Quantum security timestamp issuing networking system

Abstract

The invention discloses a quantum security timestamp issuing networking system, which comprises a national time service center, a first issuing center, a first-level timestamp server and a first group of users in the jurisdiction range of the first-level timestamp server, and is characterized in that the national time service center is connected with the first-level timestamp server; the first-level timestamp server, the first issuing center and the first group of users are connected in pairs. According to the invention, the present-level issuing center, the present-level timestamp server and the user group within the jurisdiction range of the present-level timestamp jointly form the timestamp service expansion unit, and the expansion unit is used as the minimum unit, so that convenient expansion of networking can be realized; when a larger range or more users need to be served, the extension unit is connected to the upper-level timestamp server, so that the timestamp service can be extended, the extension of the service range of networking is realized, the service pressure of a certain timestamp server is relieved, and the response efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of time stamps, and in particular to a quantum secure time stamp issuance networking system. Background Art

[0002] With the development of electronic information technology in many fields such as electronic contracts, e-commerce, medical care, intellectual property protection, etc., time is very important information in these fields; therefore, providing reliable time services to prevent the forgery and tampering of electronic document content has become a concern of the industry. Timestamp is a reliable time mark provided by a trusted third-party timestamp issuance system, which is mainly used to prove that the electronic document existed before a certain moment; its system uses a trusted time source to collect time, and uses the corresponding timestamp protocol and timestamp mechanism to issue timestamps. The existence of timestamps can effectively prevent the forgery and tampering of electronic document content.

[0003] The National Time Service Center of the Chinese Academy of Sciences (hereinafter referred to as the "National Time Service Center") is the only scientific research institution in my country that specializes in and comprehensively engages in basic and applied research on time and frequency. It is responsible for the generation, maintenance and broadcasting of my country's national standard time (Beijing time) and is the best trusted time source for timestamps. However, many electronic files request the recognized time from the National Time Service Center, or apply for timestamps from a certain timestamp server, which will cause great load pressure on the server and easily lead to the situation of being unable to respond. At the same time, due to the importance of timestamps to electronic files, their security during transmission also directly affects the effectiveness of timestamps. Only securely transmitted and tamper-free timestamps can provide security protection for time information for electronic files.

[0004] In view of this, how to build a timestamp issuance network to alleviate the pressure of a single timestamp server issuing timestamps and to safely transmit and issue time values ​​in the network has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] Purpose of the invention: The purpose of the present invention is to provide a quantum-safe timestamp issuance networking system, which solves the problem of excessive load pressure when a single timestamp server simultaneously issues a large number of timestamps, and solves the problem of securely transmitting and issuing time values ​​in the timestamp issuance networking system.

[0006] Technical solution: The present invention provides a quantum-safe timestamp issuance networking system, which includes: a national time service center, a first issuance center, a primary timestamp server, and a first group of users within the jurisdiction of the primary timestamp server, wherein the national time service center is connected to the primary timestamp server, and the primary timestamp server, the first issuance center, and the first group of users are connected in pairs;

[0007] The National Time Service Center is used to transmit time values ​​to the primary timestamp server;

[0008] The first issuing center is used to issue a server identity certificate to the first-level timestamp server and to issue a user identity certificate to the user accessing the first-level timestamp server;

[0009] The first-level timestamp server is used to verify the user identity information of the first group of users who apply for timestamps within the jurisdiction of the first-level timestamp server, generate and issue timestamps, and issue time values ​​to the next-level timestamp server;

[0010] The first group of users is a collection of users under the jurisdiction of the first-level timestamp server. Users request timestamps from the first-level timestamp server according to their own needs, verify the server identity information attached to the timestamp, and finally accept the timestamp.

[0011] Further, the primary timestamp server and the first issuing center are also connected to a primary timestamp service extension unit, the primary timestamp service extension unit includes a second issuing center, a secondary timestamp server, and a second group of users within the jurisdiction of the secondary timestamp server, which are connected in pairs, and the secondary timestamp server is connected to both the primary timestamp server and the first issuing center;

[0012] The second issuing center is used to issue a server identity certificate for the secondary timestamp server and a user identity certificate for the user accessing the secondary timestamp server;

[0013] The secondary timestamp server is used to verify the user identity information of the second group of users who apply for timestamps within the jurisdiction of the timestamp server at this level, generate and issue timestamps, and send time values ​​to the next level timestamp server;

[0014] The second group of users is a collection of users under the jurisdiction of the secondary timestamp server. Users request timestamps from the secondary timestamp server according to their own needs, verify the server identity information attached to the timestamp, and finally accept the timestamp.

[0015] Further, the secondary timestamp server and the second issuance center are also connected to the secondary timestamp service extension unit, the secondary timestamp service extension unit includes a third issuance center connected in pairs, a third timestamp server, and a third group of users within the jurisdiction of the third timestamp server, and the third time stamp server is connected to both the secondary timestamp server and the second issuance center; by analogy, the N-1-level timestamp server and the N-1-th issuance center are also connected to the N-1-level timestamp service extension unit, the N-1-level timestamp service extension unit includes an N-th issuance center connected in pairs, an N-level timestamp server, and an N-th group of users within the jurisdiction of the N-level timestamp server, and the N-level timestamp server is connected to both the N-1-level timestamp server and the N-1-th issuance center;

[0016] The Nth issuing center is used to issue server identity certificates for the N-level timestamp server and to issue user identity certificates for users accessing the N-level timestamp server;

[0017] The N-level timestamp server is used to verify the user identity information of the Nth group of users who apply for timestamps within the jurisdiction of the timestamp server at this level, generate and issue timestamps, and send time values ​​to the next-level timestamp server;

[0018] The Nth group of users is a collection of users under the jurisdiction of the N-level timestamp server. Users request timestamps from the N-level timestamp server according to their own needs, verify the server identity information attached to the timestamp, and finally accept the timestamp.

[0019] Further, the first-level timestamp server, the second-level timestamp server to the N-level timestamp server all include an input module, a decryption module, an authentication module, an encryption module and an output module connected in sequence, and the authentication module and the encryption module are both connected to the time value module; the time value module includes a time source receiving module, a time source calibration module and a local time source module connected in sequence, the time source receiving module is connected to the authentication module, and the local time source module is connected to the encryption module;

[0020] The input module is used to receive data from the outside world;

[0021] The decryption module is used to decrypt the external ciphertext data received via the input module;

[0022] The authentication module is used to authenticate the legitimacy of the identity information in the data and verify the integrity of the received data, where the identity information includes the identity information of the previous level timestamp server and the identity information of the user applying for the timestamp;

[0023] The time value module is used to provide a time value as a timestamp for the timestamp server at this level; wherein, the time source receiving module is used to receive the time value issued by the National Time Service Center or to receive the time value issued by the upper-level timestamp server; the local time source module is used to record the local time value, and use the local time value as the time value issued to the next-level timestamp server; the time source calibration module is used to obtain the time value received by the time source receiving module and the local time value in the local time source module, and compare the received time value with the local time value, and calibrate the local time value according to the received time value;

[0024] The encryption module is used to encrypt the data sent out by the timestamp server;

[0025] The output module is used to output the encrypted ciphertext.

[0026] Furthermore, the specific process of sending the time value to the next level timestamp server is as follows:

[0027] (1) The N-level timestamp server requests its identity certificate from the N-th issuing center. In response to the request, the N-th issuing center issues and stores the public server certificate ID1-ser to the N-level timestamp server;

[0028] (2) The N-level timestamp server generates a serial number NO for the process of issuing the time value T1, and sends the serial number to the N-th issuing center to apply for the privacy server certificate ID2-ser required for the issuance process; the N-th issuing center generates and stores the privacy server certificate ID2-ser required for the N-level timestamp server to issue the time value T1 based on the serial number NO, and issues the privacy server certificate ID2-ser to the N-level timestamp server for storage;

[0029] (3) The N-level timestamp server generates a first transmission file based on the time value T1 to be sent and sends it to the N+1-level timestamp server; at the same time, the Nth issuing center uses the negotiated encryption key a1 to encrypt the privacy server certificate ID2-ser of the N-level timestamp server to obtain a first ciphertext, and associates the first ciphertext with the serial number NO and the public server certificate ID1-ser of the N-level timestamp server for storage, that is, stores (NO, ID1-ser, ID2-ser⊕a1), and uses the serial number NO and the public server certificate ID1-ser of the N-level timestamp server as the index of ID2-ser⊕a1;

[0030] (4) The N+1 level timestamp server verifies the integrity of the time value T1 in the received first transmission file and the legitimacy of the identity of the N level timestamp server. After the verification is passed, the N+1 level timestamp server receives the time value;

[0031] (5) The N+1 level timestamp server calibrates the local time value based on the received time value, and obtains an accurate local time value after the calibration operation.

[0032] Furthermore, the generation process of the privacy server certificate ID2-ser is as follows:

[0033] The Nth issuing center obtains a set of random numbers QRN locally, and concatenates the serial number NO, the public server certificate ID1-ser and the random number QRN to obtain the private server certificate ID2-ser = (NO, ID1-ser, QRN).

[0034] Furthermore, the specific process of the N-level timestamp server generating the first transmission file based on the time value T1 to be sent and sending it to the N+1-level timestamp server is as follows:

[0035] First, the N-level timestamp server negotiates with the N+1-level timestamp server the encryption key a1 used to encrypt the privacy server certificate ID2-ser during the issuance of the time value T1. The N-level timestamp server uses the encryption key a1 to encrypt the privacy server certificate ID2-ser, and then concatenates the second ciphertext ID2-ser⊕a1 with the time value T1 to be sent, and performs hash calculation on the concatenated file (ID2-ser⊕a1, T1) to obtain the first hash value h1.

[0036] The N-level timestamp server negotiates with the N+1-level timestamp server for the first transmission key k1, and uses the first transmission key k1 to encrypt the serial number NO of the time value T1 sending process, the first hash value h1, the character number str1 of the irreducible polynomial corresponding to the hash function used to generate the first hash value h1, the time value T1 to be sent, and the public server certificate ID1-ser of the N-level timestamp server to obtain the first transmission file, which is Then the first transmission file is sent to the N+1 level timestamp server.

[0037] Furthermore, the calculation process of the first hash value h1 is as follows: the N-level timestamp server obtains a set of keys w1 as random numbers from the local key pool to generate an irreducible polynomial p1(x). After obtaining the irreducible polynomial, the character string composed of the coefficients of each term except the highest term in the irreducible polynomial p1(x) is recorded as str1;

[0038] Then, the N-level timestamp server negotiates a set of keys (w2, w3) with the N+1-level timestamp server. The N-level timestamp server generates a hash function using the irreducible polynomial p1(x) and the key w2. Using hash functions Calculation File The hash value of the first hash value is obtained

[0039] Furthermore, the specific process of the N+1 level timestamp server verifying the integrity of the time value T1 in the received first transmission file and the legitimacy of the identity of the N level timestamp server is as follows:

[0040] 1) The N+1 level timestamp server uses the negotiated first transmission key k1 to Decrypt to obtain the decrypted serial number NO′, the second hash value h1′, the character string str1′, the time value T1′ to be sent, and the public server certificate ID1-ser′ of the N-level timestamp server;

[0041] 2) The N+1 level timestamp server transmits the decrypted serial number NO′ and the public server certificate ID1-ser′ of the N level timestamp server to the Nth issuing center. The Nth issuing center uses the serial number NO′ and the public server certificate ID1-ser′ of the N level timestamp server as indexes to index the ciphertext of the private server certificate ID2-ser of the N level timestamp server.

[0042] 3) The Nth issuing center negotiates with the N+1th level timestamp server for the second transmission key k2, and uses the second transmission key k2 to send the ciphertext Encrypt again Then Send to N+1 level timestamp server;

[0043] 4) The N+1 level timestamp server uses the second transmission key k2 to encrypt the ciphertext Decrypt to get The N+1 level timestamp server then uses the coefficients of each item of the polynomial except the highest item in each bit of the decrypted string str1′ to generate an irreducible polynomial p′1(x) with the highest item coefficient being 1, and generates a hash function based on the irreducible polynomial p′1(x) and the negotiated key w2 Using hash functions Calculate the decrypted ciphertext and the hash value of the time value T1′ to obtain the third hash value The third hash value h1″ obtained by calculation is compared with the second hash value h1′ obtained by decryption to see if they are consistent. If they are consistent, the verification is successful; if they are inconsistent, the verification fails, and the process returns to step (3) to re-issue the time value.

[0044] Furthermore, the specific process of the N+1 level timestamp server calibrating the local time value based on the received time value is as follows:

[0045] The N+1 level timestamp server uses the received time value T1′ as the standard time value, and then obtains the local time value T 本 , the received time value T1′ and the local time value T 本 Compare, if consistent, no calibration is required; if inconsistent, use time value T1′ to replace local time value T 本 , get the accurate local time value.

[0046] Beneficial effects of the present invention:

[0047] (1) In the timestamp issuance networking system proposed in the present invention, the issuance center at this level, the timestamp server at this level, and the user group within the jurisdiction of the timestamp at this level together constitute a timestamp service extension unit. With the extension unit as the smallest unit, convenient expansion of the network can be achieved. When a larger range or more users need to be served, the extension unit is connected to the timestamp server at the previous level to expand the timestamp service, thereby extending the service scope of the network, alleviating the service pressure of a timestamp server, and improving the response efficiency;

[0048] (2) In the process of issuing time values ​​to the next-level timestamp server in the timestamp issuance networking system proposed by the present invention, the circulation process of time values ​​in the timestamp servers at each level is quantum secure, and the keys used for encryption or decryption or calculation of hash values ​​in the transmission are all true quantum random numbers, which ensures the accuracy and non-tamperability of the time values ​​used to generate the timestamp, and improves the credibility of the timestamp;

[0049] (3) By introducing and calibrating the local time source module, the entire timestamp issuance networking system no longer needs to request a time value from the National Time Service Center for each timestamp request. The existence of the local time source module can directly process the generation and issuance of timestamps at this level based on the local time value within the time range of two time value calibrations, greatly alleviating the response pressure on the upper-level timestamp server and the National Time Service Center. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A connection diagram of the timestamp issuance networking system of the present invention;

[0051] Figure 2 It is a schematic diagram of the structure of the timestamp server of the present invention;

[0052] Figure 3 The present invention is a flow chart of sending time values ​​to a next-level timestamp server. DETAILED DESCRIPTION

[0053] The present invention will be further described below in conjunction with the accompanying drawings and embodiments:

[0054] As mentioned in the background technology, the National Time Service Center is undoubtedly the best trusted time source for timestamps, but its uniqueness also means that if it is used as the only time source, it will cause the server to bear a huge load pressure and easily fail to respond. Therefore, how to ensure the safe issuance of timestamps while alleviating the load pressure of a timestamp server has become a technical problem that the industry urgently needs to solve.

[0055] In view of this, the present application proposes a quantum-safe timestamp issuance networking system for issuing quantum-safe timestamps. Figure 1 The time stamp issuance networking system includes: a national time service center 1, a first issuance center 12, a first time stamp server 11, and a first group of users 13 under the jurisdiction of the first time stamp server 11, the first group of users 13 includes a first user 131, a second user 132, etc. Among them, the national time service center 1 is connected to the first time stamp server 11, and the first time stamp server 11, the first issuance center 12 and the first group of users 13 are connected in pairs;

[0056] The National Time Service Center 1 is used as a trusted time source for timestamps and is used to transmit time values ​​to the first-level timestamp server 11; the first issuance center 12 is used to issue server identity certificates to the first-level timestamp server 11 and user identity certificates to users who access the first-level timestamp server 11; the first-level timestamp server 11 is used to verify the user identity information of users who apply for timestamps in the first group of users 13 within the jurisdiction of the first-level timestamp server, and generate and issue timestamps, as well as provide time values ​​for the next-level timestamp server; the first group of users 13 is a collection of users within the jurisdiction of the first-level timestamp server 11. Each user requests a timestamp from the first-level timestamp server 11 according to its own needs, verifies the server identity information attached to the timestamp, and finally accepts the timestamp. It should be noted that the first-level timestamp server generates and issues timestamps for the files of users who have passed the user identity information verification.

[0057] The primary timestamp server 11 and the first issuing center 12 can also be connected to the primary timestamp service extension unit 2. The number of primary timestamp service extension units 2 can be multiple. Through the connection of the extension unit, the timestamp service can be expanded to extend the service scope of the network. The primary timestamp service extension unit 2 includes a second issuing center 22 connected in pairs, a secondary timestamp server 21, and a second group of users 23 within the jurisdiction of the secondary timestamp server 21. The second group of users 23 includes the Lth user 231, the L+1th user 232, etc.; wherein the secondary timestamp server 21 is connected to both the primary timestamp server 11 and the first issuing center 12;

[0058] The second issuing center 22 is used to issue server identity certificates for the secondary timestamp server 21 and user identity certificates for users accessing the secondary timestamp server 21; the secondary timestamp server 21 is used to verify the user identity information of users who apply for timestamps in the second group of users 23 under the jurisdiction of the current timestamp server, and to generate and issue timestamps, as well as provide time values ​​for the next-level timestamp server; the second group of users 23 is a collection of users under the jurisdiction of the secondary timestamp server 21. Each user requests a timestamp from the secondary timestamp server 21 according to its own needs, verifies the server identity information attached to the timestamp, and finally accepts the timestamp.

[0059] It can be understood that the secondary timestamp server 21 and the second issuance center 22 can also be connected to the secondary timestamp service extension unit, the secondary timestamp service extension unit includes a third issuance center connected in pairs, a third timestamp server, and a third group of users within the jurisdiction of the third timestamp server, and the third timestamp server is connected to both the secondary timestamp server 21 and the second issuance center 22; the third timestamp server and the third issuance center can also be connected to the third timestamp service extension unit, the third timestamp service extension unit includes a fourth issuance center connected in pairs, a fourth timestamp server, and a third group of users within the jurisdiction of the fourth timestamp server. For the fourth group of users within the jurisdiction of the timestamp server, the fourth-level timestamp server is connected to the third-level timestamp server and the third issuance center; by analogy, the N-1-level timestamp server and the N-1th issuance center can also be connected to the N-1-level timestamp service extension unit, and the N-1-level timestamp service extension unit includes the N-th issuance center, the N-level timestamp server, and the N-th group of users within the jurisdiction of the N-level timestamp server, and the N-level timestamp server is connected to the N-1-level timestamp server and the N-1th issuance center; by analogy, the service scope of the timestamp issuance networking system can be gradually expanded.

[0060] Among them, the Nth issuing center is used to issue server identity certificates for the N-level timestamp server and user identity certificates for users accessing the N-level timestamp server; the N-level timestamp server is used to verify the user identity information of users who apply for timestamps in the Nth group of users under the jurisdiction of the current-level timestamp server, and to generate and issue timestamps, as well as provide time values ​​for the next-level timestamp server; the Nth group of users is the collection of users under the jurisdiction of the N-level timestamp server. Users request timestamps from the N-level timestamp server according to their own needs, verify the server identity information attached to the timestamp, and finally accept the timestamp.

[0061] It can be seen that in the timestamp issuance networking system of the present invention, the issuance center at this level, the timestamp server at this level, and the user group within the jurisdiction of the timestamp at this level together constitute the timestamp service extension unit, and the extension unit is used as the smallest unit to realize convenient expansion of the network. When it is necessary to serve a larger range or more users, the extension unit is connected to the timestamp server at the previous level, and the timestamp service can be expanded to realize the extension of the service scope of the network, relieve the service pressure of a timestamp server, and improve the response efficiency.

[0062] like Figure 2 As described above, in the above-mentioned timestamp issuance networking system, the structures of the first-level timestamp server, the second-level timestamp server to the N-level timestamp server are the same, and all include an input module 211, a decryption module 212, an authentication module 216, an encryption module 214 and an output module 215 connected in sequence, and the authentication module 216 and the encryption module 214 are both connected to the time value module 213; wherein the time value module 213 includes a time source receiving module 2131, a time source calibration module 2132 and a local time source module 2133 connected in sequence, and the time source receiving module 2131 is connected to the authentication module 216, and the local time source module 2133 is connected to the encryption module 214;

[0063] Among them, the input module 211 is used to receive data from the outside world, and the data may specifically include the time value sent by the previous level timestamp server, etc.; since the data transmission outside the server involved in this application is all encrypted transmission, the decryption module 212 is used to decrypt the external encrypted data received via the input module 211; the authentication module 216 is used to authenticate the legitimacy of the identity information carried in the data and to verify the integrity of the received data, wherein the identity information includes the identity information of the previous level timestamp server and the identity information of the user applying for the timestamp; the time value module 213 is used as the time source module of the timestamp server at this level, and is used to provide the time value as a timestamp for the timestamp server at this level; wherein the time source receiving module 2131 is used to receive the time value issued by the national time service center 1 or to receive the time value issued by the previous level timestamp server. For the first level timestamp server 11, the time source receiving module 2131 is used to receive the time value issued by the national time service center 1, and for other timestamp servers, the time source receiving module 2131 is used for the time value issued by the previous level timestamp server. The local time source module 2133 is used to record the local time value, and use the local time value as the time value sent to the next-level timestamp server; the time source calibration module 2132 is used to obtain the time value received by the time source receiving module 2131 and the local time value in the local time source module 2133, and compare the received time value with the local time value, and calibrate the local time value according to the received time value; the encryption module 214 is used to encrypt the data sent out by the timestamp server; the output module 215 is used to output the encrypted ciphertext.

[0064] In order to ensure the accuracy of the timestamps generated by the timestamp servers at all levels in the above-mentioned timestamp issuance networking system, the safe and accurate transmission of time values ​​between the timestamp servers at all levels becomes a key factor; therefore, based on the above-mentioned timestamp issuance networking system and timestamp server, the present application also proposes a method for issuing time values ​​to the next-level timestamp server in the timestamp issuance networking system.

[0065] like Figure 3 As shown, in this embodiment, the process of sending the time value T1 from the primary time stamp server 11 to the secondary time stamp server 21 is taken as an example to illustrate the process of sending the time value T1 in the timestamp issuance networking system, which includes the following steps:

[0066] (1) The primary time stamp server 11 requests its identity certificate from the first issuing center 12. In response to the request, the first issuing center 12 issues and stores the public server certificate ID1-ser to the primary time stamp server 11;

[0067] (2) The primary timestamp server 11 generates a serial number NO for the process of issuing the time value T1, and sends the serial number to the first issuing center 12 to apply for the privacy server certificate ID2-ser required for the issuance process; the first issuing center 12 responds to the request, generates and stores the privacy server certificate ID2-ser required for the primary timestamp server 11 to issue the time value T1 based on the serial number NO, and issues the privacy server certificate ID2-ser to the primary timestamp server 11 for storage;

[0068] The generation process of the privacy server certificate ID2-ser is as follows: the first issuing center 12 obtains a set of random numbers QRN locally, concatenates the serial number NO, the public server certificate ID1-ser and the random number QRN to obtain the privacy server certificate ID2-ser = (NO, ID1-ser, QRN), where the random number QRN is, for example, a true random number.

[0069] (3) The primary timestamp server 11 generates a first transmission file based on the time value T1 to be sent and sends it to the secondary timestamp server 21. The specific process is as follows:

[0070] First, the primary timestamp server 11 and the secondary timestamp server 21 negotiate the encryption key a1 used to encrypt the privacy server certificate ID2-ser during the sending of the time value T1. The primary timestamp server 11 encrypts the privacy server certificate ID2-ser using the encryption key a1, and concatenates the second ciphertext ID2-ser⊕a1 with the time value T1 to be sent, and performs hash calculation on the concatenated file (ID2-ser⊕a1, T1) to obtain the first hash value h1;

[0071] The calculation process of the first hash value h1 is as follows: the primary timestamp server 11 obtains a set of keys w1 as random numbers from the local key pool, which are used to generate an irreducible polynomial p1(x). After obtaining the irreducible polynomial, the string consisting of the coefficients of each term except the highest term in the irreducible polynomial p1(x) is recorded as str1; then, the primary timestamp server 11 negotiates a set of keys (w2, w3) with the secondary timestamp server 21, and the primary timestamp server 11 generates a hash function h1 using the irreducible polynomial p1(x) and the key w2. p1,w2 , using the hash function h p1,w2 Calculate the hash value of the file (ID2-ser⊕a1,T1) and get the first hash value h1=h p1,w2 (ID2-ser⊕a1,T1).

[0072] Then, the serial number NO of the time value T1 sending process, the first hash value h1, the string str1 of the irreducible polynomial corresponding to the hash function used to generate the first hash value h1, the time value T1 to be sent, and the public server certificate ID1-ser of the first-level timestamp server 11 are encrypted as the first transmission file and sent to the second-level timestamp server 21. That is, the first-level timestamp server 11 negotiates the first transmission key k1 with the second-level timestamp server 21, and uses the first transmission key k1 to encrypt the serial number NO of the time value T1 sending process, the first hash value h1, the string str1 of the irreducible polynomial corresponding to the hash function used to generate the first hash value h1, the time value T1 to be sent, and the public server certificate ID1-ser of the first-level timestamp server 11 to obtain the first transmission file, which is [(NO, h1, str1, T1, ID1-ser) ⊕ k1], and then the first transmission file is sent to the second-level timestamp server 21;

[0073] At the same time, the first issuing center 12 also uses the negotiated encryption key a1 to encrypt the private server certificate ID2-ser of the primary timestamp server 11 to obtain a second ciphertext, and associates the second ciphertext with the serial number NO and the public server certificate ID1-ser of the primary timestamp server 11 for storage, that is, stores (NO, ID1-ser, ID2-ser⊕a1), and uses the serial number NO and the public server certificate ID1-ser of the primary timestamp server 11 as indexes of ID2-ser⊕a1;

[0074] The keys involved in encryption or decryption or calculation of hash values ​​are, for example, true random numbers, i.e., quantum random numbers, to ensure that the entire process is quantum secure.

[0075] (4) The secondary timestamp server 21 verifies the integrity of the time value T1 in the received first transmission file and the legitimacy of the identity of the primary timestamp server 11 to ensure that the time value T1 has not been tampered with during the transmission process. After the verification is passed, the secondary timestamp server 21 receives the time value. The specific process is as follows:

[0076] 1) The secondary timestamp server 21 uses the negotiated first transmission key k1 to decrypt the first transmission file [(NO, h1, str1, T1, ID1-ser) ⊕ k1], that is, the decryption module 212 decrypts the first transmission file to obtain the decrypted serial number NO′, the second hash value h1′, the string str1′, the time value T1′, and the public identity certificate ID1-ser′ of the primary timestamp server 11, and sends the decrypted serial number NO′, the second hash value h1′, the string str1′, the time value T1′, and the public identity certificate ID1-ser′ of the primary timestamp server 11 to the authentication module 216 of the secondary timestamp server 21;

[0077] 2) The secondary timestamp server 21 transmits the decrypted serial number NO′ and the public identity certificate ID1-ser′ of the primary timestamp server 11 to the first issuing center 12, and the first issuing center 12 uses the serial number NO′ and the public identity certificate ID1-ser′ of the primary timestamp server 11 as indexes to index the ciphertext ID2-ser⊕a1 of the privacy server certificate ID2-ser of the primary timestamp server 11; that is, the authentication module 216 of the secondary timestamp server 21 sends the decrypted serial number NO′ and the public identity certificate ID1-ser′ of the primary timestamp server 11 to the encryption module 214 for encryption, and then transmits the encrypted ciphertext to the first issuing center 12 via the output module 215, so as to use the serial number NO′ and the public identity certificate ID1-ser′ as indexes to request the ciphertext ID2-ser⊕a1 of the privacy server certificate ID2-ser of the primary timestamp server 11 involved in this timestamp issuance process from the first issuing center 12;

[0078] 3) The first issuing center 12 negotiates with the secondary timestamp server 21 the second transmission key k2, uses the second transmission key k2 to encrypt the ciphertext ID2-ser⊕a1 again to obtain ID2-ser⊕a1⊕k2, and then sends ID2-ser⊕a1⊕k2 to the secondary timestamp server 21, i.e., to the input module 211 of the secondary timestamp server 21;

[0079] 4) The secondary timestamp server 21 uses the second transmission key k2 to encrypt the ciphertext Decrypt it to get That is, the decryption module 212 decrypts the decrypted The authentication module 216 in the secondary timestamp server 21 then uses the coefficients of each item of the polynomial except the highest item of each bit of the decrypted string str1′ to generate an irreducible polynomial p′1(x) with the highest item coefficient of 1, and generates a hash function based on the irreducible polynomial p′1(x) and the negotiated key w2. Use this hash function Calculate the decrypted ciphertext and the hash value of the time value T1′ to obtain the third hash value The third hash value h1″ obtained by calculation is compared with the second hash value h1′ obtained by decryption to see if they are consistent. If they are consistent, the verification is successful, and the authentication module 216 sends the time value T1′ to the time source receiving module 2131. If they are inconsistent, the verification fails, which means that either the time value has been tampered with during the transmission process, or the identity authentication of the primary timestamp server 11 that sends the time value has failed. In either case, the secondary timestamp server 21 will not accept the time value T1′ and returns to step (3) to resend the time value.

[0080] In this process, since the transmission of the privacy server certificate ID2-ser of the primary timestamp server 11 between the first issuing center 12 and the secondary timestamp server 21 is transmitted and calculated in the form of ciphertext, there is no risk of the privacy server certificate of the primary timestamp server 11 being leaked to a third party in this process, thereby ensuring the privacy and security of the identity of the primary timestamp server 11 during the transmission process.

[0081] (5) The secondary time stamp server 21 calibrates the local time value based on the received time value. After the calibration operation, an accurate local time value is obtained. The specific process is as follows:

[0082] The secondary timestamp server 21 uses the received time value T1′ as the standard time value, and then obtains the local time value T 本 , the received time value T1′ and the local time value T 本 That is, the secondary timestamp server 21 takes the time value T1′ received by the time source receiving module 2131 as the standard time value, and then the time source calibration module 2132 obtains the time value T1′ and the local time value T from the time source receiving module 2131 and the local time source module 2133 respectively. 本 , compare the two values, if they are consistent, no calibration is required and no operation is performed; if they are inconsistent, the local time source module 2133 uses the standard time value T1′ to replace the local time value T 本, get the accurate local time value.

[0083] After the calibration operation, the time value in the local time source module 2133 is synchronized with the time value issued by the upper-level timestamp server. Through tracing, it can be ensured that the time value in the local time source module 2133 is consistent with the time value of the National Time Service Center, ensuring the accuracy of the time value used as a timestamp.

[0084] The purpose of introducing the local time source module 2133 here is that if each time a timestamp is generated, the national time service center is requested for standard time, then the load burden of the national time service center will still be caused. By introducing the local time source module, the timestamp servers at all levels only need to perform calibration operations regularly to make the time value in the local time source module 2133 consistent with the time value of the national time service center. In this way, the request for the timestamp between the last calibration time and the local calibration time can directly use the time value provided by the local time source module 2133, without having to request the national time service center every time. The deployment mode of the multi-level hierarchical timestamp server further alleviates the pressure of the calibration of the timestamp servers at all levels. Each level of the timestamp server only needs to calibrate with the time value issued by the previous level of the timestamp server, rather than directly calibrating with the time value of the national time service center.

Claims

1. A quantum secure timestamp issuance networking system, characterized in that: The system comprises: a national time service center, a first issuing center, a first time stamp server, and a first group of users within the jurisdiction of the first time stamp server, wherein the national time service center is connected to the first time stamp server, and the first time stamp server, the first issuing center and the first group of users are connected in pairs; The National Time Service Center is used to transmit time values ​​to the primary timestamp server; The first issuing center is used to issue a server identity certificate to the first-level timestamp server and to issue a user identity certificate to the user accessing the first-level timestamp server; The first-level timestamp server is used to verify the user identity information of the first group of users who apply for timestamps within the jurisdiction of the first-level timestamp server, generate and issue timestamps, and issue time values ​​to the next-level timestamp server; The first group of users is a collection of users under the jurisdiction of the first-level timestamp server. Users request timestamps from the first-level timestamp server according to their own needs, verify the server identity information attached to the timestamp, and finally accept the timestamp.

2. A quantum secure timestamp issuance networking system according to claim 1, characterized in that: The primary time stamp server and the first issuing center are also connected to a primary time stamp service extension unit, the primary time stamp service extension unit includes a second issuing center, a secondary time stamp server, and a second group of users within the jurisdiction of the secondary time stamp server, which are connected in pairs, and the secondary time stamp server is connected to both the primary time stamp server and the first issuing center; The second issuing center is used to issue a server identity certificate for the secondary timestamp server and a user identity certificate for the user accessing the secondary timestamp server; The secondary timestamp server is used to verify the user identity information of the second group of users who apply for timestamps within the jurisdiction of the timestamp server at this level, generate and issue timestamps, and send time values ​​to the next level timestamp server; The second group of users is a collection of users under the jurisdiction of the secondary timestamp server. Users request timestamps from the secondary timestamp server according to their own needs, verify the server identity information attached to the timestamp, and finally accept the timestamp.

3. A quantum secure timestamp issuance networking system according to claim 2, characterized in that: The secondary timestamp server and the second issuance center are also connected to the secondary timestamp service extension unit, and the secondary timestamp service extension unit includes a third issuance center connected in pairs, a third timestamp server, and a third group of users within the jurisdiction of the third timestamp server, and the third time stamp server is connected to both the secondary timestamp server and the second issuance center; by analogy, the N-1-level timestamp server and the N-1-th issuance center are also connected to the N-1-level timestamp service extension unit, and the N-1-level timestamp service extension unit includes an N-th issuance center connected in pairs, an N-level timestamp server, and an N-th group of users within the jurisdiction of the N-level timestamp server, and the N-level timestamp server is connected to both the N-1-level timestamp server and the N-1-th issuance center; The Nth issuing center is used to issue server identity certificates for the N-level timestamp server and to issue user identity certificates for users accessing the N-level timestamp server; The N-level timestamp server is used to verify the user identity information of the Nth group of users who apply for timestamps within the jurisdiction of the timestamp server at this level, generate and issue timestamps, and send time values ​​to the next-level timestamp server; The Nth group of users is a collection of users under the jurisdiction of the N-level timestamp server. Users request timestamps from the N-level timestamp server according to their own needs, verify the server identity information attached to the timestamp, and finally accept the timestamp.

4. A quantum secure timestamp issuance networking system according to claim 3, characterized in that: The first-level timestamp server, the second-level timestamp server to the N-level timestamp server all include an input module, a decryption module, an authentication module, an encryption module and an output module connected in sequence, and the authentication module and the encryption module are both connected to the time value module; the time value module includes a time source receiving module, a time source calibration module and a local time source module connected in sequence, the time source receiving module is connected to the authentication module, and the local time source module is connected to the encryption module; The input module is used to receive data from the outside world; The decryption module is used to decrypt the external ciphertext data received via the input module; The authentication module is used to authenticate the legitimacy of the identity information in the data and verify the integrity of the received data, where the identity information includes the identity information of the previous level timestamp server and the identity information of the user applying for the timestamp; The time value module is used to provide a time value as a timestamp for the timestamp server at this level; wherein, the time source receiving module is used to receive the time value issued by the National Time Service Center or to receive the time value issued by the upper-level timestamp server; the local time source module is used to record the local time value, and use the local time value as the time value issued to the next-level timestamp server; the time source calibration module is used to obtain the time value received by the time source receiving module and the local time value in the local time source module, and compare the received time value with the local time value, and calibrate the local time value according to the received time value; The encryption module is used to encrypt the data sent out by the timestamp server; The output module is used to output the encrypted ciphertext.

5. A quantum secure timestamp issuance networking system according to claim 3, characterized in that: The specific process of sending the time value to the next-level timestamp server is as follows: (1) The N-level timestamp server requests its identity certificate from the N-th issuing center. In response to the request, the N-th issuing center issues and stores the public server certificate ID1-ser to the N-level timestamp server; (2) The N-level timestamp server generates a serial number NO for the process of issuing the time value T1, and sends the serial number to the N-th issuing center to apply for the privacy server certificate ID2-ser required for the issuance process; the N-th issuing center generates and stores the privacy server certificate ID2-ser required for the N-level timestamp server to issue the time value T1 based on the serial number NO, and issues the privacy server certificate ID2-ser to the N-level timestamp server for storage; (3) The N-level timestamp server generates a first transmission file based on the time value T1 to be sent and sends it to the N+1-level timestamp server; at the same time, the Nth issuing center uses the negotiated encryption key a1 to encrypt the privacy server certificate ID2-ser of the N-level timestamp server to obtain a first ciphertext, and associates the first ciphertext with the serial number NO and the public server certificate ID1-ser of the N-level timestamp server for storage, that is, stores (NO, ID1-ser, ID2-ser⊕a1), and uses the serial number NO and the public server certificate ID1-ser of the N-level timestamp server as the index of ID2-ser⊕a1; (4) The N+1 level timestamp server verifies the integrity of the time value T1 in the received first transmission file and the legitimacy of the identity of the N level timestamp server. After the verification is passed, the N+1 level timestamp server receives the time value; (5) The N+1 level timestamp server calibrates the local time value based on the received time value, and obtains an accurate local time value after the calibration operation.

6. A quantum secure timestamp issuance networking system according to claim 5, characterized in that: The generation process of the privacy server certificate ID2-ser is as follows: The Nth issuing center obtains a set of random numbers QRN locally, and concatenates the serial number NO, the public server certificate ID1-ser and the random number QRN to obtain the private server certificate ID2-ser = (NO, ID1-ser, QRN).

7. A quantum secure timestamp issuance networking system according to claim 5, characterized in that: The specific process of the N-level timestamp server generating the first transmission file based on the time value T1 to be sent and sending it to the N+1-level timestamp server is as follows: First, the N-level timestamp server negotiates with the N+1-level timestamp server the encryption key a1 used to encrypt the privacy server certificate ID2-ser during the issuance of the time value T1. The N-level timestamp server uses the encryption key a1 to encrypt the privacy server certificate ID2-ser, and then concatenates the second ciphertext ID2-ser⊕a1 with the time value T1 to be sent, and performs hash calculation on the concatenated file (ID2-ser⊕a1, T1) to obtain the first hash value h1. The N-level timestamp server negotiates with the N+1-level timestamp server on the first transmission key k1, and uses the first transmission key k1 to encrypt the serial number NO of the time value T1 issuance process, the first hash value h1, the character symbol str1 of the irreducible polynomial corresponding to the hash function used to generate the first hash value h1, the time value T1 to be sent, and the public server certificate ID1-ser of the N-level timestamp server to obtain the first transmission file, which is [(NO, h1, str1, T1, ID1-ser) ⊕ k1], and then sends the first transmission file to the N+1-level timestamp server.

8. A quantum secure timestamp issuance networking system according to claim 7, characterized in that: The calculation process of the first hash value h1 is as follows: the N-level timestamp server obtains a set of keys w1 as random numbers from the local key pool to generate an irreducible polynomial p1(x). After obtaining the irreducible polynomial, the character string composed of the coefficients of each term except the highest term in the irreducible polynomial p1(x) is recorded as str1; Then, the N-level timestamp server negotiates a set of keys (w2, w3) with the N+1-level timestamp server. The N-level timestamp server uses the irreducible polynomial p1(x) and the key w2 to generate the hash function h p1,w2 , using the hash function h p1,w2 Calculate the hash value of the file (ID2-ser⊕a1,T1) and get the first hash value h1=h p1,w2 (ID2-ser⊕a1,T1).

9. A quantum secure timestamp issuance networking system according to claim 7, characterized in that: The specific process of the N+1 level timestamp server verifying the integrity of the time value T1 in the received first transmission file and the legitimacy of the identity of the N level timestamp server is: 1) The N+1 level timestamp server uses the negotiated first transmission key k1 to decrypt the first transmission file [(NO, h1, str1, T1, ID1-ser) ⊕ k1] to obtain the decrypted serial number NO′, the second hash value h1′, the string str1′, the time value T1′ to be sent, and the public server certificate ID1-ser′ of the N level timestamp server; 2) The N+1 level timestamp server transmits the decrypted serial number NO′ and the public server certificate ID1-ser′ of the N level timestamp server to the Nth issuing center. The Nth issuing center uses the serial number NO′ and the public server certificate ID1-ser′ of the N level timestamp server as indexes to index the ciphertext ID2-ser⊕a1 of the private server certificate ID2-ser of the N level timestamp server; 3) The Nth issuing center negotiates the second transmission key k2 with the N+1 level timestamp server, uses the second transmission key k2 to encrypt the ciphertext ID2-ser⊕a1 again to obtain ID2-ser⊕a1⊕k2, and then sends ID2-ser⊕a1⊕k2 to the N+1 level timestamp server; 4) The N+1 level timestamp server uses the second transmission key k2 to decrypt the ciphertext ID2-ser⊕a1⊕k2 to obtain ID2-ser′⊕a1; The N+1 level timestamp server then uses the coefficients of each item of the polynomial except the highest item in each bit of the decrypted string str1′ to generate an irreducible polynomial p′1(x) with the highest item coefficient being 1. Based on the irreducible polynomial p′1(x) and the negotiated key w2, the hash function h′ is generated. p1,w2 , using the hash function h′ p1,w2 Calculate the hash value of the decrypted ciphertext ID2-ser′⊕a1 and the time value T1′ to obtain the third hash value h1″=h′ p1,w2 (ID2-ser′⊕a1,T1′); compare the calculated third hash value h1″ with the decrypted second hash value h1′ to see if they are consistent. If they are consistent, the verification is successful; if they are inconsistent, the verification fails and returns to step (3) to re-issue the time value.

10. A quantum secure timestamp issuance networking system according to claim 9, characterized in that: The specific process of the N+1 level timestamp server calibrating the local time value based on the received time value is as follows: The N+1 level timestamp server uses the received time value T1′ as the standard time value, and then obtains the local time value T 本 , the received time value T1′ and the local time value T 本 Compare, if consistent, no calibration is required; if inconsistent, use time value T1′ to replace local time value T 本 , get the accurate local time value.

Images