Post quantum cryptography migration method and device, related equipment, storage medium and computer program product

Abstract

The invention discloses a post quantum cryptography migration method and device, related equipment, a storage medium and a computer program product, and the method comprises the steps: transmitting first information to first equipment; the first information represents information of a post quantum cryptography algorithm and is used for post quantum cryptography migration.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a post-quantum cryptographic migration method, apparatus, related equipment, storage medium and computer program product. Background Art

[0002] At present, the post-quantum cryptographic migration plan mainly involves equipment replacement, while gradually upgrading the deployed equipment equipped with the original classical cryptographic algorithms offline or online. Among them, the equipment replacement method requires a large investment and affects the normal operation of the service business system. Offline or online upgrades of deployed equipment also have problems such as large workload, low security and poor operability, and it is impossible to flexibly adjust the cryptographic algorithm support capabilities of the cryptographic equipment. Summary of the invention

[0003] To solve the related technical problems, the embodiments of the present application provide a post-quantum cryptographic migration method, apparatus, related equipment, storage medium and computer program product.

[0004] The technical solution of the embodiment of the present application is implemented as follows:

[0005] The present application embodiment provides a post-quantum cryptographic migration method, which is applied to a cryptographic service platform, and the method includes:

[0006] Sending first information to a first device; the first information represents information of a post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration.

[0007] In the above scheme, the method further includes:

[0008] receiving second information sent by the first device, wherein the second information indicates success or failure of post-quantum cryptography migration;

[0009] When the second information indicates that the post-quantum cryptography migration is successful, the status information of the first device is updated; the updated status information of the first device indicates that the post-quantum cryptography migration has been completed.

[0010] In the above solution, when the first device supports the cryptographic algorithm update capability, before sending the first information to the first device, the method further includes:

[0011] receiving third information sent by the first device, wherein the third information represents an application for a cryptographic service; and / or

[0012] A first request is sent to the first device, and a first response returned by the first device is received; wherein the first request is used to request an update of a cryptographic algorithm; and the first response indicates agreement to update the cryptographic algorithm.

[0013] In the above solution, the sending the first information to the first device includes:

[0014] Querying status information of the first device, where the status information represents a migration state of post-quantum cryptography;

[0015] When the status information of the first device indicates that the post-quantum cryptography migration is not completed, first information is sent to the first device.

[0016] In the above solution, when the first device does not support cryptographic algorithm update capability or does not support post-quantum cryptographic algorithm, before sending the first information to the first device, the method further includes:

[0017] receiving a second request sent by the first device; the second request is used to request a post-quantum cryptographic algorithm proxy service;

[0018] Based on the second request, perform post-quantum cryptography algorithm proxy service negotiation with the first device;

[0019] Establish a first proxy identity; the first proxy identity represents that the cryptographic service platform acts as an agent for the first device to complete the post-quantum cryptographic protocol interaction with the second device, and the second device is a device that supports the post-quantum cryptographic algorithm.

[0020] In the above solution, before sending the first information to the first device, the method further includes one or more of the following:

[0021] receiving a fourth request sent by the first device, where the fourth request is used to request an update of a cryptographic algorithm;

[0022] Sending fourth information to the first device, where the fourth information represents information generated by the first device executing a post-quantum cryptographic protocol process with the second device as the first proxy;

[0023] The fourth information is deleted.

[0024] In the above solution, after sending the first information to the first device, the method further includes:

[0025] receiving fifth information sent by the first device, wherein the fifth information represents an application for a cryptographic service;

[0026] When the first device has completed post-quantum cryptography migration and the status information of the first device indicates that the quantum cryptography migration has been completed, destroying the first proxy identity; or

[0027] When the first device has completed post-quantum cryptography migration and the state information of the first device indicates that post-quantum cryptography migration has not been completed, the state information of the first device is updated to indicate that post-quantum cryptography migration has been completed.

[0028] In the above solution, the sending the first request to the first device includes:

[0029] When the first device has not completed the post-quantum cryptography migration, or the state information of the first device indicates that the post-quantum cryptography migration has not been completed, a first request is sent to the first device.

[0030] The embodiment of the present application also provides a post-quantum cryptographic migration method, which is applied to a first device, and the method includes:

[0031] Receiving first information sent by a cryptographic service platform; the first information represents information of a post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration;

[0032] Post-quantum cryptographic migration is performed based on the first information.

[0033] In the above solution, the post-quantum cryptographic migration based on the first information includes one or more of the following:

[0034] Performing integrity check on the first information;

[0035] Based on the first information, updating the cryptographic algorithm of the first device to a post-quantum cryptographic algorithm;

[0036] Data to verify the updated cryptographic algorithm.

[0037] In the above scheme, the method further includes:

[0038] Sending second information to the cryptographic service platform, wherein the second information indicates whether the post-quantum cryptographic migration is successful or failed.

[0039] In the above solution, when the first device supports the cryptographic algorithm update capability, before receiving the first information sent by the cryptographic service platform, the method further includes one or more of the following:

[0040] Sending third information to the cryptographic service platform, wherein the third information represents an application for cryptographic services;

[0041] Receiving a first request sent by the cryptographic service platform, where the first request is used to request an update of a cryptographic algorithm;

[0042] A first response is returned to the cryptographic service platform, where the first response indicates agreement to update the cryptographic algorithm.

[0043] In the above solution, when the first device does not support the cryptographic algorithm update capability or does not support the post-quantum cryptographic algorithm, before receiving the first information sent by the cryptographic service platform, the method further includes:

[0044] Sending a second request to the cryptographic service platform; the second request is used to request a post-quantum cryptographic algorithm proxy service; and / or

[0045] Conduct post-quantum cryptographic algorithm proxy service negotiation with the cryptographic service platform.

[0046] In the above solution, before receiving the first information sent by the cryptographic service platform, the method further includes:

[0047] Sending a fourth request to the cryptographic service platform, wherein the fourth request is used to request an update of the cryptographic algorithm; and / or

[0048] Receive fourth information sent by the cryptographic service platform, where the fourth information represents information generated by the first device executing a post-quantum cryptographic protocol process with the second device as the first proxy.

[0049] In the above solution, after receiving the first information sent by the cryptographic service platform, the method further includes:

[0050] Send fifth information to the cryptographic service platform, wherein the fifth information represents an application for cryptographic service.

[0051] In the above solution, the sending of the third information to the cryptographic service platform includes:

[0052] Sending third information to the cryptographic service platform when one or more of the following is performed:

[0053] Device authentication;

[0054] Key update;

[0055] Certificate renewal;

[0056] Start-up report;

[0057] Shutdown report.

[0058] The embodiment of the present application also provides a post-quantum cryptographic migration device, including:

[0059] The first sending unit is used to send first information to the first device; the first information represents information of the post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration.

[0060] The embodiment of the present application also provides a post-quantum cryptographic migration device, including:

[0061] A first receiving unit is used to receive first information sent by a cryptographic service platform; the first information represents information of a post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration;

[0062] A migration unit is used to perform post-quantum cryptography migration based on the first information.

[0063] The embodiment of the present application also provides a cryptographic service platform, including: a first processor and a first communication interface; wherein,

[0064] The first communication interface is used to send first information to the first device; the first information represents information of a post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration.

[0065] The embodiment of the present application further provides a first device, comprising: a second processor and a second communication interface; wherein,

[0066] The second communication interface is used to receive first information sent by the cryptographic service platform; the first information represents information of the post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration;

[0067] The second processor is used to perform post-quantum cryptographic migration based on the first information.

[0068] The embodiment of the present application further provides an electronic device, the electronic device comprising a cryptographic service platform or a first device, the electronic device comprising a processor and a memory for storing a computer program that can be run on the processor,

[0069] In which, when the processor is used to run the computer program, it executes the steps of any method on the above-mentioned cryptographic service platform side, or executes the steps of any method on the above-mentioned first device side.

[0070] An embodiment of the present application also provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the computer program implements the steps of any method on the cryptographic service platform side, or implements the steps of any method on the first device side.

[0071] An embodiment of the present application also provides a computer program product, including a computer program, which implements the steps of any of the above methods when executed by a processor.

[0072] In the post-quantum cryptographic migration method, apparatus, related equipment, storage medium and computer program product provided in the embodiments of the present application, the cryptographic service platform sends a first message to the first device; the first device receives the first message sent by the cryptographic service platform; post-quantum cryptographic migration is performed based on the first message; the first message represents information of the post-quantum cryptographic algorithm, which is used for post-quantum cryptographic migration. In the above scheme, the cryptographic service platform, as a provider of post-quantum cryptographic algorithms, performs post-quantum cryptographic migration on the first device in the service system, which is not limited to the business scenarios of blockchain and has stronger applicability; and compared with the method of equipment replacement, it does not require large-scale replacement of equipment, has low cost and strong feasibility; compared with the offline or online upgrade method, the cryptographic service platform automatically performs post-quantum cryptographic migration or post-quantum cryptographic algorithm update, and the implementation workload is small, thereby further enhancing feasibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 A schematic diagram of a post-quantum cryptographic migration method according to an embodiment of the present application;

[0074] Figure 2 A schematic diagram of a post-quantum cryptographic migration method according to an embodiment of the present application;

[0075] Figure 3 A schematic diagram of a post-quantum cryptographic migration method according to an embodiment of the present application;

[0076] Figure 4 A schematic diagram of a post-quantum cryptographic migration method according to an embodiment of the present application;

[0077] Figure 5 This is a schematic diagram of the structure of a post-quantum cryptographic migration device according to an embodiment of the present application;

[0078] Figure 6 This is a schematic diagram of the structure of a post-quantum cryptographic migration device according to an embodiment of the present application;

[0079] Figure 7 This is a schematic diagram of the cryptographic service platform structure of the embodiment of the present application;

[0080] Figure 8 This is a schematic diagram of the first device structure of an embodiment of the present application. DETAILED DESCRIPTION

[0081] Post-quantum cryptographic migration refers to the process of migrating existing cryptographic systems from traditional public key cryptographic systems to post-quantum cryptographic systems, thereby ensuring that future networks and information systems can resist the threat of quantum computing and ensure network and information security. At present, the time when quantum computers that can break the currently used cryptographic algorithms will appear is still unknown. Therefore, post-quantum cryptographic migration is still in the planning and research stage, and there is no clear migration plan; among them, the most clearly planned migration schedule is the "Commercial National Security Algorithm Suite 2.0" released by the National Security Agency (NSA), and it is expected that the US government will complete the post-quantum migration in information systems by 2033.

[0082] Considering the complexity and stability of post-quantum cryptographic algorithms, most of the current post-quantum cryptographic migrations tend to adopt a hybrid mode for transition rather than a direct replacement mode, that is, to support both classical cryptographic algorithms and post-quantum cryptographic algorithms within a certain period of time; specifically, by using post-quantum cryptographic algorithms for newly deployed devices and the original classical cryptographic algorithms for deployed devices, two cryptographic systems are used in parallel in one system, and the transition is carried out in a hybrid mode. At the same time, the proportion of devices supporting post-quantum cryptographic algorithms is increased through the gradual elimination and offline of deployed devices, or the online upgrade of deployed devices, thereby completing the post-quantum cryptographic migration. For example, in the blockchain business scenario, there is a post-quantum cryptographic migration solution for the consistency of account status during the migration process, which achieves the purpose of account migration that takes into account both security and efficiency, but this solution is only applicable to blockchain business scenarios.

[0083] Although the most direct and thorough way to achieve post-quantum cryptographic migration is to directly replace equipment, it also requires a large investment and affects the normal operation of the service system. The gradual elimination and offline of deployed equipment, or the online upgrade of deployed equipment, also involve a large workload and affect the normal operation of the service business system. Both methods have the problem of low security due to the hybrid mode, as well as poor operability, i.e., the cryptographic algorithm support capabilities of the cryptographic equipment cannot be flexibly adjusted.

[0084] Based on this, in each embodiment of the present application, the cryptographic service platform sends a first message to the first device; the first device receives the first message sent by the cryptographic service platform; post-quantum cryptographic migration is performed based on the first message; the first message represents information about the post-quantum cryptographic algorithm, which is used for post-quantum cryptographic migration. In the above scheme, the cryptographic service platform, as a provider of post-quantum cryptographic algorithms, performs post-quantum cryptographic migration on the first device in the service system, which is not limited to the business scenarios of blockchain and has stronger applicability; and compared with the method of equipment replacement, it does not require large-scale replacement of equipment, has low cost and strong feasibility; compared with the offline or online upgrade method, the cryptographic service platform automatically performs post-quantum cryptographic migration or post-quantum cryptographic algorithm updates, and the implementation workload is small, thereby further enhancing feasibility.

[0085] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0086] The present application embodiment provides a post-quantum cryptographic migration method, which is applied to a cryptographic service platform. The cryptographic service platform can perform cryptographic device resource management, cryptographic service management, and application key management, such as Figure 1 As shown, the method includes:

[0087] Step 101: Send first information to a first device.

[0088] The first information represents information of a post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration.

[0089] Here, the cryptographic service platform can actively send the first information to the first device it manages so that the first device it manages completes the post-quantum cryptographic migration; specifically, the first information can be sent to the first device it manages when there is no other process on the first device it manages; or the first information can be sent to the first device when the cryptographic protocol interaction message or information sent by the cryptographic device is received, so as to avoid the post-quantum cryptographic migration from affecting the normal operation of the business; the cryptographic service platform can manage one or more first devices; the first device can be understood as a cryptographic device; the post-quantum cryptographic algorithm can correspond to the classical cryptographic algorithm, for example, the post-quantum cryptographic algorithm can include an asymmetric cryptographic algorithm and a symmetric cryptographic algorithm.

[0090] It should be noted that the post-quantum cryptographic migration process can be triggered or started by the cryptographic service platform or by the first device. When the cryptographic service platform triggers or starts the post-quantum cryptographic migration process, it supports actively triggering the first device to update the cryptographic algorithm to the post-quantum cryptographic algorithm, which has a small implementation workload and strong feasibility.

[0091] In order to save the signaling overhead or transmission resources of the cryptographic service platform and avoid the cryptographic service platform triggering the first device that has completed the post-quantum cryptographic migration to perform the post-quantum cryptographic migration again, in one embodiment, the method further includes:

[0092] receiving second information sent by the first device, wherein the second information indicates success or failure of post-quantum cryptography migration;

[0093] When the second information indicates that the post-quantum cryptography migration is successful, the status information of the first device is updated; the updated status information of the first device indicates that the post-quantum cryptography migration has been completed.

[0094] Here, the second information can be understood as the cryptographic algorithm update result or the post-quantum cryptographic algorithm update result of the first device; the status information of all first devices managed by the cryptographic service platform can default indicate that the first device has not completed post-quantum cryptographic migration or the cryptographic algorithm of the first device has not been successfully updated to the post-quantum cryptographic algorithm; the cryptographic algorithm update can be understood as the post-quantum cryptographic algorithm update.

[0095] For example, a state library is set in the cryptographic service platform, which can also be called a migration state library, a post-quantum cryptographic migration state library or a post-quantum cryptographic migration state database; the state library can store the state information of all first devices managed by the cryptographic service platform; updating the state information of the first device can be understood as updating the state information of the first device in the state library.

[0096] It should be noted that when the second information indicates that the post-quantum cryptographic migration is successful and the status information of the first device is updated, the cryptographic service platform and the first device still need to perform a key update process to synchronize the key of the post-quantum cryptographic algorithm to the first device; the status information of the first device can also be stored on other devices other than the cryptographic service platform.

[0097] In order to prevent the post-quantum cryptographic migration from affecting the service operation of the first device, in one embodiment, when the first device supports the cryptographic algorithm update capability, before sending the first information to the first device, the method further includes:

[0098] receiving third information sent by the first device, wherein the third information represents an application for a cryptographic service; and / or

[0099] A first request is sent to the first device, and a first response returned by the first device is received; wherein the first request is used to request an update of a cryptographic algorithm; and the first response indicates agreement to update the cryptographic algorithm.

[0100] Here, in the case of receiving the third information sent by the first device, the post-quantum cryptographic migration is triggered, and the first information is sent to the first device. Alternatively, in the case of receiving the third information sent by the first device, the post-quantum cryptographic migration is triggered, a first request is sent to the first device, and a first response returned by the first device is received, so as to determine whether the current state of the first device supports the cryptographic algorithm update based on the first response; if the first device supports the cryptographic algorithm update, the first information is sent to the first device. The cryptographic service platform may also directly send the first request to the first device if it confirms that there are no other processes on the first device; the cryptographic algorithm update capability can be understood as the post-quantum cryptographic algorithm update capability.

[0101] In order to prevent the cryptographic service platform from triggering the first device that has completed post-quantum cryptographic migration to perform post-quantum cryptographic migration again, and to avoid omitting the first device that has not completed quantum cryptographic migration, in one embodiment, sending the first information to the first device includes:

[0102] Querying status information of the first device, where the status information represents a migration state of post-quantum cryptography;

[0103] When the status information of the first device indicates that the post-quantum cryptography migration is not completed, first information is sent to the first device.

[0104] Here, when the third information sent by the first device is received, the status information of the first device can be queried, and when the status information of the first device indicates that the post-quantum cryptographic migration has not been completed, the first information can be sent to the first device; it can also be periodically or regularly queried The status information of all first devices is sent to each first device whose status information indicates that the post-quantum cryptographic migration has not been completed. The query of the status information of the first device can be performed when executing other cryptographic algorithm-related services.

[0105] It should be noted that, after querying the status information of the first device and before sending the first information to the first device, a first request may be sent to the first device to receive a first response returned by the first device.

[0106] In one embodiment, sending the first request to the first device includes:

[0107] When the first device has not completed the post-quantum cryptography migration, or the state information of the first device indicates that the post-quantum cryptography migration has not been completed, a first request is sent to the first device.

[0108] Here, when the first device has not completed the post-quantum cryptography migration, or the status information of the first device indicates that the post-quantum cryptography migration has not been completed, the first request can be sent to the first device to avoid sending the first request to the first device that has completed the post-quantum cryptography migration, thereby saving signaling overhead.

[0109] In order to support compatible services during the transition from classical cryptographic algorithms to post-quantum cryptographic algorithms, when the first device does not support cryptographic algorithm update capability or does not support post-quantum cryptographic algorithms, before sending the first information to the first device, the method further includes:

[0110] receiving a second request sent by the first device; the second request is used to request a post-quantum cryptographic algorithm proxy service;

[0111] Based on the second request, perform post-quantum cryptography algorithm proxy service negotiation with the first device;

[0112] Establish a first proxy identity; the first proxy identity represents that the cryptographic service platform acts as an agent for the first device to complete the post-quantum cryptographic protocol interaction with the second device, and the second device is a device that supports the post-quantum cryptographic algorithm.

[0113] Here, it can be determined whether the first device supports the cryptographic algorithm update capability according to the first device's own properties and / or current working state; specifically, a first request can be sent to the first device, and a response returned by the first device can be received, and based on the first response, it can be determined whether the first device's own properties and / or current working state support the post-quantum cryptographic algorithm update. The first device may not support the post-quantum cryptographic algorithm due to a poor network state, resulting in the first device failing to successfully receive the first information, or failing to trigger the post-quantum cryptographic migration process, resulting in the first device failing to complete the post-quantum cryptographic migration.

[0114] Since the first device does not support the cryptographic algorithm update capability or does not support the post-quantum cryptographic algorithm, before sending the first information to the first device to trigger the first device to perform the post-quantum cryptographic algorithm update, in order not to affect the normal operation of the first device, the cryptographic service platform needs to support the first device to perform a transition plan for the post-quantum cryptographic algorithm update.

[0115] Specifically, for the first device (cryptographic device) that only supports a single cryptographic algorithm, the cryptographic service platform receives a second request from the first device, performs a post-quantum cryptographic algorithm proxy service negotiation with the first device based on the second request, establishes a first proxy identity, and uses the proxy to perform post-quantum cryptographic protocol interaction with the second device that supports the post-quantum cryptographic algorithm by proxy to proxy the first device that does not support the cryptographic algorithm update capability or does not support the post-quantum cryptographic algorithm; the post-quantum cryptographic algorithm proxy service negotiation includes identity authentication and protocol data synchronization.

[0116] For the first device (cryptographic device) that supports multiple cryptographic algorithms at the same time, when performing cryptographic protocol interaction, the cryptographic algorithm supported by both parties can be used for cryptographic protocol interaction by adding an algorithm identification field in the protocol data.

[0117] Through the first agent identity, post-quantum cryptographic algorithms can be supported in the entire main business process, making the main business process more secure, reducing the differences caused by hybrid modes, improving business consistency, and providing a better service experience.

[0118] In the case where the first device does not support the cryptographic algorithm update capability or does not support the post-quantum cryptographic algorithm, in order to enable the first device to implement post-quantum cryptographic migration, in one embodiment, before sending the first information to the first device, the method further includes one or more of the following:

[0119] receiving a fourth request sent by the first device, where the fourth request is used to request an update of a cryptographic algorithm;

[0120] Sending fourth information to the first device, where the fourth information represents information generated by the first device executing a post-quantum cryptographic protocol process with the second device as the first proxy;

[0121] The fourth information is deleted.

[0122] Here, the cryptographic service platform can use the first proxy identity to proxy the first device to complete the post-quantum cryptographic protocol interaction with the second device, and then send the fourth information to the first device, and after sending the fourth information to the first device, directly send the first information to the first device; it can also receive the fourth request sent by the first device after sending the fourth information to the first device, and send the first information to the first device upon receiving the fourth request sent by the first device; optionally, after sending the fourth information to the first device, the fourth information can also be deleted to save storage resources.

[0123] In order to facilitate the cryptographic service platform and other cryptographic devices to perform the post-quantum cryptographic migration process, after the cryptographic service platform acts as an agent for the first device and the second device to perform the post-quantum cryptographic protocol process, and after the first device completes the post-quantum cryptographic migration, the cryptographic service platform can destroy the proxy identity. Based on this, in one embodiment, after sending the first information to the first device, the method further includes:

[0124] receiving fifth information sent by the first device, wherein the fifth information represents an application for a cryptographic service;

[0125] When the first device has completed post-quantum cryptography migration and the status information of the first device indicates that the quantum cryptography migration has been completed, destroying the first proxy identity; or

[0126] When the first device has completed post-quantum cryptography migration and the state information of the first device indicates that post-quantum cryptography migration has not been completed, the state information of the first device is updated to indicate that post-quantum cryptography migration has been completed.

[0127] Here, after sending the first information to the first device, in the case of receiving the fifth information sent by the first device, the migration state of the post-quantum cryptography of the first device is detected; specifically, the state information of the first device is queried; when the first device has completed the post-quantum cryptography migration, and the state information of the first device indicates that the post-quantum cryptography migration has been completed, that is, when the actual migration state of the first device is consistent with the recorded state information, it means that the first device has completed the post-quantum cryptography migration, and the stored state information has been updated, and there is no need to continue to act as an agent for the first device to perform post-quantum cryptography protocol interaction, and the first device can support the post-quantum cryptography algorithm; when the first device has completed the post-quantum cryptography migration, and the state information of the first device indicates that the quantum cryptography migration has not been completed, that is, when the actual migration state of the first device is inconsistent with the recorded state information, it may be that an exception occurs when the state information is updated, resulting in the failure to update the stored state information of the first device in time, and the state information of the first device needs to be updated to be consistent with the actual migration state, that is, the state information of the first device is updated to complete the post-quantum cryptography migration.

[0128] The embodiment of the present application provides a post-quantum cryptographic migration method, which is applied to a first device, where the first device can be understood as a cryptographic device, such as Figure 2 As shown, the method includes:

[0129] Step 201: Receive the first information sent by the cryptographic service platform.

[0130] The first information represents information of a post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration.

[0131] Here, post-quantum cryptographic migration includes updating the current cryptographic algorithm of the first device to a post-quantum cryptographic algorithm; the first device supports the algorithm update protocol between the cryptographic service platform and also supports its own algorithm reconstruction.

[0132] Step 202: Perform post-quantum cryptographic migration based on the first information.

[0133] Here, based on the first information, the current cryptographic algorithm of the first device can be updated or replaced with a post-quantum cryptographic algorithm.

[0134] In order to ensure the success of post-quantum cryptographic migration, in one embodiment, performing post-quantum cryptographic migration based on the first information includes one or more of the following:

[0135] Performing integrity check on the first information;

[0136] Based on the first information, updating the cryptographic algorithm of the first device to a post-quantum cryptographic algorithm;

[0137] Data to verify the updated cryptographic algorithm.

[0138] Here, performing post-quantum cryptographic migration based on the first information may include: updating the cryptographic algorithm of the first device to a post-quantum cryptographic algorithm based on the first information; optionally, it may also include performing an integrity check on the first information, that is, when the integrity check of the first information passes, updating the cryptographic algorithm of the first device to a post-quantum cryptographic algorithm based on the first information to ensure that the first device successfully completes the post-quantum cryptographic algorithm update; optionally, it may also include verifying the data of the updated cryptographic algorithm, that is, after updating the cryptographic algorithm of the first device to a post-quantum cryptographic algorithm based on the first information, verifying the data of the updated cryptographic algorithm may be verified by a set standard to further ensure that the post-quantum cryptographic algorithm update is successful.

[0139] In order to promptly inform the cryptographic service platform of the post-quantum cryptographic migration status of the first device to avoid duplication or omission, in one embodiment, the method further includes:

[0140] Sending second information to the cryptographic service platform, wherein the second information indicates whether the post-quantum cryptographic migration is successful or failed.

[0141] Here, after the cryptographic algorithm of the first device is updated to a post-quantum cryptographic algorithm based on the first information, or after the data of the updated cryptographic algorithm is verified, the second information is sent to the cryptographic service platform so that the cryptographic service platform can timely update the status information of the first device based on the second information.

[0142] In order to save signaling overhead and data transmission resources, and / or to ensure smooth post-quantum cryptographic migration, in one embodiment, when the first device supports cryptographic algorithm update capability, before receiving the first information sent by the cryptographic service platform, the method further includes one or more of the following:

[0143] Sending third information to the cryptographic service platform, wherein the third information represents an application for cryptographic services;

[0144] Receiving a first request sent by the cryptographic service platform, where the first request is used to request an update of a cryptographic algorithm;

[0145] A first response is returned to the cryptographic service platform, where the first response indicates agreement to update the cryptographic algorithm.

[0146] Here, before receiving the first information sent by the cryptographic service platform, the third information can be sent to the cryptographic service platform, that is, when actively applying for services to the cryptographic service platform, the post-quantum cryptographic migration process is triggered to save signaling overhead and data transmission resources. Optionally, after sending the third information to the cryptographic service platform, the first request sent by the cryptographic service platform can be received; when the first request is received, and the first device supports the algorithm update capability, and the current working state of the first device supports post-quantum cryptographic migration, a first response is returned to the cryptographic service platform; when the first device does not support the cryptographic algorithm update capability, and / or the current working state of the first device does not support post-quantum cryptographic migration, a second response is returned to the cryptographic service platform to instruct the cryptographic service platform to postpone the post-quantum cryptographic migration, or temporarily not respond to the first request, and wait until the first device can support post-quantum cryptographic migration and the current working state supports post-quantum cryptographic migration, and then return the first response to the cryptographic service platform; the first response represents the consent to update the cryptographic algorithm.

[0147] In order to save signaling overhead and data transmission resources, the first device may trigger the post-quantum cryptographic migration process when the set conditions are met. Based on this, in one embodiment, the sending of the third information to the cryptographic service platform includes:

[0148] Sending third information to the cryptographic service platform when one or more of the following is performed:

[0149] Device authentication;

[0150] Key update;

[0151] Certificate renewal;

[0152] Start-up report;

[0153] Shutdown report.

[0154] Here, when the first device is working normally, that is, when the first device is performing one or more of device authentication, key update, certificate update, startup report and shutdown report, the third information can be sent to the cryptographic service platform to trigger post-quantum cryptographic migration; that is to say, there is no need to occupy specific resources separately for post-quantum cryptographic migration, but when working normally and applying for cryptographic services, the post-quantum cryptographic migration is automatically triggered, thereby not affecting the continuity and stability of the business system.

[0155] Because an exception may occur during the post-quantum cryptographic migration of the first device, or the first device itself does not support the cryptographic algorithm update capability, or the first device has not yet triggered the post-quantum cryptographic migration, the first device cannot complete the post-quantum cryptographic migration, so that the first device does not support the post-quantum cryptographic algorithm, and another device is required to replace the first device for post-quantum cryptographic protocol interaction. Based on this, in one embodiment, when the first device does not support the cryptographic algorithm update capability or does not support the post-quantum cryptographic algorithm, before receiving the first information sent by the cryptographic service platform, the method also includes:

[0156] Sending a second request to the cryptographic service platform; the second request is used to request a post-quantum cryptographic algorithm proxy service; and / or

[0157] Conduct post-quantum cryptographic algorithm proxy service negotiation with the cryptographic service platform.

[0158] Here, since the first device does not support the cryptographic algorithm update capability or does not support the post-quantum cryptographic algorithm, it is unable to perform post-quantum cryptographic protocol interaction with other cryptographic devices that support the post-quantum cryptographic algorithm. Therefore, it is necessary to request the cryptographic service platform to act as an agent for the first device to perform post-quantum cryptographic protocol interaction with other cryptographic devices, that is, send a second request to the cryptographic service platform; after sending the second request to the cryptographic service platform, post-quantum cryptographic algorithm proxy service negotiation can be performed with the cryptographic service platform, or post-quantum cryptographic algorithm proxy service negotiation may not be performed. For example, when the cryptographic service platform has the first proxy identity of the first device, that is, the first device has received the first information, but the post-quantum cryptographic migration fails, since the proxy identity has been requested from the cryptographic service platform before, the post-quantum cryptographic algorithm proxy service negotiation has been completed with the cryptographic service platform. Therefore, there is no need to perform post-quantum cryptographic algorithm proxy service negotiation with the cryptographic service platform again; post-quantum cryptographic algorithm proxy service negotiation includes identity authentication and / or protocol data synchronization.

[0159] It should be noted that before receiving the first information sent by the cryptographic service platform, it is also possible to only perform post-quantum cryptographic algorithm proxy service negotiation with the cryptographic service platform, that is, perform post-quantum cryptographic algorithm proxy service negotiation with the cryptographic service platform, which can also be regarded as requesting post-quantum cryptographic algorithm proxy service from the cryptographic service platform at the same time.

[0160] The first device can flexibly start the post-quantum cryptography migration process according to actual conditions. In one embodiment, before receiving the first information sent by the cryptographic service platform, the method further includes:

[0161] Sending a fourth request to the cryptographic service platform, wherein the fourth request is used to request an update of the cryptographic algorithm; and / or

[0162] Receive fourth information sent by the cryptographic service platform, where the fourth information represents information generated by the first device executing a post-quantum cryptographic protocol process with the second device as the first proxy.

[0163] Here, the post-quantum cryptographic migration can be triggered by sending a fourth request to the cryptographic service platform, thereby receiving the first information sent by the cryptographic service platform; or, the fourth information sent by the cryptographic service platform can be received, that is, the cryptographic service platform completes a post-quantum cryptographic algorithm proxy service, triggering the post-quantum cryptographic migration, thereby receiving the first information sent by the cryptographic service platform; or, when receiving the fourth information sent by the cryptographic service platform, a fourth request can be sent to the cryptographic service platform.

[0164] In order to save resources of the cryptographic service platform, the first device may start the post-quantum cryptographic migration process according to actual needs. In one embodiment, after receiving the first information sent by the cryptographic service platform, the method further includes:

[0165] Send fifth information to the cryptographic service platform, wherein the fifth information represents an application for cryptographic service.

[0166] Here, after receiving the first information sent by the cryptographic service platform and performing post-quantum cryptographic migration based on the first information, the fifth information is sent to the cryptographic service platform to trigger the cryptographic service platform to detect whether the stored status information of the first device has been updated, and perform the key update process with the cryptographic service platform.

[0167] The present application is described in further detail below in conjunction with application examples.

[0168] like Figure 3 As shown, the post-quantum cryptographic migration method includes the following steps:

[0169] Step 1: The first device sends third information to the cryptographic service platform.

[0170] Here, the third information represents the application for cryptographic services. When the cryptographic service platform receives the third information, it triggers the post-quantum cryptographic migration of the first device, that is, the post-quantum cryptographic migration is triggered when the first device and the cryptographic service platform have normal business interactions, and it is actively triggered, and the post-quantum cryptographic migration is automatically performed, which will not affect the continuity and stability of the business system. Optionally, it is also possible to directly execute step 5 without sending the third information to the cryptographic service platform through the first device to trigger the post-quantum cryptographic migration.

[0171] Step 2: The cryptographic service platform queries the status information of the first device.

[0172] Here, when the status information of the first device is queried to indicate that the post-quantum cryptography migration is not completed, step 3 is executed or step 5 is directly executed.

[0173] Step 3: The cryptographic service platform sends a first request to the first device.

[0174] Here, for the specific implementation process of steps 3-8, please refer to the relevant description above and will not be repeated here.

[0175] Step 4: The first device sends a first response to the cryptographic service platform; the cryptographic service platform receives the first response sent by the first device.

[0176] Step 5: The cryptographic service platform sends the first information to the first device.

[0177] Step 6: The first device performs post-quantum cryptographic migration based on the first information.

[0178] Step 7: The first device sends the second information to the cryptographic service platform.

[0179] Step 8: The cryptographic service platform updates the status information of the first device.

[0180] Step 9: The cryptographic service platform and the first device update the key.

[0181] Here, when the first device has completed post-quantum cryptographic migration and the status information of the first device stored in the cryptographic service platform has been updated, and the updated status information of the first device indicates that the first device has completed quantum cryptographic migration, the cryptographic service platform and the first device perform a key update process to synchronize the key of the post-quantum cryptographic algorithm to the first device.

[0182] like Figure 4 As shown, when the first device does not support the cryptographic algorithm update capability or does not support the post-quantum cryptographic algorithm, the post-quantum cryptographic migration method includes the following steps:

[0183] Step 1: The second device performs cryptographic protocol interaction with the first device.

[0184] Here, the second device and the first device perform post-quantum cryptographic algorithm protocol interaction, and the asymmetric cryptographic algorithm protocol interaction includes identity authentication and key negotiation. When the first device is a cryptographic device that does not support post-quantum cryptographic algorithms and only supports classical cryptographic algorithms, and the second device is a cryptographic device that supports post-quantum cryptographic algorithms, the second device and the first device cannot complete post-quantum cryptographic algorithm protocol interaction, and step 2 is executed; when the first device and the second device support multiple sets of cryptographic algorithms at the same time, when performing cryptographic algorithm protocol interaction, the algorithm identification field in the protocol data can be added, and the cryptographic algorithm commonly supported by the first device and the second device can be used to perform the commonly supported cryptographic algorithm protocol interaction, and then step 7 or step 8 is executed.

[0185] Step 2: The first device sends a second request to the cryptographic service platform; the cryptographic service platform receives the second request sent by the first device.

[0186] Here, for the specific implementation process of steps 2-5, please refer to the relevant description above and will not be repeated here.

[0187] Step 3: The cryptographic service platform negotiates the post-quantum cryptographic algorithm proxy service with the first device.

[0188] Step 4: The cryptographic service platform establishes the first proxy identity.

[0189] Step 5: The cryptographic service platform interacts with the second device using the post-quantum cryptographic protocol.

[0190] Step 6: The cryptographic service platform sends fourth information to the first device.

[0191] Here, after sending the fourth information to the first device, the cryptographic service platform may delete the fourth information stored in itself to save storage resources.

[0192] Step 7: The cryptographic service platform sends a fourth request to the first device.

[0193] Here, for the specific implementation process of steps 7-11, please refer to the relevant description above and will not be repeated here.

[0194] Step 8: The cryptographic service platform sends the first information to the first device.

[0195] Step 9: The first device performs post-quantum cryptographic migration based on the first information.

[0196] Step 10: The first device sends the second information to the cryptographic service platform.

[0197] Step 11: The cryptographic service platform updates the status information of the first device.

[0198] Step 12: The first device sends the fifth information to the cryptographic service platform.

[0199] Here, in order to ensure that the status information of the first device is updated, the first device sends the fifth information to the cryptographic service platform. That is, when the first device conducts normal business interaction with the cryptographic service platform, it can trigger the cryptographic service platform to detect whether the stored status information of the first device is correct and execute step 13.

[0200] Step 13: The cryptographic service platform queries the status information of the first device.

[0201] Here, when the status information of the first device queried by the cryptographic service platform is the same as the actual migration status of the first device, that is, the first device has completed the post-quantum cryptographic migration, and the status information of the first device stored by the cryptographic service platform also indicates that the quantum cryptographic migration has been completed, step 14 is executed. When the status information of the first device queried by the cryptographic service platform is different from the actual migration status of the first device, that is, the first device has completed the post-quantum cryptographic migration, and the status information of the first device stored by the cryptographic service platform indicates that the post-quantum cryptographic migration has not been completed, the cryptographic service platform needs to update the status information of the first device first, and then execute step 14; or, the cryptographic service platform first updates the status information of the first device, and then ends the quantum cryptographic migration process, and when the first device applies for cryptographic services again, the status information of the first device is queried, and when the status information of the first device queried by the cryptographic service platform is the same as the actual migration status of the first device, step 14 is executed.

[0202] Step 14: The cryptographic service platform and the first device update the key.

[0203] Here, for the specific implementation process of step 14, please refer to the relevant description above, which will not be repeated here.

[0204] Step 15: The cryptographic service platform destroys the first agent identity.

[0205] Here, the cryptographic service platform destroys the first proxy identity, that is, the first device supports the post-quantum cryptographic algorithm, and the subsequent post-quantum cryptographic algorithm protocol interaction with the first device can be executed by the first device.

[0206] In order to implement the method on the cryptographic service platform side of the embodiment of the present application, the embodiment of the present application also provides a post-quantum cryptographic migration device, which is arranged on the cryptographic service platform, such as Figure 5 As shown, the device comprises:

[0207] The first sending unit 501 is used to send first information to a first device; the first information represents information of a post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration.

[0208] In one embodiment, the device further comprises:

[0209] A second receiving unit, configured to receive second information sent by the first device, where the second information indicates success or failure of post-quantum cryptography migration;

[0210] The first updating unit is used to update the state information of the first device when the second information indicates that the post-quantum cryptography migration is successful; the updated state information of the first device indicates that the post-quantum cryptography migration has been completed.

[0211] In one embodiment, when the first device supports the cryptographic algorithm update capability, the apparatus further includes:

[0212] a third receiving unit, configured to receive third information sent by the first device, wherein the third information represents an application for a cryptographic service; and / or

[0213] A second sending unit, configured to send a first request to the first device; the first request is used to request to update the cryptographic algorithm;

[0214] The fourth receiving unit is used to receive a first response returned by the first device; wherein the first response represents agreement to update the cryptographic algorithm.

[0215] In one embodiment, the apparatus further comprises a query unit, configured to query state information of the first device, the state information representing a migration state of post-quantum cryptography;

[0216] The first sending unit 501 is specifically configured to send first information to the first device when the status information of the first device indicates that the post-quantum cryptography migration has not been completed.

[0217] In one embodiment, when the first device does not support cryptographic algorithm update capability or does not support post-quantum cryptographic algorithm, the apparatus further includes:

[0218] A fifth receiving unit, configured to receive a second request sent by the first device; the second request is used to request a post-quantum cryptographic algorithm proxy service;

[0219] A first negotiation unit, configured to perform a post-quantum cryptography algorithm proxy service negotiation with the first device based on the second request;

[0220] An establishing unit is used to establish a first proxy identity; the first proxy identity represents that the cryptographic service platform acts as an agent for the first device to complete the post-quantum cryptographic protocol interaction with the second device, and the second device is a device that supports the post-quantum cryptographic algorithm.

[0221] In one embodiment, the device further comprises one or more of the following:

[0222] a sixth receiving unit, configured to receive a fourth request sent by the first device, wherein the fourth request is used to request an update of a cryptographic algorithm;

[0223] A third sending unit is configured to send fourth information to the first device, where the fourth information represents information generated by the first device executing a post-quantum cryptographic protocol process with the second device as the first proxy;

[0224] A deleting unit is used to delete the fourth information.

[0225] In one embodiment, the device further comprises:

[0226] a seventh receiving unit, configured to receive fifth information sent by the first device, wherein the fifth information represents an application for a cryptographic service;

[0227] a destroying unit, configured to destroy the first proxy identity when the first device has completed post-quantum cryptography migration and the status information of the first device indicates that the quantum cryptography migration has been completed; or

[0228] The second updating unit is used to update the state information of the first device to the state that the post-quantum cryptography migration has been completed when the first device has completed the post-quantum cryptography migration and the state information of the first device indicates that the post-quantum cryptography migration has not been completed.

[0229] In one embodiment, the second sending unit is specifically configured to send a first request to the first device when the first device has not completed post-quantum cryptography migration, or when the status information of the first device indicates that post-quantum cryptography migration has not been completed.

[0230] In actual applications, the first sending unit 501, the second receiving unit, the third receiving unit, the second sending unit, the fourth receiving unit, the fifth receiving unit, the sixth receiving unit, the third sending unit and the seventh receiving unit can be implemented by a processor in a post-quantum cryptographic migration device in combination with a communication interface; the first updating unit, the query unit, the first negotiation unit, the establishing unit, the deleting unit, the destroying unit and the second updating unit can be implemented by a processor in a post-quantum cryptographic migration device.

[0231] In order to implement the method on the first device side of the embodiment of the present application, the embodiment of the present application also provides a post-quantum cryptographic migration device, which is arranged on the first device, such as Figure 6 As shown, the device comprises:

[0232] The first receiving unit 601 is used to receive first information sent by the cryptographic service platform; the first information represents information of the post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration;

[0233] The migration unit 602 is used to perform post-quantum cryptography migration based on the first information.

[0234] In one embodiment, the migration unit 602 is specifically used for one or more of the following:

[0235] Performing integrity check on the first information;

[0236] Based on the first information, updating the cryptographic algorithm of the first device to a post-quantum cryptographic algorithm;

[0237] Data to verify the updated cryptographic algorithm.

[0238] In one embodiment, the device further comprises:

[0239] The fourth sending unit is used to send second information to the cryptographic service platform, where the second information indicates whether the post-quantum cryptographic migration is successful or failed.

[0240] In one embodiment, when the first device supports cryptographic algorithm update capability, the apparatus further includes one or more of the following:

[0241] A fifth sending unit, configured to send third information to the cryptographic service platform, wherein the third information represents an application for cryptographic service;

[0242] An eighth receiving unit is configured to receive a first request sent by the cryptographic service platform, where the first request is used to request an update of a cryptographic algorithm;

[0243] The sixth sending unit is used to return a first response to the cryptographic service platform, where the first response represents agreement to update the cryptographic algorithm.

[0244] In one embodiment, when the first device does not support cryptographic algorithm update capability or does not support post-quantum cryptographic algorithm, the apparatus further includes:

[0245] A seventh sending unit, configured to send a second request to the cryptographic service platform; the second request is used to request a post-quantum cryptographic algorithm proxy service; and / or

[0246] The second negotiation unit is used to negotiate a post-quantum cryptographic algorithm proxy service with the cryptographic service platform.

[0247] In one embodiment, the device further comprises:

[0248] an eighth sending unit, configured to send a fourth request to the cryptographic service platform, wherein the fourth request is used to request an update of a cryptographic algorithm; and / or

[0249] A ninth receiving unit is used to receive fourth information sent by the cryptographic service platform, where the fourth information represents information generated by the first device executing a post-quantum cryptographic protocol process with the second device as the first proxy.

[0250] In one embodiment, the device further comprises:

[0251] The ninth sending unit is used to send fifth information to the cryptographic service platform, where the fifth information represents an application for cryptographic service.

[0252] In one embodiment, the fifth sending unit is specifically configured to send the third information to the cryptographic service platform when performing one or more of the following:

[0253] Device authentication;

[0254] Key update;

[0255] Certificate renewal;

[0256] Start-up report;

[0257] Shutdown report.

[0258] In actual applications, the first receiving unit 601, the fourth sending unit, the fifth sending unit, the eighth receiving unit, the sixth sending unit, the seventh sending unit, the eighth sending unit, the ninth receiving unit and the ninth sending unit can be implemented by a processor in a post-quantum cryptographic migration device in combination with a communication interface, and the migration unit 602 and the second negotiation unit can be implemented by a processor in a post-quantum cryptographic migration device.

[0259] It should be noted that: the above embodiment provides a post-quantum cryptographic migration device, and only uses the division of the above program modules as an example to illustrate when performing post-quantum cryptographic migration. In practical applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the above-described processing. In addition, the post-quantum cryptographic migration device provided in the above embodiment and the post-quantum cryptographic migration method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0260] Based on the hardware implementation of the above program modules, and in order to implement the method of the cryptographic service platform side of the embodiment of the present application, the embodiment of the present application also provides a cryptographic service platform, such as Figure 7 As shown, the cryptographic service platform 700 includes:

[0261] The first communication interface 701 can exchange information with other network nodes.

[0262] The first processor 702 is connected to the first communication interface 701 to implement information interaction with other network nodes, and is used to execute the methods provided by one or more technical solutions on the cryptographic service platform side when running a computer program.

[0263] The first memory 703 is used to store a computer program that can be run on the first processor 702 .

[0264] Specifically, the first communication interface 701 is used to send first information to the first device; the first information represents information of the post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration.

[0265] In one embodiment, the first communication interface 701 is further used to receive second information sent by the first device, where the second information indicates whether the post-quantum cryptography migration is successful or failed;

[0266] The first processor 702 is configured to update the state information of the first device when the second information indicates that the post-quantum cryptography migration is successful; the updated state information of the first device indicates that the post-quantum cryptography migration has been completed.

[0267] In one embodiment, when the first device supports the cryptographic algorithm update capability, the first communication interface 701 is further used to receive third information sent by the first device, where the third information represents an application for a cryptographic service; and / or

[0268] A first request is sent to the first device, and a first response returned by the first device is received; wherein the first request is used to request an update of a cryptographic algorithm; and the first response indicates agreement to update the cryptographic algorithm.

[0269] In one embodiment, the first processor 702 is further used to query the state information of the first device, where the state information represents the migration state of the post-quantum cryptography;

[0270] The first communication interface 701 is specifically configured to send first information to the first device when the status information of the first device indicates that the post-quantum cryptography migration has not been completed.

[0271] In one embodiment, when the first device does not support cryptographic algorithm update capability or does not support post-quantum cryptographic algorithm, the first communication interface 701 is further used to receive a second request sent by the first device; the second request is used to request a post-quantum cryptographic algorithm proxy service;

[0272] The first processor 702 is further used to perform post-quantum cryptographic algorithm proxy service negotiation with the first device based on the second request; and is further used to establish a first proxy identity; the first proxy identity represents that the cryptographic service platform acts as an agent for the first device to complete the post-quantum cryptographic protocol interaction with the second device, and the second device is a device that supports the post-quantum cryptographic algorithm.

[0273] In one embodiment, the first communication interface 701 is further used for one or more of the following:

[0274] receiving a fourth request sent by the first device, where the fourth request is used to request an update of a cryptographic algorithm;

[0275] Sending fourth information to the first device, where the fourth information represents information generated by the first device executing a post-quantum cryptographic protocol process with the second device as the first proxy;

[0276] The first processor 702 is further configured to delete the fourth information.

[0277] In one embodiment, the first communication interface 701 is further used to receive fifth information sent by the first device, where the fifth information represents an application for a cryptographic service;

[0278] The first processor 702 is further configured to destroy the first proxy identity when the first device has completed post-quantum cryptography migration and the state information of the first device indicates that the quantum cryptography migration has been completed; or

[0279] When the first device has completed post-quantum cryptography migration and the state information of the first device indicates that post-quantum cryptography migration has not been completed, the state information of the first device is updated to indicate that post-quantum cryptography migration has been completed.

[0280] In one embodiment, the first communication interface 701 is specifically used to send a first request to the first device when the first device has not completed the post-quantum cryptography migration, or when the status information of the first device indicates that the post-quantum cryptography migration has not been completed.

[0281] It should be noted that the specific processing process of the first processor 702 and the first communication interface 701 can be understood by referring to the above method.

[0282] Of course, in actual application, the various components in the cryptographic service platform 700 are coupled together through the bus system 704. It is understandable that the bus system 704 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 704 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 7 Various buses are labeled as bus system 704 .

[0283] The first memory 703 in the embodiment of the present application is used to store various types of data to support the operation of the cryptographic service platform 700. Examples of such data include: any computer program used to operate on the cryptographic service platform 700.

[0284] The method disclosed in the above embodiment of the present application can be applied to the first processor 702, or implemented by the first processor 702. The first processor 702 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the first processor 702. The above-mentioned first processor 702 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The first processor 702 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the first memory 703, and the first processor 702 reads the information in the first memory 703, and completes the steps of the above method in combination with its hardware.

[0285] In an exemplary embodiment, the cryptographic service platform 700 can be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to execute the aforementioned method.

[0286] Based on the hardware implementation of the above program module, and in order to implement the method on the first device side of the embodiment of the present application, the embodiment of the present application also provides a first device, such as Figure 8 As shown, the first device 800 includes:

[0287] The second communication interface 801 can exchange information with other network nodes.

[0288] The second processor 802 is connected to the second communication interface 801 to implement information interaction with other network nodes, and is used to execute the methods provided by one or more technical solutions on the first device side when running a computer program.

[0289] The second memory 803 is used to store a computer program that can be run on the second processor 802 .

[0290] Specifically, the second communication interface 801 is used to receive first information sent by the cryptographic service platform; the first information represents information of the post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration;

[0291] The second processor 802 is used to perform post-quantum cryptographic migration based on the first information.

[0292] In one embodiment, the second processor 802 is specifically configured to:

[0293] Performing integrity check on the first information;

[0294] Based on the first information, updating the cryptographic algorithm of the first device to a post-quantum cryptographic algorithm;

[0295] Data to verify the updated cryptographic algorithm.

[0296] In one embodiment, the second communication interface 801 is further used to send second information to the cryptographic service platform, where the second information indicates whether the post-quantum cryptographic migration is successful or failed.

[0297] In one embodiment, when the first device supports the cryptographic algorithm update capability, the second communication interface 801 is further used for one or more of the following:

[0298] Sending third information to the cryptographic service platform, wherein the third information represents an application for cryptographic services;

[0299] Receiving a first request sent by the cryptographic service platform, where the first request is used to request an update of a cryptographic algorithm;

[0300] A first response is returned to the cryptographic service platform, where the first response indicates agreement to update the cryptographic algorithm.

[0301] In one embodiment, when the first device does not support the cryptographic algorithm update capability or does not support the post-quantum cryptographic algorithm, the second communication interface 801 is further used to send a second request to the cryptographic service platform; the second request is used to request a post-quantum cryptographic algorithm proxy service; and / or

[0302] The second processor 802 is further configured to perform post-quantum cryptographic algorithm proxy service negotiation with the cryptographic service platform.

[0303] In one embodiment, the second communication interface 801 is further used to send a fourth request to the cryptographic service platform, wherein the fourth request is used to request to update the cryptographic algorithm; and / or

[0304] Receive fourth information sent by the cryptographic service platform, where the fourth information represents information generated by the first device executing a post-quantum cryptographic protocol process with the second device as the first proxy.

[0305] In one embodiment, the second communication interface 801 is further used to send fifth information to the cryptographic service platform, where the fifth information represents an application for cryptographic service.

[0306] In one embodiment, the second communication interface 801 is specifically configured to send the third information to the cryptographic service platform when one or more of the following is performed:

[0307] Device authentication;

[0308] Key update;

[0309] Certificate renewal;

[0310] Start-up report;

[0311] Shutdown report.

[0312] It should be noted that the specific processing process of the second processor 802 and the second communication interface 801 can be understood by referring to the above method.

[0313] Of course, in actual application, the various components in the first device 800 are coupled together through the bus system 804. It can be understood that the bus system 804 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 804 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 8 Various buses are labeled as bus system 804 .

[0314] The second memory 803 in the embodiment of the present application is used to store various types of data to support the operation of the first device 800. Examples of such data include: any computer program used to operate on the first device 800.

[0315] The method disclosed in the above embodiment of the present application can be applied to the second processor 802, or implemented by the second processor 802. The second processor 802 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the second processor 802. The above-mentioned second processor 802 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The second processor 802 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the second memory 803. The second processor 802 reads the information in the second memory 803 and completes the steps of the above method in combination with its hardware.

[0316] In an exemplary embodiment, the first device 800 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general purpose processors, controllers, MCUs, Microprocessors, or other electronic components to perform the aforementioned methods.

[0317] It can be understood that the memory (first memory 803 and second memory 803) of the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include both a volatile memory and a non-volatile memory. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAM bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memory described in the embodiments of the present application is intended to include, but is not limited to, these and any other suitable types of memory.

[0318] In an exemplary embodiment, the embodiment of the present application further provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, for example, including a first memory 703 storing a computer program, and the computer program can be executed by the first processor 702 of the cryptographic service platform 700 to complete the steps described in the aforementioned cryptographic service platform side method. For another example, a second memory 803 storing a computer program can be executed by the second processor 802 of the first device 800 to complete the steps described in the aforementioned first device side method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

[0319] Exemplarily, an embodiment of the present application also provides a computer program product, including a computer program, which can be executed by the first processor 702 of the cryptographic service platform 700 and the second processor 802 of the first device 800 to complete the steps of any of the aforementioned methods.

[0320] It should be noted that “first”, “second”, etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence; “multiple items” refers to two or more items.

[0321] The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there may be three relationships. For example, A and or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0322] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0323] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. A post-quantum cryptographic migration method, It is characterized in that Applied to a cryptographic service platform, the method comprises: Sending first information to a first device; the first information represents information of a post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration.

2. The method according to claim 1, It is characterized in that The method further comprises: receiving second information sent by the first device, wherein the second information indicates success or failure of post-quantum cryptography migration; When the second information indicates that the post-quantum cryptography migration is successful, the status information of the first device is updated; the updated status information of the first device indicates that the post-quantum cryptography migration has been completed.

3. The method according to any one of claims 1 to 2, It is characterized in that In the case where the first device supports the cryptographic algorithm update capability, before sending the first information to the first device, the method further includes: receiving third information sent by the first device, wherein the third information represents an application for a cryptographic service; and / or A first request is sent to the first device, and a first response returned by the first device is received; wherein the first request is used to request an update of a cryptographic algorithm; and the first response indicates agreement to update the cryptographic algorithm.

4. The method according to claim 3, It is characterized in that The sending the first information to the first device includes: Querying status information of the first device, where the status information represents a migration state of post-quantum cryptography; When the status information of the first device indicates that the post-quantum cryptography migration is not completed, first information is sent to the first device.

5. The method according to any one of claims 1 to 2, It is characterized in that In a case where the first device does not support a cryptographic algorithm update capability or does not support a post-quantum cryptographic algorithm, before sending the first information to the first device, the method further includes: receiving a second request sent by the first device; the second request is used to request a post-quantum cryptographic algorithm proxy service; Based on the second request, perform post-quantum cryptography algorithm proxy service negotiation with the first device; Establish a first proxy identity; the first proxy identity represents that the cryptographic service platform acts as an agent for the first device to complete the post-quantum cryptographic protocol interaction with the second device, and the second device is a device that supports the post-quantum cryptographic algorithm.

6. The method according to claim 5, It is characterized in that Before sending the first information to the first device, the method further includes one or more of the following: receiving a fourth request sent by the first device, where the fourth request is used to request an update of a cryptographic algorithm; Sending fourth information to the first device, where the fourth information represents information generated by the first device executing a post-quantum cryptographic protocol process with the second device as the first proxy; The fourth information is deleted.

7. The method according to claim 5, It is characterized in that After sending the first information to the first device, the method further includes: receiving fifth information sent by the first device, wherein the fifth information represents an application for a cryptographic service; When the first device has completed post-quantum cryptography migration and the status information of the first device indicates that the quantum cryptography migration has been completed, destroying the first proxy identity; or When the first device has completed post-quantum cryptography migration and the state information of the first device indicates that post-quantum cryptography migration has not been completed, the state information of the first device is updated to indicate that post-quantum cryptography migration has been completed.

8. The method according to claim 3, It is characterized in that The sending a first request to the first device includes: When the first device has not completed the post-quantum cryptography migration, or the state information of the first device indicates that the post-quantum cryptography migration has not been completed, a first request is sent to the first device.

9. A post-quantum cryptographic migration method, It is characterized in that Applied to a first device, the method includes: Receiving first information sent by a cryptographic service platform; the first information represents information of a post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration; Post-quantum cryptographic migration is performed based on the first information.

10. The method according to claim 9, It is characterized in that The performing post-quantum cryptographic migration based on the first information includes one or more of the following: Performing integrity check on the first information; Based on the first information, updating the cryptographic algorithm of the first device to a post-quantum cryptographic algorithm; Data to verify the updated cryptographic algorithm.

11. The method according to claim 9, It is characterized in that The method further comprises: Sending second information to the cryptographic service platform, wherein the second information indicates whether the post-quantum cryptographic migration is successful or failed.

12. The method according to any one of claims 9 to 11, It is characterized in that In the case where the first device supports the cryptographic algorithm update capability, before receiving the first information sent by the cryptographic service platform, the method further includes one or more of the following: Sending third information to the cryptographic service platform, wherein the third information represents an application for cryptographic services; Receiving a first request sent by the cryptographic service platform, where the first request is used to request an update of a cryptographic algorithm; A first response is returned to the cryptographic service platform, where the first response indicates agreement to update the cryptographic algorithm.

13. The method according to any one of claims 9 to 11, It is characterized in that In the case where the first device does not support the cryptographic algorithm update capability or does not support the post-quantum cryptographic algorithm, before receiving the first information sent by the cryptographic service platform, the method further includes: Sending a second request to the cryptographic service platform; the second request is used to request a post-quantum cryptographic algorithm proxy service; and / or Conduct post-quantum cryptographic algorithm proxy service negotiation with the cryptographic service platform.

14. The method according to claim 13, It is characterized in that Before receiving the first information sent by the cryptographic service platform, the method further includes: Sending a fourth request to the cryptographic service platform, wherein the fourth request is used to request an update of the cryptographic algorithm; and / or Receive fourth information sent by the cryptographic service platform, where the fourth information represents information generated by the first device executing a post-quantum cryptographic protocol process with the second device as the first proxy.

15. The method according to claim 13, It is characterized in that After receiving the first information sent by the cryptographic service platform, the method further includes: Send fifth information to the cryptographic service platform, wherein the fifth information represents an application for cryptographic service.

16. The method according to claim 12, It is characterized in that The sending the third information to the cryptographic service platform includes: Sending third information to the cryptographic service platform when one or more of the following is performed: Device authentication; Key update; Certificate renewal; Start-up report; Shutdown report.

17. A post-quantum cryptographic migration device, It is characterized in that include: A first sending unit, configured to send first information to a first device; The first information represents information of a post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration.

18. A post-quantum cryptographic migration device, It is characterized in that include: A first receiving unit, configured to receive first information sent by the cryptographic service platform; The first information represents information of a post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration; A migration unit is used to perform post-quantum cryptography migration based on the first information.

19. A cryptographic service platform, It is characterized in that include: A first processor and a first communication interface; wherein, The first communication interface is used to send first information to the first device; The first information represents information of a post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration.

20. A first device, It is characterized in that include: A second processor and a second communication interface; wherein, The second communication interface is used to receive the first information sent by the cryptographic service platform; The first information represents information of a post-quantum cryptographic algorithm and is used for post-quantum cryptographic migration; The second processor is used to perform post-quantum cryptographic migration based on the first information.

21. An electronic device, It is characterized in that The electronic device comprises a cryptographic service platform or a first device, the electronic device comprises a processor and a memory for storing a computer program that can be run on the processor, Wherein, when the processor is used to run the computer program, it executes the steps of the method described in any one of claims 1 to 8, or executes the steps of the method described in any one of claims 9 to 16.

22. A storage medium having a computer program stored thereon, It is characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented, or the steps of the method according to any one of claims 9 to 16 are implemented.

23. A computer program product comprising a computer program, It is characterized in that The computer program implements the steps of the method according to any one of claims 1 to 16 when executed by a processor.

Images