Cipher equipment management secure channel establishment method fused with post quantum cryptography technology

Abstract

The invention discloses a method for establishing a password equipment management secure channel fused with a post-quantum cryptography technology. The method comprises the following steps: before the establishment of a secure channel, respectively generating post-quantum key pairs for an initiator and a responder; a secure channel establishment process: on the basis of existing secure channel establishment, a post quantum cryptography technology is fused, and the method specifically comprises the following steps: S1, an initiator establishes a request message through a secure channel based on but not limited to a Kyber algorithm and a Diithium algorithm, and sends the request message to a responder; s2, the responder decrypts and verifies the request message based on but not limited to a Kyber algorithm and a Diithium algorithm, establishes the request message through a secure channel based on but not limited to the Kyber algorithm and the Diithium algorithm after the verification is passed, and sends the request message to the initiator; s3, the initiator decrypts and verifies the request message based on, but not limited to, a Kyber algorithm and a Diithium algorithm, and after verification is passed, the step S4 is continued; and S4, the initiator and the responder obtain the session key. According to the method, the security requirement of quantum computing resistance can be met.

Description

Technical Field

[0001] The present invention relates to the field of quantum information and cryptographic technology, and in particular to a method for establishing a secure channel between a cryptographic device management system and a managed device by integrating post-quantum cryptographic technology. Background Art

[0002] Quantum computing is a technology that uses quantum superposition, entanglement and other principles to achieve parallel computing. With the rapid development of quantum computing technology in recent years, quantum computing has demonstrated the ability to surpass classical computers on specific issues. Famous quantum algorithms such as Shor and Grover have proved that existing public key cryptographic algorithms based on computational complexity problems are difficult to resist quantum computing cryptographic attacks. Cryptographic security experts point out that with the development and progress of quantum technology, "steal first, decrypt later" attacks are becoming more and more common. In order to solve the security risks brought by quantum computers to cryptographic communications, post-quantum cryptography (PQC) that can resist quantum computing has emerged. The National Institute of Standards and Technology (NIST) of the United States has announced post-quantum cryptographic algorithms that can resist quantum computing, among which Kyber is a secure key encapsulation mechanism that resists adaptive chosen ciphertext attacks (IND-CCA2), and Dilithium is a highly unforgeable (EUF-CMA) secure digital signature algorithm. Both cryptographic algorithms are designed to deal with attacks from quantum computers, and the security level can be converted by changing only a few parameters during operation.

[0003] GM / T 0050 "Technical Specification for Cryptographic Equipment Management" is a standard specification for cryptographic equipment management issued by the State Cryptography Administration. This specification specifies the application interface, management process, management protocol, and management information structure of cryptographic equipment management, clarifies the specific requirements for cryptographic equipment to implement management agents, and realizes the independence of equipment management applied to specific cryptographic equipment. Cryptographic equipment designed and developed in accordance with this standard can be uniformly managed and configured by the management system developed in accordance with this standard.

[0004] This technical specification has clearly defined the sequence and calculation process for establishing a secure channel between the managed cryptographic device and the cryptographic device management system, such as Figure 1As shown, it is the existing technology, and the specific steps will not be repeated here. However, the current secure channel between the managed cryptographic device and the cryptographic device management system supports SM2 and SM3, among which the SM2 algorithm is based on the elliptic curve cryptography algorithm (Elliptic Curve Cryptography, referred to as: ECC, SM2 algorithm is the ECC system), but with the rapid development of quantum computing, the existing ECC algorithm has been facing the risk of being attacked. Researchers have proved through mathematics that quantum computers can easily crack ECC keys, so the existing secure channel establishment method based on the SM2 algorithm has been difficult to resist the security risks brought by quantum computing. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a method for establishing a cryptographic device management security channel that integrates post-quantum cryptographic technology, so as to enhance the security channel between the managed cryptographic device and the cryptographic device management system and meet the security requirements of anti-quantum computing.

[0006] In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows.

[0007] A method for establishing a cryptographic device management secure channel integrating post-quantum cryptographic technology comprises the following steps:

[0008] Before the secure channel is established: generate a post-quantum encryption key pair and a post-quantum signature key pair for the initiator and responder respectively;

[0009] Secure channel establishment process: Based on the existing secure channel establishment, by integrating post-quantum cryptography technology, the security strength of the secure channel against quantum computing is improved without changing the secure channel establishment process. Specifically, the following steps are included:

[0010] S1. The initiator sends a request message to the responder through a secure channel based on but not limited to the Kyber algorithm and the Dilithium algorithm;

[0011] S2. The responder decrypts and verifies the request message based on but not limited to the Kyber algorithm and the Dilithium algorithm, and after the verification is passed, establishes a request message through a secure channel based on but not limited to the Kyber algorithm and the Dilithium algorithm and sends it to the initiator;

[0012] S3. The initiator decrypts and verifies the request message based on, but not limited to, the Kyber algorithm and the Dilithium algorithm, and proceeds to step S4 after the verification is passed;

[0013] S4. The initiator and responder obtain the session key.

[0014] Preferably, the method is based on a post-quantum key management module, a managed cryptographic device and a cryptographic device management system; the post-quantum key management module is used for the generation and offline distribution of post-quantum key pairs, including encryption key pairs based on the Kyber algorithm and signature key pairs based on the Dilithium algorithm; the managed cryptographic device is the initiator, and the cryptographic device management system is the responder;

[0015] The post-quantum encryption key pair and post-quantum signature key pair generated by the pre- and post-quantum key management modules for the initiator and responder are respectively established in the secure channel, which are: the post-quantum encryption public key PQCEncPubKey of the initiator A 、Post-quantum encryption private key PQCEncSecKey of the initiator A 、Post-quantum signature public key PQCSignPubKey of the initiator A 、Post-quantum signature private key PQCSignSecKey of the initiator A And the responder's post-quantum encryption public key PQCEncPubKey B , responder post-quantum encryption private key PQCEncSecKey B 、Responder post-quantum signature public key PQCSignPubKey B 、Responder post-quantum signature private key PQCSignSecKey B The post-quantum key management module distributes the respective post-quantum encryption key pairs, post-quantum signature key pairs, and the other party’s post-quantum encryption public key and post-quantum signature public key offline to the initiator and responder through secure media;

[0016] The initiator and responder also obtain a classic key pair, which are: the initiator's encryption public key EncPubKey A 、Initiator encryption private key EncSecKey A 、SignPubKey of the initiator A 、SignSecKey, the signature private key of the initiator A And the responder's encrypted public key EncPubKey B , Responder encryption private key EncSecKey B , responder signature public key SignPubKey B , responder signature private key SignSecKey B .

[0017] Preferably, the step S1 specifically includes the following steps:

[0018] S11. The initiator uses the responder's encrypted public key based on the Kyber algorithm to generate the first set of shared key plaintext K1 and shared ciphertext key K1C. The calculation process is as follows:

[0019] K1C=PQC_PubKey_Enc(K1,PQCEncPubKey B );

[0020] Among them, PQC_PubKey_Enc represents a key encryption method based on the PQC public key encryption algorithm. The first parameter K1 of this method represents the shared key generated by this method, and the second parameter represents the encrypted public key of the responder's post-quantum algorithm. The return value of this method is the ciphertext data of the shared key.

[0021] S12. The initiator signs K1C using the initiator's signature private key based on the Dilithium algorithm to obtain signature data K1S. The calculation process is as follows:

[0022] K1S=PQC_SecKey_Sign(K1C,PQCSignSecKey A );

[0023] Among them, PQC_SecKey_Sign represents a signature method based on the PQC digital signature algorithm. The first parameter of this method represents the data to be signed, and the second parameter represents the signature private key of the initiator's post-quantum algorithm. The return value of this method is the signature data.

[0024] S13. The initiator uses the existing classic asymmetric algorithm to encrypt K1C and K1S using the responder's certificate public key, and sends ResultA to the responder through a secure channel to establish a request message. The calculation process is as follows:

[0025] R AE =E(EncPubKey B ,K1C|K1S);

[0026] R AS =S(SignSecKey A ,H(K1C|K1S));

[0027] ResultA=R AE |R AS .

[0028] Preferably, the PQC public key encryption algorithm includes but is not limited to the Kyber algorithm and any other public key encryption algorithm based on the Kyber algorithm with any adjustment or variation; the PQC digital signature algorithm includes but is not limited to the Dilithium algorithm and any other data signature algorithm based on the Dilithium algorithm with any adjustment or variation.

[0029] Preferably, the step S2 specifically includes the following steps:

[0030] S21. The responder uses the existing classic asymmetric algorithm to decrypt and obtain the original data of K1C and K1S, and uses the existing classic asymmetric algorithm to verify the signature data: R AS If the verification is successful, the process continues to step S22; if the verification fails, the process ends; the calculation process is as follows:

[0031] K1C'|K1S'=D(EncSecKey B ,R AE );

[0032] bool=V(SignPubKey A ,R AS ,H(K1C'|K1S'));

[0033] S22. The responder uses its own encrypted private key based on the Kyber algorithm to decrypt K1C to obtain the K1 plaintext. The responder uses the signature public key of the initiator based on the Dilithium algorithm to verify the signature K1S of K1C. The calculation process is as follows:

[0034] K1=PQC_SecKey_Dec(K1C,PQCEncSecKey B );

[0035] bool=PQC_Verify(K1S,K1C,PQCSignPubKey A );

[0036] If the quantum-resistant digital signature verification is successful, it means that the received K1 data is correct, and the process continues to step S23; if the quantum-resistant digital signature verification fails, it means that the received K1 data is wrong, and the process ends;

[0037] S23. The responder uses the initiator's encrypted public key based on the Kyber algorithm to generate the second set of shared key plaintext K2 and shared ciphertext key K2C; the responder uses the responder's signature private key based on the Dilithium algorithm to sign K2C to obtain the signature data K2S. The calculation process is as follows:

[0038] K2C=PQC_PubKey_Enc(K2,PQCEncPubKey A );

[0039] K2S=PQC_SecKey_Sign(K2C,PQCSignSecKey B );

[0040] S24. The responder uses the existing classic asymmetric algorithm to encrypt K2C and K2S using the initiator's certificate public key, and sends ResultB to the responder through a secure channel. The calculation process is as follows:

[0041] R BE =E(EncPubKey A ,K2C|K2S);

[0042] R BS =S(SignSecKey B ,H(K2C|K2S));

[0043] Result B = R BE |R BS .

[0044] Preferably, the step S3 specifically includes the following steps:

[0045] S31. The initiator uses the existing classic asymmetric algorithm to decrypt and obtain the original data of K2C and K2S, and uses the existing classic asymmetric algorithm to verify the signature data: R BS If the verification is successful, the process continues to step S32; if the verification fails, the process ends; the calculation process is as follows:

[0046] K2C'|K2S'=D(PQCEncSecKey A ,R BE );

[0047] bool=V(SignPubKey B ,R BS ,H(K2C'|K2S'));

[0048] S32. The initiator uses its own encrypted private key to decrypt K2C based on the Kyber algorithm to obtain the K2 plaintext. The responder uses the responder's signature public key based on the Dilithium algorithm to verify the signature K2S of K2C. The calculation process is as follows:

[0049] K2=PQC_SecKey_Dec(K2C,PQCEncSecKey A );

[0050] bool=PQC_Verify(K2S,K2C,PQCSignPubKey B );

[0051] If the quantum-resistant digital signature verification passes, it means that the K2 data is correct, and the process continues to step S4; if the quantum-resistant digital signature verification fails, it means that the K2 data is wrong, and the process ends.

[0052] Preferably, the step S4 is specifically:

[0053] The initiator and responder have obtained the first group of shared key plaintext K1 and the second group of shared key plaintext K2. The two parties perform XOR on K1 and K2 to obtain the current session key SK. The calculation process is as follows:

[0054]

[0055] Due to the adoption of the above technical scheme, the technical progress achieved by the present invention is as follows.

[0056] The present invention clarifies the form, scenario and upgrade plan of the post-quantum cryptographic technology integrated into the secure channel between the managed cryptographic devices and the cryptographic device management system. It can improve the anti-quantum computing capability of the secure channel and enhance the security strength without affecting the existing secure channel establishment process and data calculation steps. It is suitable for the migration of secure channels based on existing classical asymmetric algorithms to secure channels based on anti-quantum cryptographic algorithms. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 Establish a flow chart for the existing cryptographic device management system and the secure channel between the managed cryptographic devices;

[0058] Figure 2 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0059] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0060] A method for establishing a secure channel for cryptographic device management that integrates post-quantum cryptographic technology, combined with Figure 2 As shown, it is based on three parts: a post-quantum key management module, a managed cryptographic device, and a cryptographic device management system. The post-quantum key management module is mainly used for the generation and offline distribution of post-quantum key pairs, including encryption key pairs based on the Kyber algorithm and signature key pairs based on the Dilithium algorithm; the managed cryptographic device and the cryptographic device management system are two participants in the establishment of a secure channel, the managed cryptographic device is the initiator role, and the cryptographic device management system is the responder role. The present invention includes the following steps:

[0061] Before the secure channel is established, the post-quantum key management module needs to generate a post-quantum encryption key pair and a post-quantum signature key pair for the initiator and responder, respectively: the initiator's post-quantum encryption public key PQCEncPubKey A 、Post-quantum encryption private key PQCEncSecKey of the initiator A 、Post-quantum signature public key PQCSignPubKey of the initiator A、Post-quantum signature private key PQCSignSecKey of the initiator A And the responder's post-quantum encryption public key PQCEncPubKey B , responder post-quantum encryption private key PQCEncSecKey B 、Responder post-quantum signature public key PQCSignPubKey B 、Responder post-quantum signature private key PQCSignSecKey B The post-quantum key management module distributes each party’s post-quantum encryption key pair, post-quantum signature key pair, and the other party’s post-quantum encryption public key and post-quantum signature public key offline to the initiator and responder through secure media.

[0062] The initiator and the responder also obtain a classic key pair, and the method of obtaining the classic key pair remains unchanged (the present invention does not include or limit the method of obtaining the classic key pair by the initiator and the responder), which are: the initiator's encryption public key EncPubKey A 、Initiator encryption private key EncSecKey A 、SignPubKey of the initiator A 、SignSecKey, the signature private key of the initiator A And the responder's encrypted public key EncPubKey B , Responder encryption private key EncSecKey B , responder signature public key SignPubKey B , responder signature private key SignSecKey B .

[0063] Secure channel establishment process: Based on the existing secure channel establishment, by integrating post-quantum cryptography technology, the security strength of the secure channel against quantum computing is improved without changing the secure channel establishment process. Specifically, the following steps are included:

[0064] S1. The initiator sends a request message to the responder through a secure channel based on but not limited to the Kyber algorithm and the Dilithium algorithm. The specific steps include:

[0065] S11. The initiator uses the responder's encrypted public key based on the Kyber algorithm to generate the first set of shared key plaintext K1 and shared ciphertext key K1C. The calculation process is as follows:

[0066] K1C=PQC_PubKey_Enc(K1,PQCEncPubKey B );

[0067] Among them, PQC_PubKey_Enc represents a key encryption method based on the PQC public key encryption algorithm (it should be pointed out that the PQC public key encryption algorithm referred to in the present invention includes but is not limited to the Kyber algorithm and any other public key encryption algorithm based on any adjustment or change of the Kyber algorithm). The first parameter K1 of this method represents the shared key generated by this method, and the second parameter represents the encrypted public key of the responder's post-quantum algorithm. The return value of this method is the ciphertext data of the shared key.

[0068] S12. The initiator signs K1C using the initiator's signature private key based on the Dilithium algorithm to obtain signature data K1S. The calculation process is as follows:

[0069] K1S=PQC_SecKey_Sign(K1C,PQCSignSecKey A );

[0070] Among them, PQC_SecKey_Sign represents a signature method based on the PQC digital signature algorithm (it should be pointed out that the PQC digital signature method referred to in the present invention includes but is not limited to the Dilithium algorithm and any other data signature algorithm based on any adjustment or variation of the Dilithium algorithm). The first parameter of this method represents the data to be signed, and the second parameter represents the signature private key of the initiator's post-quantum algorithm. The return value of this method is the signature data.

[0071] S13. The initiator uses the existing classic asymmetric algorithm to encrypt K1C and K1S using the responder's certificate public key, and sends ResultA to the responder through a secure channel to establish a request message. The calculation process is as follows:

[0072] R AE =E(EncPubKey B ,K1C|K1S);

[0073] R AS =S(SignSecKey A ,H(K1C|K1S));

[0074] ResultA=R AE |R AS .

[0075] S2. The responder decrypts and verifies the request message based on but not limited to the Kyber algorithm and the Dilithium algorithm, and after the verification is passed, establishes a request message through a secure channel based on but not limited to the Kyber algorithm and the Dilithium algorithm and sends it to the initiator. Specifically, the following steps are included:

[0076] S21. The responder uses the existing classic asymmetric algorithm to decrypt and obtain the original data of K1C and K1S, and uses the existing classic asymmetric algorithm to verify the signature data: R AS If the verification is successful, the process continues to step S22; if the verification fails, the process ends; the calculation process is as follows:

[0077] K1C'|K1S'=D(EncSecKey B ,R AE );

[0078] bool=V(SignPubKey A ,R AS ,H(K1C'|K1S')).

[0079] S22. The responder uses its own encrypted private key based on the Kyber algorithm to decrypt K1C to obtain the K1 plaintext. The responder uses the signature public key of the initiator based on the Dilithium algorithm to verify the signature K1S of K1C. The calculation process is as follows:

[0080] K1=PQC_SecKey_Dec(K1C,PQCEncSecKey B );

[0081] bool=PQC_Verify(K1S,K1C,PQCSignPubKey A );

[0082] If the quantum-resistant digital signature verification is successful, it means that the received K1 data is correct, and the process continues to step S23; if the quantum-resistant digital signature verification fails, it means that the received K1 data is wrong, and the process ends.

[0083] S23. The responder uses the initiator's encrypted public key based on the Kyber algorithm to generate the second set of shared key plaintext K2 and shared ciphertext key K2C; the responder uses the responder's signature private key based on the Dilithium algorithm to sign K2C to obtain the signature data K2S. The calculation process is as follows:

[0084] K2C=PQC_PubKey_Enc(K2,PQCEncPubKey A );

[0085] K2S=PQC_SecKey_Sign(K2C,PQCSignSecKey B ).

[0086] S24. The responder uses the existing classic asymmetric algorithm to encrypt K2C and K2S using the initiator's certificate public key, and sends ResultB to the responder through a secure channel. The calculation process is as follows:

[0087] R BE =E(EncPubKey A ,K2C|K2S);

[0088] R BS =S(SignSecKey B ,H(K2C|K2S));

[0089] Result B = R BE |R BS .

[0090] S3. The initiator decrypts and verifies the request message based on, but not limited to, the Kyber algorithm and the Dilithium algorithm, and proceeds to step S4 after the verification is passed. Specifically, the following steps are included:

[0091] S31. The initiator uses the existing classic asymmetric algorithm to decrypt and obtain the original data of K2C and K2S, and uses the existing classic asymmetric algorithm to verify the signature data: R BS If the verification is successful, the process continues to step S32; if the verification fails, the process ends; the calculation process is as follows:

[0092] K2C'|K2S'=D(PQCEncSecKey A ,R BE );

[0093] bool=V(SignPubKey B ,R BS ,H(K2C'|K2S')).

[0094] S32. The initiator uses its own encrypted private key to decrypt K2C based on the Kyber algorithm to obtain the K2 plaintext. The responder uses the responder's signature public key based on the Dilithium algorithm to verify the signature K2S of K2C. The calculation process is as follows:

[0095] K2=PQC_SecKey_Dec(K2C,PQCEncSecKey A );

[0096] bool=PQC_Verify(K2S,K2C,PQCSignPubKey B );

[0097] If the quantum-resistant digital signature verification passes, it means that the K2 data is correct, and the process continues to step S4; if the quantum-resistant digital signature verification fails, it means that the K2 data is wrong, and the process ends.

[0098] S4. The initiator and responder obtain the session key. Specifically:

[0099] The initiator and responder have obtained the first group of shared key plaintext K1 and the second group of shared key plaintext K2. The two parties perform XOR on K1 and K2 to obtain the current session key SK. The calculation process is as follows:

[0100]

[0101] S5. The secure channel establishment process ends.

[0102] When in use, the present invention, based on the establishment of a secure channel between the existing managed device and the cryptographic device management system, integrates post-quantum cryptographic technology, including adding a post-quantum key management module, maintaining the existing secure channel establishment steps and other technologies, thereby improving the security strength of the secure channel against quantum computing without changing the secure channel establishment process.

Claims

1. A method for establishing a secure channel for cryptographic device management integrating post-quantum cryptographic technology, characterized in that: The following steps are involved: Before the secure channel is established: generate a post-quantum encryption key pair and a post-quantum signature key pair for the initiator and responder respectively; Secure channel establishment process: Based on the existing secure channel establishment, by integrating post-quantum cryptography technology, the security strength of the secure channel against quantum computing is improved without changing the secure channel establishment process. Specifically, the following steps are included: S1. The initiator sends a request message to the responder through a secure channel based on but not limited to the Kyber algorithm and the Dilithium algorithm; S2. The responder decrypts and verifies the request message based on but not limited to the Kyber algorithm and the Dilithium algorithm, and after the verification is passed, establishes a request message through a secure channel based on but not limited to the Kyber algorithm and the Dilithium algorithm and sends it to the initiator; S3. The initiator decrypts and verifies the request message based on, but not limited to, the Kyber algorithm and the Dilithium algorithm, and proceeds to step S4 after the verification is passed; S4. The initiator and responder obtain the session key.

2. According to claim 1, a method for establishing a cryptographic device management secure channel integrating post-quantum cryptographic technology is characterized in that: The method is based on a post-quantum key management module, a managed cryptographic device, and a cryptographic device management system; The post-quantum key management module is used for the generation and offline distribution of post-quantum key pairs, including encryption key pairs based on the Kyber algorithm and signature key pairs based on the Dilithium algorithm; the managed cryptographic device is the initiator, and the cryptographic device management system is the responder; The post-quantum encryption key pair and post-quantum signature key pair generated by the pre- and post-quantum key management modules for the initiator and responder are respectively established in the secure channel, which are: the post-quantum encryption public key PQCEncPubKey of the initiator A 、Post-quantum encryption private key PQCEncSecKey of the initiator A 、Post-quantum signature public key PQCSignPubKey of the initiator A 、Post-quantum signature private key PQCSignSecKey of the initiator A And the responder's post-quantum encryption public key PQCEncPubKey B 、Responder post-quantum encryption private key PQCEncSecKey B 、Responder post-quantum signature public key PQCSignPubKey B 、Responder post-quantum signature private key PQCSignSecKey B The post-quantum key management module distributes the respective post-quantum encryption key pairs, post-quantum signature key pairs, and the other party’s post-quantum encryption public key and post-quantum signature public key offline to the initiator and responder through secure media; The initiator and responder also obtain a classic key pair, which are: the initiator's encryption public key EncPubKey A 、Initiator encryption private key EncSecKey A 、SignPubKey of the initiator A 、SignSecKey, the signature private key of the initiator A And the responder's encrypted public key EncPubKey B , Responder encryption private key EncSecKey B , responder signature public key SignPubKey B , responder signature private key SignSecKey B .

3. According to claim 2, a method for establishing a cryptographic device management secure channel integrating post-quantum cryptographic technology is characterized in that: The step S1 specifically includes the following steps: S11. The initiator uses the responder's encrypted public key based on the Kyber algorithm to generate the first set of shared key plaintext K1 and shared ciphertext key K1C. The calculation process is as follows: K1C=PQC_PubKey_Enc(K1,PQCEncPubKey B ); Among them, PQC_PubKey_Enc represents a key encryption method based on the PQC public key encryption algorithm. The first parameter K1 of this method represents the shared key generated by this method, and the second parameter represents the encrypted public key of the responder's post-quantum algorithm. The return value of this method is the ciphertext data of the shared key. S12. The initiator signs K1C using the initiator's signature private key based on the Dilithium algorithm to obtain signature data K1S. The calculation process is as follows: K1S=PQC_SecKey_Sign(K1C,PQCSignSecKey A ); Among them, PQC_SecKey_Sign represents a signature method based on the PQC digital signature algorithm. The first parameter of this method represents the data to be signed, and the second parameter represents the signature private key of the initiator's post-quantum algorithm. The return value of this method is the signature data. S13. The initiator uses the existing classic asymmetric algorithm to encrypt K1C and K1S using the responder's certificate public key, and sends ResultA to the responder through a secure channel to establish a request message. The calculation process is as follows: R AE N ( E ( EncPubKey B ,K1C|K1S) R AS =S(SignSecKey A ,H(K1C|K1S)); ResultA=R AE |R AS 。 4. According to claim 3, a method for establishing a cryptographic device management secure channel integrating post-quantum cryptographic technology is characterized in that: The PQC public key encryption algorithm includes but is not limited to the Kyber algorithm and any other public key encryption algorithm based on the Kyber algorithm with any adjustment or variation; the PQC digital signature algorithm includes but is not limited to the Dilithium algorithm and any other data signature algorithm based on the Dilithium algorithm with any adjustment or variation.

5. According to claim 3, a method for establishing a cryptographic device management secure channel integrating post-quantum cryptographic technology is characterized in that: The step S2 specifically includes the following steps: S21. The responder uses the existing classic asymmetric algorithm to decrypt and obtain the original data of K1C and K1S, and uses the existing classic asymmetric algorithm to verify the signature data: R AS If the verification is successful, the process continues to step S22; if the verification fails, the process ends; the calculation process is as follows: K1C'|K1S'=D(EncSecKey B ,R AE ); bool=V(SignPubKey A ,R AS ,H(K1C'|K1S')); S22. The responder uses its own encrypted private key based on the Kyber algorithm to decrypt K1C to obtain the K1 plaintext. The responder uses the signature public key of the initiator based on the Dilithium algorithm to verify the signature K1S of K1C. The calculation process is as follows: K1=PQC_SecKey_Dec(K1C,PQCEncSecKey B ); bool=PQC_Verify(K1S,K1C,PQCSignPubKey A ); If the quantum-resistant digital signature verification is successful, it means that the received K1 data is correct, and the process continues to step S23; if the quantum-resistant digital signature verification fails, it means that the received K1 data is wrong, and the process ends; S23. The responder uses the initiator's encrypted public key based on the Kyber algorithm to generate the second set of shared key plaintext K2 and shared ciphertext key K2C; the responder uses the responder's signature private key based on the Dilithium algorithm to sign K2C to obtain the signature data K2S. The calculation process is as follows: K2C=PQC_PubKey_Enc(K2,PQCEncPubKey A ); K2S=PQC_SecKey_Sign(K2C,PQCSignSecKey B ); S24. The responder uses the existing classic asymmetric algorithm to encrypt K2C and K2S using the initiator's certificate public key, and sends ResultB to the responder through a secure channel. The calculation process is as follows: R BE N ( E ( EncPubKey A ,K2C|K2S) R BS =S(SignSecKey B ,H(K2C|K2S)); ResultB=R BE |R BS 。 6. According to claim 5, a method for establishing a cryptographic device management secure channel integrating post-quantum cryptographic technology is characterized in that: The step S3 specifically comprises the following steps: S31. The initiator uses the existing classic asymmetric algorithm to decrypt and obtain the original data of K2C and K2S, and uses the existing classic asymmetric algorithm to verify the signature data: R BS If the verification is successful, the process continues to step S32; if the verification fails, the process ends; the calculation process is as follows: K2C’|K2S’=D(PQCEncSecKey A ,R BE ); bool=V(SignPubKey B ,R BS ,H(K2C'|K2S')); S32. The initiator uses its own encrypted private key to decrypt K2C based on the Kyber algorithm to obtain the K2 plaintext. The responder uses the responder's signature public key based on the Dilithium algorithm to verify the signature K2S of K2C. The calculation process is as follows: K2=PQC_SecKey_Dec(K2C,PQCEncSecKey A ); bool=PQC_Verify(K2S,K2C,PQCSignPubKey B ); If the quantum-resistant digital signature verification passes, it means that the K2 data is correct, and the process continues to step S4; if the quantum-resistant digital signature verification fails, it means that the K2 data is wrong, and the process ends.

7. According to claim 6, a method for establishing a cryptographic device management secure channel integrating post-quantum cryptographic technology is characterized in that: The step S4 is specifically as follows: The initiator and responder have obtained the first group of shared key plaintext K1 and the second group of shared key plaintext K2. The two parties perform XOR on K1 and K2 to obtain the current session key SK. The calculation process is as follows:

Images