Single packet authentication method and device based on quantum key, and storage medium

Abstract

The embodiment of the invention provides a single packet authentication method and device based on a quantum key and a storage medium, and relates to the technical field of single packet authentication. The method comprises the following steps: determining a quantum key acquisition mode and acquiring a quantum key according to the mode; determining verification basic information corresponding to the single packet authentication request, and determining a target security algorithm corresponding to the single packet authentication request; performing digest operation on the verification basic information based on a target security algorithm to obtain a first digest operation value, and encrypting the first digest operation value by using a quantum key to obtain an integrity verification value; and based on the SPA basic information of the single packet authentication request, in combination with the verification basic information and the integrity verification value, performing message assembly to obtain an SPA message which is sent to a server for single packet authentication. According to the embodiment of the invention, encryption operation is performed on the abstract in the single packet authentication process in combination with the quantum key, so that the risk that the single packet authentication message is attacked is reduced, and the security of single packet authentication is effectively improved.

Description

Technical Field

[0001] The present application relates to the technical field of single-packet authentication, and more specifically, to a single-packet authentication method, device, and storage medium based on quantum key. Background Art

[0002] Single packet authorization (SPA) is a network security technology that completes the identity authentication process through a single encrypted data packet, thereby improving the security and efficiency of authentication. This technology verifies the identity of the device and user before allowing access to the network, thereby achieving the effect of "network invisibility" and preventing attackers from finding the service address and port.

[0003] The traditional single-packet authentication scheme is based on cryptographic technology, combined with message authentication codes or digital signatures to achieve authentication. After negotiation logic such as key exchange, identity authentication, and encryption algorithm negotiation, a session key between the two parties is generated. However, once the data channel of this scheme is attacked by network hackers during the establishment process, there may be security risks such as the session key being cracked and private data being stolen. For example, when the client performs the first authentication on the server through the SPA message, the SPA message needs to be encrypted with the initial default password. After the initial authentication is passed, the shared key of the next SPA message is updated through the key exchange protocol. In this process, if the initial default password and encryption algorithm are leaked, the security of the single-packet authentication will be invalidated, and the server will still face the risk of TLS (Transport Layer Security) denial of service attacks. In summary, there is an urgent need for an implementation scheme that can improve the security of single-packet authentication. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a single-packet authentication method, device and storage medium based on quantum key, so as to improve the security of single-packet authentication.

[0005] In a first aspect, an embodiment of the present application provides a single-packet authentication method based on a quantum key, comprising:

[0006] Determining a quantum key acquisition mode corresponding to the single-packet authentication request, and acquiring a quantum key based on the quantum key acquisition mode;

[0007] Determining verification basic information corresponding to the single-package authentication request, and determining a target security algorithm corresponding to the single-package authentication request;

[0008] Performing a digest operation on the verification basic information based on the target security algorithm to obtain a first digest operation value, and encrypting the first digest operation value using the quantum key to obtain an integrity check value;

[0009] Based on the SPA basic information of the single-packet authentication request, and in combination with the verification basic information and the integrity check value, a message is assembled to obtain a SPA message for sending to the server for single-packet authentication;

[0010] The SPA message includes a security algorithm identification field for identifying the type of the target security algorithm.

[0011] In the embodiment of the present application, by combining the quantum key to perform encryption operation on the summary in the single-packet authentication process, the risk of the single-packet authentication message being attacked is reduced, thereby effectively improving the security of the single-packet authentication.

[0012] In some possible embodiments, obtaining a quantum key based on the quantum key acquisition mode includes at least one of the following:

[0013] In the case where it is determined that the quantum key acquisition mode is an online acquisition mode, obtaining key server address information and key basic information corresponding to the online acquisition mode, and obtaining a corresponding quantum key from a pre-configured key server based on the key server address information and the key basic information;

[0014] In the case where it is determined that the quantum key acquisition mode is an offline acquisition mode, key storage location information and key basic information corresponding to the offline acquisition mode are obtained, and based on the key storage location information and the key basic information, the corresponding quantum key is obtained from a pre-configured local key security storage device.

[0015] In the embodiments of the present application, different methods are configured to obtain quantum keys, which further increases the difficulty of cracking the key information, thereby further improving the security of single-package authentication.

[0016] In some possible embodiments, determining a quantum key acquisition mode corresponding to a single-packet authentication request includes:

[0017] Determining a request initiation time of the single-packet authentication request, and determining a quantum key acquisition mode corresponding to the single-packet authentication request based on the request initiation time;

[0018] Alternatively, the number of request initiations of the single-packet authentication request is determined, and a quantum key acquisition mode corresponding to the single-packet authentication request is determined based on the number of request initiations.

[0019] In the embodiment of the present application, by determining different key acquisition modes according to the initiation time or number of single-package authentication requests, the difficulty of cracking the key information is further increased, thereby further improving the security of single-package authentication.

[0020] In some possible embodiments, the SPA message includes a message sequence number;

[0021] The message sequence number is randomly generated based on the number of times the SPA message is sent.

[0022] In an embodiment of the present application, by randomly generating a corresponding message sequence number based on the number of times the message is sent, the difficulty of a replay attack can be further increased, thereby further improving the security of single-packet authentication.

[0023] In some possible embodiments, the SPA message further includes a basic information identification field for identifying a type of the verification basic information.

[0024] In the embodiment of the present application, by identifying the type of basic verification information in the SPA message, the data involved in calculating the summary operation value can be flexibly configured, thereby further improving the security of single-packet authentication.

[0025] In a second aspect, the embodiment of the present application further provides a single-packet authentication method based on quantum key, comprising:

[0026] Identify a SPA message sent by a client in response to a single-packet authentication request initiated by the client based on the SPA message, determine a quantum key acquisition mode corresponding to the single-packet authentication request, and acquire a quantum key based on the quantum key acquisition mode;

[0027] Decrypting the integrity check value of the SPA message using the quantum key to obtain a first summary operation value;

[0028] Determine a target security algorithm based on a security algorithm identification field of the SPA message, and extract basic verification information corresponding to the single-packet authentication request based on the SPA message;

[0029] Performing a digest operation on the verification basic information based on the target security algorithm to obtain a second digest operation value;

[0030] The legitimacy of the single-packet authentication request of the client is verified based on the consistency of the first digest operation value and the second digest operation value.

[0031] In an embodiment of the present application, by obtaining the corresponding quantum key according to the authentication request initiated by the client to decrypt the integrity check value of the SPA message, the risk of single-packet authentication messages being attacked is effectively reduced, thereby effectively improving the security of single-packet authentication.

[0032] In some possible embodiments, the SPA message includes a message sequence number; the message sequence number is randomly generated by the client based on the number of times the SPA message is sent;

[0033] Performing a legitimacy check on the single-packet authentication request of the client based on the consistency between the first digest operation value and the second digest operation value, further comprising:

[0034] The message sequence number in the SPA message is extracted, and the message sequence number is repeatedly verified based on the stored sequence number cache information to perform a legitimacy check on the single-packet authentication request of the client.

[0035] In an embodiment of the present application, by randomly generating a corresponding message sequence number based on the number of times the message is sent, and repeatability verification of the sequence number is performed based on a sequence number cache mechanism, the difficulty of a replay attack can be effectively increased, thereby further improving the security of single-packet authentication.

[0036] In some possible embodiments, the identifying a SPA message sent by the client in response to a single-packet authentication request initiated by the client based on the SPA message includes:

[0037] An SPA message identifier is detected for a data packet sent by a client, and when the data packet carries the SPA message identifier, the data packet is identified as a SPA message sent by the client.

[0038] In the embodiment of the present application, by adding a corresponding SPA message identifier in the SPA message, rapid identification of the SPA message is achieved, which effectively improves the efficiency and reliability of single-packet authentication.

[0039] In a third aspect, an embodiment of the present application provides a single-packet authentication device based on a quantum key, comprising:

[0040] A first key acquisition module, used to determine a quantum key acquisition mode corresponding to a single-packet authentication request, and acquire a quantum key based on the quantum key acquisition mode;

[0041] an algorithm determination module, configured to determine basic verification information corresponding to the single-package authentication request, and determine a target security algorithm corresponding to the single-package authentication request;

[0042] an encryption operation module, configured to perform a summary operation on the verification basic information based on the target security algorithm to obtain a first summary operation value, and encrypt the first summary operation value using the quantum key to obtain an integrity check value;

[0043] A message assembly module, used to assemble the message based on the SPA basic information of the single-packet authentication request and in combination with the verification basic information and the integrity check value, to obtain a SPA message for sending to the server for single-packet authentication;

[0044] The SPA message includes a security algorithm identification field for identifying the type of the target security algorithm.

[0045] In a fourth aspect, an embodiment of the present application provides a single-packet authentication device based on a quantum key, comprising:

[0046] A second key acquisition module, configured to identify an SPA message sent by a client in response to a single-packet authentication request initiated by the client based on the SPA message, determine a quantum key acquisition mode corresponding to the single-packet authentication request, and acquire a quantum key based on the quantum key acquisition mode;

[0047] A message decryption module, used to decrypt the integrity check value of the SPA message using the quantum key to obtain a first summary operation value;

[0048] An information extraction module, configured to determine a target security algorithm based on a security algorithm identification field of the SPA message, and to extract basic verification information corresponding to the single-packet authentication request based on the SPA message;

[0049] A digest operation module, configured to perform a digest operation on the verification basic information based on the target security algorithm to obtain a second digest operation value;

[0050] A single-packet authentication module is used to perform a legitimacy check on the single-packet authentication request of the client based on the consistency between the first digest operation value and the second digest operation value.

[0051] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement the method described in any embodiment when executing the program.

[0052] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method described in any embodiment can be implemented.

[0053] In a seventh aspect, an embodiment of the present application provides a computer program product, wherein the computer program product includes a computer program, wherein the computer program can implement the method described in any embodiment when executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0055] Figure 1 A schematic diagram of a single-packet authentication method based on quantum key provided in an embodiment of the present application;

[0056] Figure 2 A schematic diagram of a flow chart of another single-packet authentication method based on quantum key provided in an embodiment of the present application;

[0057] Figure 3 A schematic diagram of the format of the SPA message provided in the embodiment of the present application;

[0058] Figure 4 A schematic diagram of the structure of a single-packet authentication device based on quantum key provided in an embodiment of the present application;

[0059] Figure 5 A schematic diagram of the structure of another single-packet authentication device based on quantum key provided in an embodiment of the present application;

[0060] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0062] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0063] It should be noted that in the traditional single-packet authentication scheme, when the key information and encryption algorithm of the encrypted data are leaked, the security of the SPA authentication will become invalid, and the server will still face the risk of TLS denial of service attacks.

[0064] In order to solve the problems existing in the above-mentioned prior art, the embodiments of the present application utilize quantum keys to encrypt the data in the single-packet authentication process, thereby avoiding the risk of the single-packet authentication data packet being attacked, thereby effectively improving the security of the single-packet authentication.

[0065] like Figure 1 As shown, the first embodiment of the present application provides a single-packet authentication method based on quantum key, which is executed by the client and may include the following steps:

[0066] S101. Determine a quantum key acquisition mode corresponding to a single-packet authentication request, and acquire a quantum key based on the quantum key acquisition mode.

[0067] Specifically, first, a quantum key acquisition environment is configured on the client and the server respectively, wherein the quantum key acquisition mode may include multiple modes, for example, at least an online acquisition mode (C / S model) and an offline acquisition model (local acquisition mode).

[0068] Based on this, when the client initiates a single-package authentication request, it can obtain the corresponding quantum key according to the quantum key acquisition mode corresponding to the currently initiated single-package authentication request.

[0069] S102: Determine basic verification information corresponding to the single-package authentication request, and determine a target security algorithm corresponding to the single-package authentication request.

[0070] Specifically, step S102 is to determine the verification basic information and the corresponding target security algorithm used to calculate the first summary operation value. For example, the verification basic information may include one or more of the user name, quantum key ID, message sequence number, identification field of the target security algorithm, etc., and these information will be assembled into a SPA message in plain text and transmitted to the server. It should be noted that, in order to facilitate calculation, the user name and quantum key ID can usually be combined into a creator identification as a verification basic information.

[0071] It should be noted that the number and type of basic verification information can be configured in a fixed form, for example, one or more of the creator identifier, message sequence number, security algorithm identifier field, etc. are used as basic verification information. It is understandable that the same rules need to be configured on the server side so that the server side performs summary operations with the basic verification information of the same information item.

[0072] It should be noted that the target security algorithm can also be selected and confirmed based on the time or number of times of the currently initiated single-packet authentication request, and the server and the client are configured with the same target security algorithm determination rule.

[0073] S103. Perform a summary operation on the verification basic information based on the target security algorithm to obtain a first summary operation value, and encrypt the first summary operation value using a quantum key to obtain an integrity check value.

[0074] Specifically, after determining the target security algorithm and verification basic information corresponding to the current single-package authentication request, the target security algorithm can be used to perform a digest operation on the verification basic information to obtain a first digest operation value. Then, the first digest operation value is encrypted using the quantum key obtained in step S101 to obtain an integrity check value.

[0075] S104: Based on the SPA basic information of the single packet authentication request, the basic verification information and the integrity check value are combined to assemble the message to obtain a SPA message for sending to the server for single packet authentication. The SPA message includes a security algorithm identification field for identifying the type of the target security algorithm.

[0076] It can be understood that based on the traditional SPA message assembly method, the SPA basic information such as the IP header and UDP information is combined with the above-determined verification basic information, the calculated integrity check value and the identification field corresponding to the determined target security algorithm, and the message is assembled based on the above information to finally obtain the SPA message. The format of the SPA message can be exemplarily as follows: Figure 3 shown.

[0077] It should be noted that the SPA basic information, verification basic information and security algorithm identification field are merely identity names used to indicate the functions or roles of various information in the SPA message. When the functions or roles of these information change (different verification basic information is selected), their identity names can be converted to each other: for example, when the security algorithm identification field can also be used as verification basic information to participate in the calculation of the first summary operation value; for another example, when the message sequence number is selected to participate in the calculation of the first summary operation value, the message sequence number can also be represented as one of the information items of the verification basic information; when the message sequence number is not selected to participate in the calculation of the first summary operation value, the message sequence number can also be represented as one of the information items of the SPA basic information.

[0078] Based on this, the summary in the single-packet authentication process is encrypted by combining quantum keys. And because the target security algorithm, verification basic information and the acquisition of quantum keys all have a certain degree of randomness, the complexity and robustness of calculating the integrity check value are increased in different dimensions, thereby reducing the risk of the final integrity check value being cracked and attacked, thereby effectively improving the security of single-packet authentication.

[0079] In some possible embodiments, in step S1, obtaining a quantum key based on a quantum key acquisition mode may include at least one of the following:

[0080] 1. When it is determined that the quantum key acquisition mode is the online acquisition mode, obtain the key server address information and key basic information corresponding to the online acquisition mode, and obtain the corresponding quantum key from the pre-configured key server based on the key server address information and the key basic information;

[0081] 2. When it is determined that the quantum key acquisition mode is the offline acquisition mode, the key storage location information and key basic information corresponding to the offline acquisition mode are obtained, and based on the key storage location information and the key basic information, the corresponding quantum key is obtained from a pre-configured local key security storage device.

[0082] Specifically, the online acquisition mode can also be called the C / S (Client / Server) mode, which pre-configures the key server for generating quantum keys, and then generates and obtains the corresponding quantum key from the key server through the online acquisition mode on the client according to the pre-configured IP address and port (key server address information) of the key server, as well as the quantum key ID, instance name and other key basic information. It can be understood that, corresponding to the client, the key server address information and the key basic information determination rules need to be configured on the server side accordingly, so that the server side can also generate and obtain the corresponding quantum key from the key server.

[0083] In addition, the offline acquisition mode can also be called the local acquisition mode. By configuring Ukey or TF card as a local key security storage device, the corresponding quantum key can be saved on the client and server respectively. Then, each time a single-package authentication is performed, the client and server can determine the corresponding key storage location information and key basic information according to the pre-configured rules and the current single-package authentication request, and obtain the corresponding quantum key from their respective local key security storage devices.

[0084] In some possible embodiments, in step S101, determining a quantum key acquisition mode corresponding to a single-packet authentication request may include:

[0085] Determining a request initiation time of the single-packet authentication request, and determining a quantum key acquisition mode corresponding to the single-packet authentication request based on the request initiation time;

[0086] Alternatively, the number of request initiations of the single-packet authentication request is determined, and the quantum key acquisition mode corresponding to the single-packet authentication request is determined based on the number of request initiations.

[0087] Specifically, the request initiation time of the current single-packet authentication request can be determined first, and then the quantum key acquisition mode corresponding to the current request initiation time can be determined according to the correspondence between the preset time information and the quantum key acquisition mode. Exemplarily, if the sum of the hour, minute, and second values ​​of the current request initiation time is an odd number, the corresponding quantum key acquisition mode is an online acquisition mode; conversely, if the sum of the hour, minute, and second values ​​of the current request initiation time is an even number, the corresponding quantum key acquisition mode is an offline acquisition mode. Exemplarily, if the current request initiation time belongs to a preset first preset time period, the corresponding quantum key acquisition mode is an online acquisition mode; if the current request initiation time belongs to a preset second preset time period, the corresponding quantum key acquisition mode is an offline acquisition mode. The specific mode determination rule can be set according to actual needs.

[0088] In addition, the number of times the current single-package authentication request is initiated can be determined first, that is, the cumulative number of times the single-package authentication request is initiated, and then the quantum key acquisition mode corresponding to the current number of request initiations can be determined based on the correspondence between the preset number of times information and the quantum key acquisition mode. Exemplarily, if the current number of request initiations is an odd number, the corresponding quantum key acquisition mode is an online acquisition mode, and conversely, if the current number of request initiations is an even number, the corresponding quantum key acquisition mode is an offline acquisition mode. The specific mode determination rules can be set according to actual needs.

[0089] In some possible embodiments, the SPA message includes a message sequence number;

[0090] The message sequence number is randomly generated based on the number of times the SPA message is sent.

[0091] It should be noted that a sequence number is generated in the client according to the number of times the SPA message is sent, and the sequence number is accumulated as the number of times the SPA message is sent increases. In the embodiment of the present application, based on the adaptively accumulated sequence number, a message sequence number is generated by using a preset random algorithm.

[0092] Based on this, a unique message sequence number is generated each time a SPA message is assembled. Traditional solutions usually only use naturally accumulated sequence numbers for SPA message assembly. In comparison, the random algorithm is used to further generate the corresponding message sequence number from the adaptively accumulated sequence number and use it as the information item for assembling the SPA message, which can increase the difficulty of the sequence number information being cracked and attacked, thereby further improving the security of single-packet authentication.

[0093] In some possible embodiments, the SPA message further includes a basic information identification field for identifying the type of verification basic information.

[0094] It should be noted that the amount and type of information included in the basic verification information can be configured to be selected according to the adaptability of the current single-package authentication request. Exemplarily, the corresponding information item can be selected as the basic verification information for calculating the first summary operation value according to the time (or number of times) of initiating the current single-package authentication request and the correspondence between the preset time (or number of times) and the amount of information (and / or type). It should be noted that based on the verification principle of the summary operation value, the server needs to be configured with the same basic verification information selection rules as the client to maintain consistency in the basic verification information obtained by both parties.

[0095] Based on this, by configuring random information item selection rules for verification basic information, the risk of SPA messages being cracked can be reduced, thereby further improving the security of single-packet authentication.

[0096] See also Figure 2 The second embodiment of the present application further provides a single-packet authentication method based on quantum key, which is executed by the server and may include the following steps:

[0097] S201. Identify a SPA message sent by a client in response to a single-packet authentication request initiated by the client based on the SPA message, determine a quantum key acquisition mode corresponding to the single-packet authentication request, and acquire a quantum key based on the quantum key acquisition mode.

[0098] Specifically, when the server recognizes the SPA message sent by the client, it determines the corresponding quantum key acquisition mode according to the client's single-packet authentication request, where the determination rules of the quantum key acquisition mode correspond to the rules configured in the client, for example, including online acquisition mode and offline acquisition mode; then the quantum key is acquired based on the determined quantum key acquisition mode.

[0099] It should be noted that the client needs to re-acquire the quantum key for encryption each time it assembles a SPA message. Correspondingly, the server needs to obtain the corresponding quantum key for decryption according to the corresponding mode each time it responds to a single-packet authentication request.

[0100] S202. Decrypt the integrity check value of the SPA message using the quantum key to obtain a first summary operation value.

[0101] After obtaining the quantum key, the integrity check value in the SPA message is extracted and decrypted using the quantum key to obtain the first summary operation value calculated by the client.

[0102] S203: Determine a target security algorithm based on the security algorithm identification field of the SPA message, and extract basic verification information corresponding to the single-packet authentication request based on the SPA message.

[0103] Specifically, the SPA message carries a security algorithm identification field, and the server can extract the security algorithm identification field from the SPA message to determine the corresponding target security algorithm.

[0104] In addition, the verification basic information corresponding to this single-packet authentication request is extracted from the SPA message. It can be understood that the information items of the verification basic information need to be consistent with the information items of the first summary operation value calculated by the client, and the specific information item determination rules can be pre-configured by agreement between the client and the server.

[0105] It should be noted that the security algorithm identification field and the basic verification information can be transmitted in plain text along with the SPA message.

[0106] S204: Perform a digest operation on the verification basic information based on the target security algorithm to obtain a second digest operation value.

[0107] It can be understood that after determining the target security algorithm and verification basic information corresponding to this single-packet authentication request, a digest operation is performed on the verification basic information using the target security algorithm to obtain a second digest operation value.

[0108] S205: Perform a validity check on the single-packet authentication request of the client based on the consistency between the first digest operation value and the second digest operation value.

[0109] Specifically, if the first digest operation value is consistent with the second digest operation value, the SPA message is judged to be legal, that is, the single-packet authentication request sent by the client this time is legal; otherwise, if the first digest operation value is inconsistent with the second digest operation value, the SPA message is judged to be illegal, that is, the single-packet authentication request sent by the client this time is not legal.

[0110] Based on this, by obtaining the corresponding quantum key according to the authentication request initiated by the client, the integrity check value of the SPA message can be decrypted, which effectively reduces the risk of single-packet authentication messages being attacked, thereby effectively improving the security of single-packet authentication.

[0111] In some possible embodiments, the SPA message includes a message sequence number; the message sequence number is randomly generated by the client based on the number of times the SPA message is sent;

[0112] Step S205, performing a validity check on the single-package authentication request of the client based on the consistency between the first digest operation value and the second digest operation value, may also include:

[0113] The message sequence number in the SPA message is extracted, and the message sequence number is repeatedly verified based on the stored sequence number cache information to verify the legitimacy of the client's single-packet authentication request.

[0114] It should be noted that in addition to verifying the legitimacy of the client's single-packet authentication request based on the consistency of the first digest operation value and the second digest operation value, the message sequence number in the SPA message can be further extracted to verify the legitimacy of the client's single-packet authentication request based on the repeatability of the message sequence number, thereby realizing replay attack detection of the SPA message.

[0115] Specifically, by establishing a cache mechanism on the server side, for each single-packet authentication request sent by the client, the corresponding message sequence number is extracted from the corresponding SPA message for cache, and the message sequence number extracted this time is compared with the cached historical message sequence number to determine whether the message sequence number extracted this time is within the range of recorded historical message sequence numbers. If so, the SPA message is determined to be illegal, that is, the single-packet authentication request sent by the client this time is not legal. Otherwise, the SPA message is determined to be legal, that is, the single-packet authentication request sent by the client this time is legal.

[0116] In some possible embodiments, identifying a SPA message sent by a client in response to a single-packet authentication request initiated by the client based on the SPA message includes:

[0117] An SPA message identifier is detected for a data packet sent by the client, and if the data packet carries the SPA message identifier, the data packet is identified as a SPA message sent by the client.

[0118] It should be noted that by adding the corresponding SPA message identifier in the SPA message, the server can detect the received message and identify whether the current message is a SPA message based on whether the SPA message identifier is detected, thereby enabling rapid identification of the SPA message and effectively improving the efficiency and reliability of single-packet authentication.

[0119] Please refer to Figure 4 , Figure 4 The block diagram of the single-packet authentication device based on quantum key provided by some embodiments of the present application is shown. It should be understood that the single-packet authentication device based on quantum key is different from the above-mentioned Figure 1 Corresponding to the method embodiment, it is able to execute each step involved in the above method embodiment. The specific functions of the single-packet authentication device based on quantum key can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0120] Figure 4 The single-package authentication device based on quantum key includes at least one software function module that can be stored in a memory in the form of software or firmware or fixed in the single-package authentication device based on quantum key, and the single-package authentication device based on quantum key includes:

[0121] A first key acquisition module 410, configured to determine a quantum key acquisition mode corresponding to a single-packet authentication request, and acquire a quantum key based on the quantum key acquisition mode;

[0122] The algorithm determination module 420 is used to determine the verification basic information corresponding to the single-package authentication request and determine the target security algorithm corresponding to the single-package authentication request;

[0123] The encryption operation module 430 is used to perform a summary operation on the verification basic information based on the target security algorithm to obtain a first summary operation value, and encrypt the first summary operation value using a quantum key to obtain an integrity check value;

[0124] The message assembly module 440 is used to assemble the message based on the SPA basic information of the single-packet authentication request and in combination with the verification basic information and the integrity check value to obtain a SPA message for sending to the server for single-packet authentication;

[0125] The SPA message includes a security algorithm identification field for identifying the type of the target security algorithm.

[0126] Please refer to Figure 5 , Figure 5 The block diagram of the single-packet authentication device based on quantum key provided by some embodiments of the present application is shown. It should be understood that the single-packet authentication device based on quantum key is different from the above-mentioned Figure 2 Corresponding to the method embodiment, it is able to execute each step involved in the above method embodiment. The specific functions of the single-packet authentication device based on quantum key can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0127] Figure 5 The single-package authentication device based on quantum key includes at least one software function module that can be stored in a memory in the form of software or firmware or fixed in the single-package authentication device based on quantum key, and the single-package authentication device based on quantum key includes:

[0128] A second key acquisition module 510 is used to identify the SPA message sent by the client in response to the single-packet authentication request initiated by the client based on the SPA message, determine the quantum key acquisition mode corresponding to the single-packet authentication request, and acquire the quantum key based on the quantum key acquisition mode;

[0129] A message decryption module 520, configured to decrypt the integrity check value of the SPA message using a quantum key to obtain a first summary operation value;

[0130] An information extraction module 530, configured to determine a target security algorithm based on a security algorithm identification field of the SPA message, and to extract basic verification information corresponding to a single-packet authentication request based on the SPA message;

[0131] A digest operation module 540 is used to perform a digest operation on the verification basic information based on a target security algorithm to obtain a second digest operation value;

[0132] The single packet authentication module 550 is used to perform a validity check on the single packet authentication request of the client based on the consistency between the first digest operation value and the second digest operation value.

[0133] It can be understood that the above-mentioned device item embodiment corresponds to the method item embodiment of the present invention. A single-packet authentication device based on quantum key provided by the embodiment of the present invention can implement the single-packet authentication method based on quantum key provided by any method item embodiment of the present invention.

[0134] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0135] like Figure 6 As shown, some embodiments of the present application provide an electronic device 600, which includes: a memory 610, a processor 620, and a computer program stored in the memory 610 and executable on the processor 620, wherein the processor 620 reads the program from the memory 610 through a bus 630 and executes the program to implement a method of any embodiment of the single-packet authentication method based on quantum keys as described above.

[0136] Processor 620 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 620 can be a microprocessor.

[0137] The memory 610 may be used to store instructions executed by the processor 620 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 620 of the disclosed embodiment may be used to execute instructions in the memory 610 to implement the method shown above. The memory 610 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0138] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon. The computer program is executed by a processor to execute the method described in the method embodiment.

[0139] Some embodiments of the present application further provide a computer program product, which, when executed on a computer, enables the computer to execute the method described in the method embodiment.

[0140] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0141] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0142] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0143] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0144] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0145] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0146] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A single-packet authentication method based on quantum key, characterized in that: include: Determining a quantum key acquisition mode corresponding to the single-packet authentication request, and acquiring a quantum key based on the quantum key acquisition mode; Determining verification basic information corresponding to the single-package authentication request, and determining a target security algorithm corresponding to the single-package authentication request; Performing a digest operation on the verification basic information based on the target security algorithm to obtain a first digest operation value, and encrypting the first digest operation value using the quantum key to obtain an integrity check value; Based on the SPA basic information of the single-packet authentication request, and in combination with the verification basic information and the integrity check value, a message is assembled to obtain a SPA message for sending to the server for single-packet authentication; The SPA message includes a security algorithm identification field for identifying the type of the target security algorithm.

2. The single-packet authentication method based on quantum key according to claim 1, characterized in that: Acquiring a quantum key based on the quantum key acquisition mode includes at least one of the following: In the case where it is determined that the quantum key acquisition mode is an online acquisition mode, obtaining key server address information and key basic information corresponding to the online acquisition mode, and obtaining a corresponding quantum key from a pre-configured key server based on the key server address information and the key basic information; In the case where it is determined that the quantum key acquisition mode is an offline acquisition mode, key storage location information and key basic information corresponding to the offline acquisition mode are obtained, and based on the key storage location information and the key basic information, the corresponding quantum key is obtained from a pre-configured local key security storage device.

3. The single-packet authentication method based on quantum key according to claim 1 or 2, characterized in that: The determining of a quantum key acquisition mode corresponding to a single-packet authentication request includes: Determining a request initiation time of the single-packet authentication request, and determining a quantum key acquisition mode corresponding to the single-packet authentication request based on the request initiation time; Alternatively, the number of request initiations of the single-packet authentication request is determined, and a quantum key acquisition mode corresponding to the single-packet authentication request is determined based on the number of request initiations.

4. The single-packet authentication method based on quantum key according to claim 1, characterized in that: The SPA message includes a message sequence number; The message sequence number is randomly generated based on the number of times the SPA message is sent.

5. The single-packet authentication method based on quantum key according to claim 1, characterized in that: The SPA message also includes a basic information identification field for identifying the type of the verification basic information.

6. A single-packet authentication method based on quantum key, characterized in that: include: Identify a SPA message sent by a client in response to a single-packet authentication request initiated by the client based on the SPA message, determine a quantum key acquisition mode corresponding to the single-packet authentication request, and acquire a quantum key based on the quantum key acquisition mode; Decrypting the integrity check value of the SPA message using the quantum key to obtain a first summary operation value; Determine a target security algorithm based on a security algorithm identification field of the SPA message, and extract basic verification information corresponding to the single-packet authentication request based on the SPA message; Performing a digest operation on the verification basic information based on the target security algorithm to obtain a second digest operation value; The legitimacy of the single-packet authentication request of the client is verified based on the consistency of the first digest operation value and the second digest operation value.

7. The single-packet authentication method based on quantum key according to claim 6, characterized in that: Acquiring a quantum key based on the quantum key acquisition mode includes at least one of the following: In the case where it is determined that the quantum key acquisition mode is an online acquisition mode, obtaining key server address information and key basic information corresponding to the online acquisition mode, and obtaining a corresponding quantum key from a pre-configured key server based on the key server address information and the key basic information; In the case where it is determined that the quantum key acquisition mode is an offline acquisition mode, key storage location information and key basic information corresponding to the offline acquisition mode are obtained, and based on the key storage location information and the key basic information, the corresponding quantum key is obtained from a pre-configured local key security storage device.

8. The single-packet authentication method based on quantum key according to claim 6 or 7, characterized in that: The determining of a quantum key acquisition mode corresponding to the single-packet authentication request comprises: Determining a request initiation time of the single-packet authentication request, and determining a quantum key acquisition mode corresponding to the single-packet authentication request based on the request initiation time; Alternatively, the number of request initiations of the single-packet authentication request is determined, and a quantum key acquisition mode corresponding to the single-packet authentication request is determined based on the number of request initiations.

9. The single-packet authentication method based on quantum key according to claim 6, characterized in that: The SPA message includes a message sequence number; the message sequence number is randomly generated by the client based on the number of times the SPA message is sent; Performing a legitimacy check on the single-packet authentication request of the client based on the consistency between the first digest operation value and the second digest operation value, further comprising: The message sequence number in the SPA message is extracted, and the message sequence number is repeatedly verified based on the stored sequence number cache information to perform a legitimacy check on the single-packet authentication request of the client.

10. The single-packet authentication method based on quantum key according to claim 6, characterized in that: The identifying a SPA message sent by the client in response to a single-packet authentication request initiated by the client based on the SPA message includes: An SPA message identifier is detected for a data packet sent by a client, and when the data packet carries the SPA message identifier, the data packet is identified as a SPA message sent by the client.

11. An electronic device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the single-packet authentication method based on quantum key described in any one of claims 1 to 10 can be implemented.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the single-packet authentication method based on quantum key as described in any one of claims 1 to 10 is executed.

13. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, it implements the single-packet authentication method based on quantum key described in any one of claims 1 to 10.

Images