A quantum secure identity authentication method and device based on blockchain

Abstract

The present application provides a quantum secure identity authentication method and device based on blockchain, which is applied to the client. The method includes: calling the smart contract deployed by the blockchain network to obtain the public key and certificate pre-published or updated by the server through the smart contract; in response to determining that the server has passed the certificate-based authentication, using the public key to perform quantum secure identity authentication with the server to establish a communication connection that complies with the target protocol; quantum secure identity authentication is used to replace the non-quantum secure identity authentication originally included in the protocol. Therefore, the published or latest public key and certificate can be obtained by calling the interface of the smart contract, which improves the convenience and security of the communication system in obtaining public keys and certificates.

Description

Technical Field

[0001] The present application relates to the field of quantum security technology, and in particular to a quantum security identity authentication method and device based on blockchain. Background Art

[0002] At present, the key-encapsulation mechanism (KEM) in quantum-safe algorithms has been proven to achieve identity authentication. Compared with signature algorithms, KEM is faster in authentication, can reduce 90% of CPU cycles, and improve authentication efficiency. KEM can be used in protocols such as TLS, Noise, and Signal to mix or replace existing classical algorithms such as elliptic curves or RSA algorithms to achieve quantum-safe identity authentication.

[0003] However, in the one-way authentication scenario (which means the client needs to ensure its own security but the server does not need to ensure the client's identity, so only the client verifies the server's identity, and the server does not need to verify the client's identity), the client needs to verify the server's public key, such as the KEM public key, which either needs to be signed by an authority or needs to be sent or configured to the client out-of-band. These methods have the following disadvantages:

[0004] 1. Single point of failure: If the authority fails or is attacked, the client will not be able to obtain trusted public key information.

[0005] 2. Security risks: There are security risks in sending or configuring public key information out-of-band, such as man-in-the-middle attacks and eavesdropping.

[0006] 3. Complex operation: The client needs to coordinate with the server to ensure that the latest public key information is obtained, which increases the complexity of the operation.

[0007] 4. Lack of transparency: The signature method by an authoritative organization has the risk of middleman intervention, and the client cannot directly verify the authenticity of the public key information.

[0008] Therefore, in the one-way authentication scenario, it is necessary to propose a method that can simply and efficiently implement quantum secure authentication. Summary of the invention

[0009] In order to solve the above problems, the present application proposes a blockchain-based quantum security identity authentication method, device, computer-readable storage medium and electronic device, which can simply and efficiently implement quantum security-supported identity authentication, thereby improving the communication system's anti-quantum attack performance.

[0010] In a first aspect, the present application provides a quantum security identity authentication method based on blockchain, which is applied to a client, and the method includes:

[0011] Call the smart contract deployed on the blockchain network to obtain the public key and certificate that the server has previously published or updated through the smart contract;

[0012] In response to determining that the server has passed the certificate-based authentication, quantum-secure identity authentication is performed with the server using the public key to establish a communication connection that complies with the target protocol; the quantum-secure identity authentication is used to replace the non-quantum-secure identity authentication originally included in the protocol.

[0013] Therefore, the present application can obtain the published or latest public key and certificate by calling the interface of the smart contract, thereby improving the convenience and security of the communication system in obtaining public keys and certificates.

[0014] In a second aspect, the present application provides a quantum secure identity authentication method based on blockchain, which is applied to a server, and the method includes:

[0015] Use the Web3 library to connect to the second node in the blockchain network;

[0016] Create a second contract object using the access interface provided by the smart contract deployed on the blockchain network and the address where the smart contract is deployed on the blockchain network;

[0017] The second function in the smart contract is called using the second contract object to publish or update the public key and certificate of the server, wherein the second function includes functions for publishing or updating public key information and certificate information.

[0018] In a third aspect, the present application provides a quantum security identity authentication device based on blockchain, which is deployed on a client, and the device includes:

[0019] The calling module is used to call the smart contract deployed on the blockchain network to obtain the public key and certificate that the server has previously published or updated through the smart contract;

[0020] The processing module is used for performing quantum-safe identity authentication with the server using the public key in response to determining that the server has passed the certificate-based authentication to establish a communication connection that complies with the target protocol; the quantum-safe identity authentication is used to replace the non-quantum-safe identity authentication originally included in the protocol.

[0021] In a fourth aspect, the present application provides a quantum security identity authentication device based on blockchain, which is deployed on a server side and includes:

[0022] A connection module for connecting to a second node in the blockchain network using the Web3 library;

[0023] A creation module is used to create a second contract object by using an access interface provided by a smart contract deployed on a blockchain network and an address where the smart contract is deployed on the blockchain network;

[0024] A processing module is used to use the second contract object to call the second function in the smart contract to publish or update the public key and certificate of the server, and the second function includes a function for publishing or updating public key information and certificate information.

[0025] In a fifth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed in a computer, the computer is caused to execute the method described in the first aspect or any possible implementation of the first aspect.

[0026] In a sixth aspect, the present application provides an electronic device, comprising: at least one memory for storing programs; and at least one processor for executing the programs stored in the memory; wherein, when the programs stored in the memory are executed, the processor is used to execute the method described in the first aspect or any possible implementation of the first aspect, and execute the method described in the second aspect or any possible implementation of the second aspect.

[0027] It can be understood that the beneficial effects of the second to sixth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0029] Figure 1 This is an architecture diagram of a blockchain-based quantum security identity authentication system provided in an embodiment of the present application;

[0030] Figure 2 This is a flowchart of a quantum secure identity authentication method based on blockchain provided in an embodiment of the present application;

[0031] Figure 3 This is a flowchart of a quantum secure identity authentication method based on blockchain provided in an embodiment of the present application;

[0032] Figure 4 This is a schematic diagram of a quantum secure identity authentication device based on blockchain provided in an embodiment of the present application;

[0033] Figure 5This is a schematic diagram of a blockchain-based quantum security identity authentication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0035] In the description of the embodiments of the present application, words such as "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a concrete way.

[0036] In the description of the embodiments of the present application, the term "and / or" is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, B exists alone, and A and B exist at the same time. In addition, unless otherwise specified, the term "multiple" means two or more. For example, multiple systems refers to two or more systems, and multiple screen terminals refers to two or more screen terminals.

[0037] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. The terms "include", "comprises", "has" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0038] Currently, in a one-way identity authentication scenario, the solution for the client to obtain the server's public key (such as a KEM public key) has the characteristics of single point failure, security risks, complex operations, and lack of transparency.

[0039] In view of this, this solution calls the smart contract deployed by the blockchain network to obtain the public key and certificate that the server has previously published or updated through the smart contract. Then, in response to determining that the server has passed the certificate-based authentication, quantum secure identity authentication is performed between the public key and the server to establish a communication connection that complies with the target protocol. Therefore, by storing the public key and certificate in the blockchain, decentralized public key management can be achieved to avoid single point failure. On the one hand, the consensus mechanism of blockchain technology can ensure the security and authenticity of public keys and certificates, avoid man-in-the-middle attacks and eavesdropping, and provide security for the communication system. On the other hand, since the published or latest public key and certificate can be obtained by calling the interface of the smart contract, the convenience of obtaining public keys and certificates in the communication system is improved.

[0040] For example, Figure 1 The following is a diagram showing the architecture of a quantum secure identity authentication system based on blockchain provided by an embodiment of the present application. Figure 1 As shown, the quantum security identity authentication system includes a blockchain network, a server, and multiple clients. Blockchain-based quantum security identity authentication is achieved through information interaction between the blockchain network, the server, and the client to establish a communication connection between the server and the client. The blockchain network and the server, and the blockchain network and the client interact through the interface provided by the smart contract.

[0041] Each of the multiple clients is a terminal device accessed by the user, and the client establishes a secure communication connection with the server based on a secure communication protocol. In the process of establishing a secure communication connection, the client and the server need to interact with the blockchain network.

[0042] The purpose of client-side interaction with the blockchain network is to:

[0043] First, it is used to obtain the server's public key and certificate information: the client needs to obtain the server's public key and certificate information from the blockchain network for identity authentication and secure communication.

[0044] Second, verify the identity of the server: The client needs to verify the server's certificate information to ensure that the server's identity is credible to prevent man-in-the-middle attacks and other security threats.

[0045] Server: The server is an application or system that provides services and can establish a secure communication connection with the client based on a secure communication protocol. Before or during the process of establishing a secure communication connection, the server needs to interact with the blockchain network.

[0046] The purpose of the server-side interaction with the blockchain network is to publish or update its own public key and certificate information: the server needs to store its own published public key and certificate information in the blockchain network so that the client can obtain and verify the information. When the public key and certificate information of the server changes, the public key and certificate information stored in the blockchain needs to be updated in time.

[0047] It should be noted that in a one-way authentication scenario, the server does not need to verify the identity of the client, so the interaction between the server and the blockchain network is mainly used to publish or update its own public key and certificate information.

[0048] Blockchain network: The blockchain network is a distributed digital ledger system that can be used to store and manage the public key information of the server in this solution. The blockchain network includes multiple blockchain nodes. Figure 1 Nodes 1-6 are shown as examples. Each blockchain node refers to the deployment of the required software, which is used, for example, to form blocks, to reach consensus with other nodes, to run smart contracts, etc., so as to form a blockchain network. Since the blockchain network provides decentralized and tamper-proof characteristics, the credibility of information such as public keys and certificates can be ensured.

[0049] Smart Contract: A smart contract is an automatically executed program that runs on a blockchain network. Smart contracts are written by users and published to the blockchain network. In this solution, a specific smart contract can be deployed to manage the public key and certificate information of the server. The smart contract provides interfaces for registration, update, and revocation of public keys and certificates, so that the server can publish, update, and revoke public keys and certificates. The smart contract also provides a public key and certificate information query interface for the client to query public key and certificate information.

[0050] Specifically, the blockchain-based quantum security identity authentication process mainly includes the following parts:

[0051] In step ①, build the blockchain infrastructure, write smart contracts and deploy them. This includes designing the functions that smart contracts are to implement; taking Ethereum as an example, Ethereum is an open source public blockchain platform with smart contract functions, and uses the solidity language to write smart contract codes; write scripts for deploying smart contracts, and use Ethereum client tools (such as Geth or Parity) to complete the deployment work.

[0052] In step ②, the server stores its own published or updated public key and certificate information in the smart contract and broadcasts the information to other nodes in the blockchain network.

[0053] In step ③, the client executes the client program to query the public key and certificate information published or updated by the server on the blockchain. The client obtains the contract address of the aforementioned smart contract (the smart contract address refers to the unique address generated after the smart contract is deployed on the blockchain network), and calls the smart contract to obtain the public key and certificate information of the server. When using the blockchain network, the client can connect to any full node to access blockchain data. Therefore, the endpoint URL configured by the client can point to the address of any full node.

[0054] The client needs to verify the validity of the certificate information queried through the blockchain network. For example, the client can verify the validity of the certificate information in the following ways: by checking the publisher address of the smart contract to ensure that the contract is issued by a legitimate server; by checking the certificate's validity period, signature and other information to ensure that the certificate is valid; by checking the hash value of the certificate to ensure that the certificate information has not been tampered with.

[0055] In step ④, the client and the server negotiate based on the target protocol, such as the KEM TLS protocol, for authentication based on the public key (i.e., the KEM public key) and establish a communication connection that complies with the TLS protocol. The client and the server can use a variety of traditional security protocols, such as TLS, Noise, Signal, IKE protocols, etc., and use KEM to replace the certificate and signature-based authentication methods in these protocols to ultimately establish a communication connection and encrypt data transmission. During the entire identity authentication process, nodes 1-6 in the blockchain network ensure the timeliness and security of identity management through a consensus mechanism.

[0056] Therefore, by utilizing the decentralized, tamper-proof, and transparent characteristics of blockchain technology, the secure storage and distribution of public key information is realized, solving the problem of authentication and distribution of server public keys in traditional one-way identity authentication, and improving the reliability and security of the system. In addition, the use of a certificate-free approach brings great convenience to identity authentication and secure communication between the client and the server.

[0057] In addition, the key encapsulation method (KEM) in the quantum security algorithm (PQC) is used for identity authentication and participation in the generation of the final shared key, which improves the overall security and efficiency of traditional security protocols including authentication and key negotiation.

[0058] Next, based on the above analysis, a blockchain-based quantum security identity authentication method provided in an embodiment of the present application is introduced in detail.

[0059] For example, Figure 2A flowchart of a quantum secure identity authentication method based on blockchain provided by an embodiment of the present application is shown. It can be understood that the method can be executed by any device, equipment, platform, server, device cluster, server cluster, etc. with computing processing capabilities, and the method is applied to the client.

[0060] For example, before executing the method, the following steps may be performed: Figure 1 The preparation steps shown in steps ①-② in the above specifically include:

[0061] First, build the blockchain infrastructure according to the expected number of nodes. Taking Ethereum as an example, use the solidity language to write and deploy smart contracts. Smart contracts are automatically executed programs running on the blockchain network. In this solution, smart contracts can be written by the server or any node of the blockchain and published to the blockchain network for deployment. The blockchain network assigns smart contract addresses to the deployed smart contracts. Smart contract addresses refer to the unique addresses generated after the smart contract is deployed on the blockchain network. Through the smart contract address, users can interact with smart contracts, such as querying the status of smart contracts, sending transaction requests, calling functions in smart contracts, etc. The blockchain network also assigns access interfaces to the compiled smart contracts to provide them to users for external calls. The smart contract access interface is also called the Application Binary Interface (ABI), which can be generally understood as the interface description of the smart contract. When the smart contract is compiled, its corresponding ABI is also determined. The Ethereum smart contract on the blockchain can be called through the ABI. In this solution, the smart contract is responsible for managing the public key and certificate information of the server.

[0062] Optionally, use the solidity language to write smart contract code and make the following design based on the functions to be implemented by the smart contract:

[0063] First, you need to define the data structure of the smart contract. For example, define a PublicKeyInfo structure to store the public key information of the service client, including the public key itself, the owner's address, and the registration timestamp. In addition, define a CertificateInfo structure to store certificate information, including the certificate itself, the owner's address, the certificate type, the validity period, etc.

[0064] Secondly, seven events are defined: PublicKeyRegistered, PublicKeyUpdated, PublicKeyRevoked, CertificateRegistered, CertificateUpdated, and CertificateRevoked, which are used to notify external listeners of changes in public key information and certificate information.

[0065] Next, define eight function interfaces:

[0066] registerPublicKey: used to publish public key information. This function accepts a byte array parameter, which represents the public key itself. This function also performs some security checks, such as checking the validity of the public key and whether the caller has already registered the public key.

[0067] updatePublicKey: used to update the public key information. This function accepts a byte array type parameter, which represents the new public key. This function also performs some security checks, such as checking whether the caller is the owner of the public key.

[0068] revokePublicKey: used to revoke public key information. This function does not accept any parameters, and only requires the caller to be the owner of the public key.

[0069] getPublicKey: used to query public key information. This function accepts an address type parameter, which represents the address of the public key owner, and returns the public key itself.

[0070] registerCertificate: used to publish certificate information. This function accepts a byte array parameter, which represents the certificate itself. The function also performs some security checks, such as checking the validity of the certificate and whether the caller has already registered the certificate.

[0071] updateCertificate: used to update certificate information. This function accepts a byte array parameter, which represents the new certificate. This function also performs some security checks, such as checking whether the caller is the owner of the certificate.

[0072] revokeCertificate: used to revoke certificate information. This function does not accept any parameters, only requires the caller to be the owner of the certificate.

[0073] getCertificate: used to query certificate information. This function accepts an address type parameter, which represents the address of the certificate owner, and returns the certificate itself.

[0074] Finally, write a script for deploying the smart contract. You can use Ethereum client tools (such as Geth or Parity) to complete the deployment. For example, you can first set the RPC URL of the Ethereum node and the private key of the deployed contract in the script. Then, use the solc command to compile the smart contract to generate binary bytecode and interface description files. Then use the web3 command to deploy the smart contract to the Ethereum network and get the address of the deployed smart contract.

[0075] Therefore, the smart contract provides function interfaces such as the publication, update, and revocation of public keys and certificates, so that the server can perform operations such as publication, update, and revocation of public keys and certificates.

[0076] Secondly, the server can use the Web3 library to connect to the second node of the blockchain network to obtain the latest status on the blockchain. Use the access interface ABI provided by the smart contract and the address where the smart contract is deployed in the blockchain network to create a second contract object, which is a transaction in the blockchain. Use the second contract object to call the second function in the smart contract to publish or update the public key and certificate.

[0077] In some embodiments, the created second contract object is used to call the second function in the smart contract to publish or update the public key and certificate. The second function includes a function for publishing or updating the public key and certificate information. For example, the functions registerPublicKey and registerCertificate are called respectively to publish the public key and certificate information; the functions updatePublicKey and updateCertificate are called respectively to update the public key and certificate information, so as to update the current public key and certificate information stored in the blockchain network to the new public key and certificate information generated by the server.

[0078] Among them, before using the second contract object to call the second function in the smart contract to update the public key and certificate of the server, it is also necessary to generate a new public key and certificate, and use the Web3 library to connect to the third node of the blockchain network, and use the access interface provided by the smart contract and the address where the smart contract is deployed in the blockchain network to create a third contract object. Use the third contract object to call the third function in the smart contract to revoke the public key and certificate of the server, and the third function includes a function for revoking public key and certificate information. For example, call the functions revokePublicKey and revokeCertificate respectively to revoke the current public key and certificate information stored in the blockchain network to ensure that the client no longer uses outdated public key and certificate information.

[0079] Optionally, the server can use the OpenSSL library to generate a new public key and certificate, and in a production environment, use a CA-certified certificate issued by a trusted certificate authority (CA) to ensure the credibility of the public key and certificate. Specifically, use the OpenSSL library to generate a public key and certificate request (CSR), and then submit the CSR to the CA for signing to obtain a public key and a certified certificate. The certified certificate will contain the identity information of the server.

[0080] Therefore, the smart contract also provides function interfaces such as public key information and certificate information query interface for the client to query public key and certificate information.

[0081] After performing the above preparations, Figure 2 The execution of the quantum secure authentication method shown in mainly includes the following steps:

[0082] Step S201, calling the smart contract deployed by the blockchain network to obtain the public key and certificate that the server has previously published or updated through the smart contract.

[0083] In this embodiment, the blockchain network is used to store and manage the public key and certificate information of the server. The smart contract runs on the blockchain network and is used to provide function interfaces such as the issuance, update and revocation of public keys and certificates for the server to perform operations such as issuance, update and revocation of public keys and certificates; and is used to provide function interfaces such as public key and certificate information query interface for the client to perform public key and certificate query operations.

[0084] like Figure 1 As shown in step ③, the client can use the Web3 library to connect to the blockchain network and obtain the latest status on the blockchain. Use the access interface provided by the smart contract and the address where the smart contract is deployed in the blockchain network to create the first contract object. Figure 1 In step ②, the deployment of the smart contract is completed, so the first contract object can be created using the deployed smart contract address. Use the first contract object to call the function in the smart contract to query and obtain the public key and certificate information.

[0085] In some embodiments, a Web3 library is used to connect to a first node of a blockchain network, and a first contract object is created using an access interface ABI provided by a smart contract and an address where the smart contract is deployed in the blockchain network. The first contract object created is used to call a first function in the smart contract to obtain information about a public key and a certificate, and the first function includes a function for querying public key information and certificate information. For example, the functions getPublicKey and getCertificate are called respectively to query public key and certificate information.

[0086] In addition, in actual applications, the process of obtaining public keys and certificates may be much more complicated than this example, and the specific order and method may also vary depending on the application scenario and security requirements. For example, in some scenarios, the client may need to obtain a certificate first, and then obtain the public key based on the information in the certificate; in other scenarios, the client may need to obtain a public key first, and then verify the credibility of the public key by obtaining the certificate. In either case, the ultimate goal is to ensure that the public key obtained by the client is credible.

[0087] Step S202, in response to determining that the server has passed the certificate-based authentication, quantum-secure identity authentication is performed with the server using the public key to establish a communication connection that complies with the target protocol. The quantum-secure identity authentication is used to replace the non-quantum-secure identity authentication originally included in the protocol.

[0088] In this embodiment, the client needs to verify the validity of the public key and certificate information.

[0089] In some embodiments, the client can verify the validity of the public key and certificate information in the following ways: by checking the publisher address of the smart contract to ensure that the contract is issued by a legitimate server; by checking the certificate's validity period, signature and other information to ensure that the certificate is valid; by checking the hash value of the certificate to ensure that the certificate information has not been tampered with.

[0090] Optionally, the client can also use tools such as the OpenSSL library to verify the validity of the obtained certificate, including checking the certificate signature, verifying the certificate chain, checking whether the certificate is within the validity period, etc. If the certificate verification passes, the client considers the obtained server public key information to be credible.

[0091] Optionally, the client can also use the CA to verify the validity of the obtained certificate, which can improve the credibility of the public key and certificate, but will also increase the complexity and cost of the operation. The specific implementation method needs to be evaluated and selected according to the specific application scenario and security requirements.

[0092] After confirming that the server has passed the certificate-based authentication, the client will obtain the server's public key to participate in the KEM-based authentication. The client uses the public key to perform quantum-safe authentication with the server to establish a communication connection that complies with the target protocol. Quantum-safe authentication is used to replace the non-quantum-safe authentication originally performed in the target protocol. Quantum-safe authentication includes authentication using the public key to perform the KEM algorithm.

[0093] Optionally, taking the TLS protocol as an example, the process of negotiation between the client and the server based on the security protocol is as follows. Before starting the TLS protocol negotiation, the client has already Figure 1In step ③, the smart contract deployed on the blockchain obtains and verifies the credibility of the server's public key. The client uses the obtained public key to perform a KEM-based TLS handshake protocol with the server. The server verifies the client's identity through the TLS handshake protocol and generates a session key. The client uses the session key to establish a communication connection with the server that complies with the TLS protocol. Then, the client uses the generated session key to perform encrypted communication with the server.

[0094] The specific implementation steps of TLS using public keys for authentication can be found in the IETF draft draft-celi-wiggers-tls-authkem-02 (KEM-based Authentication for TLS 1.3), which will not be described in detail. It can be understood that this solution can also be used for any other security protocols based on public keys (such as KEM) for authentication, such as Noise, Signal, IKE protocols, etc.

[0095] Thus, by calling the smart contract deployed on the blockchain network, the public key and certificate previously published or updated by the server through the smart contract are obtained. Then, in response to determining that the server has passed the certificate-based authentication, quantum secure identity authentication is performed between the public key and the server to establish a communication connection that complies with the target protocol. Thus, the public key and certificate can be stored in the blockchain to achieve decentralized public key management and avoid single point failure. On the one hand, the consensus mechanism of blockchain technology can ensure the security and authenticity of public keys and certificates, avoid man-in-the-middle attacks and eavesdropping, and provide the security of the communication system. On the other hand, since the published or latest public key and certificate can be obtained by calling the interface of the smart contract, the convenience of obtaining public keys and certificates in the communication system is improved.

[0096] For example, Figure 3 A quantum secure identity authentication method based on blockchain provided in an embodiment of the present application is shown. The method is applied to the server and mainly includes the following steps:

[0097] Step S301, use the Web3 library to connect to the second node in the blockchain network.

[0098] In this embodiment, the blockchain network is used to store and manage the public key and certificate information of the server. The second node is one of the multiple nodes in the blockchain network, and Web3 is a library function that connects the second node to the blockchain network.

[0099] Step S302, creating a second contract object using the access interface provided by the smart contract deployed on the blockchain network and the address where the smart contract is deployed in the blockchain network.

[0100] In this embodiment, the smart contract runs on the blockchain network and is used to provide function interfaces such as the issuance, update, and revocation of public keys and certificates, so that the server can perform operations such as the issuance, update, and revocation of public keys and certificates.

[0101] Step S303, using the second contract object to call the second function in the smart contract to publish or update the public key and certificate of the server, the second function includes a function for publishing or updating public key information and certificate information.

[0102] In some embodiments, the server can use the Web3 library to connect to the second node of the blockchain network to obtain the latest status on the blockchain. Using the access interface ABI provided by the smart contract and the address where the smart contract is deployed in the blockchain network, a second contract object is created, and the contract object is a transaction in the blockchain.

[0103] Exemplarily, the created second contract object is used to call the second function in the smart contract to publish or update the public key and certificate. The second function includes a function for publishing or updating the public key and certificate information. For example, the functions registerPublicKey and registerCertificate are called respectively to publish the public key and certificate information, and the functions updatePublicKey and updateCertificate are called respectively to update the public key and certificate information, so as to update the current public key and certificate information stored in the blockchain network to the new public key and certificate information generated by the server.

[0104] Among them, before using the second contract object to call the second function in the smart contract to update the public key and certificate of the server, it is also necessary to generate a new public key and certificate, and use the Web3 library to connect to the third node of the blockchain network, and use the access interface provided by the smart contract and the address where the smart contract is deployed in the blockchain network to create a third contract object. Use the third contract object to call the third function in the smart contract to revoke the public key and certificate of the server, and the third function includes a function for revoking public key and certificate information. For example, call the functions revokePublicKey and revokeCertificate respectively to revoke the public key and certificate information to ensure that the client no longer uses outdated public key and certificate information.

[0105] Optionally, the server can use the OpenSSL library to generate a new public key and certificate, and in a production environment, use a CA-certified certificate issued by a trusted certificate authority (CA) to ensure the credibility of the public key and certificate. Specifically, use the OpenSSL library to generate a public key and certificate request (CSR), and then submit the CSR to the CA for signing to obtain a public key and a certified certificate. The certified certificate will contain the identity information of the server.

[0106] Therefore, the smart contract also provides function interfaces such as public key information and certificate information query interface for the client to query public key and certificate information.

[0107] Based on the method in the above embodiment, illustratively, Figure 4 A schematic diagram of a quantum security identity authentication device based on blockchain provided in an embodiment of the present application is shown. The device is deployed on the client, such as Figure 4 As shown, the quantum secure identity authentication device 300 includes:

[0108] The calling module 410 is used to call the smart contract deployed by the blockchain network to obtain the public key and certificate previously issued or updated by the server through the smart contract;

[0109] The processing module 420 is used to perform quantum-secure identity authentication with the server using the public key to establish a communication connection that complies with the target protocol in response to determining that the server has passed the certificate-based authentication; the quantum-secure identity authentication is used to replace the non-quantum-secure identity authentication originally included in the protocol.

[0110] Based on the method in the above embodiment, illustratively, Figure 5 A schematic diagram of a quantum secure identity authentication device based on blockchain provided in an embodiment of the present application is shown. The device is deployed on the server side, such as Figure 5 As shown, the quantum secure identity authentication device 500 includes:

[0111] The connection module 510 is used to connect to the second node in the blockchain network using the Web3 library.

[0112] The creation module 520 is used to create a second contract object by using the access interface provided by the smart contract deployed on the blockchain network and the address where the smart contract is deployed in the blockchain network.

[0113] Processing module 530 is used to use the second contract object to call the second function in the smart contract to publish or update the public key and certificate of the server, and the second function includes a function for publishing or updating public key information and certificate information.

[0114] Based on the method in the above embodiment, an embodiment of the present application provides an electronic device. The electronic device may include: at least one memory for storing a program; at least one processor for executing the program stored in the memory. Wherein, when the program stored in the memory is executed, the processor is used to execute the method described in the above embodiment. Exemplarily, the electronic device may be a mobile phone, a tablet computer, a desktop computer, a laptop computer, a handheld computer, a notebook computer, a server, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook, and a cellular phone, a personal digital assistant (personal digital assistant, PDA), an augmented reality (augmented reality, AR) device, a virtual reality (virtual reality, VR) device, an artificial intelligence (artificial intelligence, AI) device, a wearable device, a vehicle-mounted device, a smart home device and / or a smart city device. The embodiment of the present application does not impose any special restrictions on the specific type of the electronic device.

[0115] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0116] It is understood that the various numerical numbers involved in the embodiments of the present application are only for the convenience of description and are not used to limit the scope of the embodiments of the present application. It should be understood that in the embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0117] The specific implementation methods described above further illustrate the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the present application should be included in the scope of protection of the present application.

Claims

1. A quantum secure identity authentication method based on blockchain, characterized in that: Applied to a client, the method comprises: Call the smart contract deployed on the blockchain network to obtain the public key and certificate previously published or updated by the server through the smart contract; The smart contract deployed by calling the blockchain network includes: Connect to a first node in the blockchain network using a Web3 library; Creating a first contract object using the access interface provided by the smart contract and the address at which the smart contract is deployed in the blockchain network; Using the first contract object to call a first function in the smart contract to obtain the public key and the certificate, the first function comprising a function for querying the public key information and the certificate information; In response to determining that the server has passed the authentication based on the certificate, a quantum secure identity authentication is performed with the server using the public key to establish a communication connection that complies with the target protocol; the quantum secure identity authentication is used to replace the non-quantum secure identity authentication originally included in the target protocol; the public key is a KEM public key, and the quantum secure identity authentication is an identity authentication that uses the KEM public key to execute the KEM algorithm; The method also applies a server, and the method includes: Use the Web3 library to connect to the second node in the blockchain network; Creating a second contract object using an access interface provided by a smart contract deployed on a blockchain network and an address at which the smart contract is deployed on the blockchain network; Using the second contract object to call a second function in the smart contract to publish or update the public key and certificate of the server, the second function includes a function for publishing or updating the public key information and the certificate information; The updating of the public key and certificate of the server includes updating the public key and certificate to a new public key and certificate; Before using the second contract object to call the second function in the smart contract to update the public key and certificate of the server, the method further includes: Generate the new public key and certificate; Connect to a third node of the blockchain network using the Web3 library; Creating a third contract object using the access interface provided by the smart contract and the address where the smart contract is deployed in the blockchain network; The third function in the smart contract is called using the third contract object to revoke the public key and certificate of the server, wherein the third function includes a function for revoking the public key information and the certificate information.

2. The method according to claim 1, characterized in that The authentication based on the certificate includes: authentication of the legitimacy of the server, authentication of the validity period of the certificate, authentication of the legitimacy of the signature of the certificate, and authentication based on the hash value of the certificate to determine that the certificate has not been tampered with.

3. The method according to claim 1, characterized in that The establishing of a communication connection conforming to the target protocol comprises: generating a session key based on the quantum secure authentication; The session key is used to establish a communication connection with the server in accordance with the target protocol, so as to perform encrypted communication between the server and the client.

4. A quantum security identity authentication device based on blockchain, characterized in that: Deployed on a client, the device is used to execute the method according to claim 1, and the device comprises: A calling module, used to call the smart contract deployed on the blockchain network to obtain the public key and certificate previously published or updated by the server through the smart contract; A processing module is used for, in response to determining that the server has passed the authentication based on the certificate, performing quantum secure identity authentication with the server using the public key to establish a communication connection that complies with the target protocol; the quantum secure identity authentication is used to replace the non-quantum secure identity authentication originally included in the target protocol.

5. A quantum secure identity authentication device based on blockchain, characterized in that: Deployed on the server, the device is used to execute the method according to claim 1, and the device includes: A connection module for connecting to a second node in the blockchain network using the Web3 library; A creation module, configured to create a second contract object by using an access interface provided by a smart contract deployed on a blockchain network and an address at which the smart contract is deployed on the blockchain network; A processing module is used to use the second contract object to call the second function in the smart contract to publish or update the public key and certificate of the server, and the second function includes a function for publishing or updating the public key information and the certificate information.

6. An electronic device, characterized in that: include: at least one memory for storing a program; At least one processor, configured to execute the program stored in the memory; wherein, when the program stored in the memory is executed, the processor is configured to execute the method according to any one of claims 1 to 3.

Images