, and the length of v1 is twice the length of u1; the upper-level timestamp server performs an XOR operation on the keys u1, v1, u2, and v2 it owns, and obtains the keys u=u1⊕u2 and v=v1⊕v2; A3: The upper-level timestamp server selects the irreducible polynomial q(x) and the key u as the input random number to generate the hash function h q,u , using the hash function h q,u Perform a hash operation on the time value T issued to obtain the hash value h q,u (T); The previous level timestamp server uses the key v to hash the value h q,u (T) and string str1 are encrypted, and the encrypted value (h q,u (T), str1)⊕v and the time value T are transmitted to the selected verification server and the time stamp server at this level through the time value sending module, wherein the time value authentication module of the time stamp server at this level receives the encrypted value (h q,u (T),str1)⊕v and time value T; A4: The selected verification server at this level sends its own keys u2 and v2 to the timestamp server at this level, and the timestamp server at this level sends its own keys u1 and v1 to the selected verification server at this level. The two parties exchange keys so that the selected verification server at this level and the timestamp server at this level both have keys u1, v1, u2, v2 and the encrypted value (h q,u (T),str1)⊕v, time value T; A5: The selected authentication server at this level performs an XOR operation on the keys u1, v1, u2 and v2 it possesses, and obtains keys u′=u1⊕u2 and v′=v1⊕v2; The selected authentication server at this level uses the key v′ to decrypt the encrypted value and obtain the time value T′, the string str1′ and h q,u (T)′, then use each bit of the string str1′ to correspond to the coefficients of each term of the polynomial except the highest term, generate an irreducible polynomial q′(x) with the highest term coefficient as 1, select the irreducible polynomial q′(x) and the key u′ as the input random number to generate the hash function h q′,u′ , using the hash function h q′,u′ Perform a hash operation on the time value T′ to obtain the hash value h q′,u′ (T′), compare the calculated hash value h q′,u′ (T′) and the decrypted h q,u (T)′ are equal, if they are equal, the signature verification passes; otherwise, the signature verification fails; A6: The time value authentication module of the timestamp server at this level uses the same method as the selected verification server at this level to verify the signature; A7: When the selected verification server at this level and the timestamp server at this level both pass the signature verification, the timestamp server at this level accepts and saves the time value T′; otherwise, the time value T′ is not accepted, and the timestamp server at the previous level re-issues the time value.

Images