Anti-quantum calculation method and system for electric power information system

Abstract

The invention discloses an anti-quantum computing method for an electric power information system, relates to the technical field of quantum computing, and is used for solving the problem that a key is easy to crack in the service process of an existing CA system. The method comprises the following steps: a quantum security service system calls a customer service to obtain a quantum key; the quantum security service system generates a first quantum certificate of the first quantum key and initiates an issuing request; receiving a verification result: when the verification result is verification failure, calling the customer business service again to obtain a quantum key; when the verification result is that the verification is passed, storing and decrypting the first quantum certificate, and sending a confirmation message; and the quantum security service system stores the first quantum certificate. The invention further discloses an anti-quantum computing system of the electric power information system. According to the invention, the quantum key is used for generating the certificate, so that the problems of trust chain transmission among a plurality of services and key information leakage in the certificate issuing process are solved.

Description

Technical Field

[0001] The present invention relates to the field of quantum computing technology, and in particular to an anti-quantum computing method and system for an electric power information system for increasing the anti-quantum computing capability of a CA service of the electric power information system. Background Art

[0002] The power grid is an important part of many critical infrastructures, and its information security is particularly important. To this end, the power industry has invested a lot of resources in information security protection, and has built a security protection system based on the general principles of "security partitioning, network dedicating, horizontal isolation, and vertical authentication", which effectively ensures the safe and stable operation of the power grid. In particular, in terms of cryptographic infrastructure construction, the construction of a power information cryptographic management system has been underway since 2009, giving full play to the supporting role of cryptography in ensuring the security of critical information infrastructure.

[0003] In addition, State Grid Corporation of China has also established a commercial cryptographic management center to provide comprehensive cryptographic application services including CA services to various business systems. The lower-level power business systems use CA services across domains to achieve identity authentication and session key negotiation based on certificates.

[0004] However, with the rapid development of quantum computing technology, traditional cryptographic systems face severe challenges. Quantum computers can effectively solve some mathematical problems that are difficult for classical computers to solve in a specific computing method, such as Shor's quantum algorithm and Grover's quantum algorithm. It poses a potential security risk to existing asymmetric and symmetric cryptographic algorithms. In particular, the Shor algorithm can theoretically crack the currently widely used RSA and ECC algorithms, the security foundations of which are large integer decomposition and elliptic curve discrete logarithm problems, respectively. This means that once quantum computers are widely used, the existing power information system, especially the CA service based on traditional cryptographic algorithms, will face the risk of being cracked.

[0005] Therefore, the CA service of the existing power information system has security issues when facing the threat of quantum computing. First, the cross-regional certificate issuance process requires the transmission of a large amount of information on the wide area network, which is very likely to cause the private key to be leaked or attacked, which may cause the entire trust chain to collapse. At the same time, the synchronization process of certificate data also provides opportunities for quantum computing attacks. Secondly, the imperfection of the certificate expiration and revocation mechanism has also exacerbated the security risks, especially the long renewal of existing certificates, which has reserved a sufficient window period for quantum computer cracking. Thirdly, under the current mechanism, both the issuance and renewal of certificates often require manual participation, which is not only cumbersome but also too complicated. Manual input and various import and export operations are even more at risk of leaking sensitive information. In addition, the session key negotiation process is also facing the threat of quantum computing attacks. The traditional key negotiation protocol may become fragile and cannot effectively protect the security of the session key. Finally, in the service process of the existing CA system, the public key is often transmitted in plain text, which is very easy to be cracked and exploited by quantum computing. Summary of the invention

[0006] In order to overcome the shortcomings of the prior art, one of the objects of the present invention is to provide a quantum computing method for an electric power information system, which issues a quantum certificate by using a quantum key and completes the issuance and authentication of the quantum certificate through a quantum security CA service center.

[0007] One of the purposes of the present invention is achieved by the following technical solution:

[0008] A quantum computing method for an electric power information system comprises the following steps:

[0009] The quantum security service system calls the customer service service to obtain a quantum key, called the first quantum key, which is a symmetric key stored in the quantum security service system and the quantum security CA service center;

[0010] The quantum security service system generates a first quantum certificate for the first quantum key, and initiates a request for issuing the first quantum certificate to the quantum security CA service center;

[0011] Receive verification results from the Quantum Security CA Service Center:

[0012] When the verification result is a verification failure, the quantum security business system calls the customer business service again to obtain a quantum key;

[0013] When the verification result is that the verification is passed, the quantum security CA service center stores and decrypts the first quantum certificate, and sends a confirmation message to the quantum security business system;

[0014] The quantum security service system stores the first quantum certificate and the identity information of the first quantum certificate.

[0015] Furthermore, the request for issuing the quantum certificate includes a signature based on the quantum certificate, a key identifier of the first quantum key, and encrypted identity information.

[0016] Furthermore, the quantum security CA service center issues the first quantum certificate, including:

[0017] The quantum key stored in the quantum security CA service center is searched through the key identifier corresponding to the quantum certificate to obtain the second quantum key;

[0018] generating a second quantum certificate using the second quantum key;

[0019] If the second quantum certificate is the same as the first quantum certificate, the verification succeeds; otherwise, the verification fails.

[0020] Furthermore, the quantum security service system periodically initiates certificate updates to the quantum security CA service center, including the following steps:

[0021] The quantum security business system calls the customer business service to obtain the third quantum key;

[0022] Generate a third quantum certificate using the third quantum key;

[0023] Send the previous quantum certificate index and the third quantum certificate to the quantum security CA service center and initiate an update request;

[0024] The quantum security CA service center authenticates the quantum security CA service center, and after the authentication is passed, searches the storage location through the previous quantum certificate index, uses the third quantum certificate to update the previous quantum certificate, and sends a confirmation result to the quantum security business system.

[0025] Furthermore, the quantum security service system can also perform quantum certificate query, including:

[0026] The quantum security business system calls the customer business service to obtain the temporary key and reads the stored first quantum certificate;

[0027] Send the key identifier of the temporary key, the index of the first quantum certificate and the query request to the quantum security CA service center;

[0028] The Quantum Security CA Service Center performs identity authentication through the received key identification and index;

[0029] After the verification is successful, the public key of the first quantum certificate stored is queried, and the public key and the verification result are returned to the quantum security service system.

[0030] Furthermore, the first quantum certificate includes public and private key information, the identity information of the first quantum certificate includes index information of the certificate, and the first quantum key includes a key identifier and a key value.

[0031] The second object of the present invention is to provide a quantum-resistant computing system for an electric power information system, which connects a quantum security CA service center and a quantum security business system through a quantum key distribution network, thereby completing the generation of quantum keys and the verification and storage of certificates.

[0032] The second object of the present invention is achieved by adopting the following technical solution:

[0033] A quantum-resistant computing system for an electric power information system, including a quantum-safe CA service center, a quantum key distribution network, and several quantum-safe business systems;

[0034] The quantum key distribution network is used to generate a binary bit random sequence, and the quantum security CA service center and the quantum security business system obtain the binary bit random sequence to generate a quantum key;

[0035] The quantum security CA service center and the quantum security business system execute the above-mentioned anti-quantum computing method of the power information system.

[0036] Furthermore, the quantum key distribution network includes QKD nodes and an optical fiber network between the nodes, which is used to synchronize quantum keys between QKD nodes. The quantum key distribution network uses a quantum key agreement algorithm to continuously negotiate between QKD nodes to generate a binary bit random sequence. The quantum key agreement algorithm includes a BB84 protocol with a decoyed state, a device-independent quantum key distribution protocol, and a dual-field quantum key distribution protocol.

[0037] Furthermore, the quantum security business system includes a quantum key management system, a cryptographic module and customer business services;

[0038] The quantum key management system is used to obtain a binary bit random sequence from a quantum key distribution network and generate a quantum key, and also provides an interface for obtaining the key to the customer service;

[0039] The cryptographic module is used to securely store quantum keys and quantum certificate data generated by a quantum key management system;

[0040] The client business service is used to use quantum certificates to securely protect the quantum security business system.

[0041] Further, the password module includes a password calculation area and a secure storage area, the password calculation area is calculated by SM2, SM3, and SM4, and the secure storage area is used to store sensitive data;

[0042] The private key of the quantum certificate is the key value of the quantum key, and the public key of the quantum certificate is calculated by inputting the private key into the ECC algorithm. The formats of the quantum certificate include PEM, PFX, and CER.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] The present invention generates quantum certificates based on quantum keys, which solves the problems of trust chain transmission and key information leakage between multiple services involved in the certificate issuance process. The certificate issuance process does not require the transmission of any form of public key in the network.

[0045] The present invention introduces a quantum key distribution network, so that the security of the certificate issuance process is the responsibility of the mechanism of generating quantum keys by the quantum key distribution network, which improves the ability of the certificate issuance process to resist quantum computing; through key negotiation based on the quantum key distribution network, the risk of the key being cracked in the certificate-based session key negotiation process is solved, and the session key adopts the quantum key generated by the quantum key distribution network, which improves the ability of the data transmission process to resist quantum computing;

[0046] Furthermore, by using temporary quantum keys in the certificate query process, the problem of plain text transmission of sensitive information in the certificate public key during the certificate query process is solved, and the encryption key used comes from the quantum key distribution network, which has strong resistance to quantum computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 is a flow chart of a quantum-resistant computing method for a power information system according to Embodiment 1;

[0048] Figure 2 It is a schematic diagram of a quantum certificate issuance flow chart of Embodiment 1;

[0049] Figure 3 This is a schematic diagram of the process of updating a quantum certificate in Embodiment 2;

[0050] Figure 4 1 is a flowchart of quantum certificate query in Embodiment 3;

[0051] Figure 5 is an overall composition diagram of the anti-quantum computing system of the power information system of the fourth embodiment;

[0052] Figure 6 This is a diagram of the composition of the quantum secure CA service of Example 4;

[0053] Figure 7 This is a diagram of the composition of the quantum customer business system of Example 4. DETAILED DESCRIPTION

[0054] The present invention will be described in more detail below in conjunction with the accompanying drawings. It should be noted that the following description of the present invention with reference to the accompanying drawings is only illustrative and not restrictive. The various embodiments can be combined with each other to form other embodiments not shown in the following description.

[0055] Embodiment 1

[0056] Embodiment 1 provides a quantum computing method for an electric power information system, which aims to ensure security by generating a quantum certificate using a quantum key of a symmetric cryptography.

[0057] It should be noted that, for the purpose of this embodiment, the quantum security business system is referred to as QCS, the quantum security CA service center is referred to as QSCA, the quantum key is referred to as QK, and the quantum key certificate is referred to as QE. Among them, the quantum security CA service center is the quantum security CA service located at the headquarters center, and the quantum security business system is a number of quantum security business systems of business companies located below the headquarters.

[0058] Quantum Key Distribution (QKD) technology, as an emerging supplementary cryptographic method, can share keys between spatially separated users in an information-theoretically secure manner, which is also a task that classical cryptography cannot accomplish.

[0059] By applying quantum key distribution (QKD) technology to the cryptographic module of the certificate authority (CA) service, the keys required by the cryptographic module can be directly obtained from the quantum key management system (QKMS). This process not only enhances the security of the certificate issuance, update and query process, but also forms a new CA service security solution, providing security protection against quantum attacks for the power information system.

[0060] The symmetric encryption used in this embodiment does not distinguish between public and private keys, and the same key is used for encryption and decryption. Asymmetric encryption has public and private keys. Generally, the public key is used for encryption, the private key is used for decryption, the private key is used for signing, and the public key is used for signature verification. The public key can be transmitted in plain text, and the private key needs to be encrypted and stored. However, after the emergence of quantum computers, it is no longer possible to publicly transmit the public key on the network, because the private key can be calculated from the public key.

[0061] In this embodiment, a symmetric key QK is negotiated through QKD, and an asymmetric key QE is generated through QK, so there is no need to transfer the public key back and forth in the network as in the traditional method.

[0062] Based on the above quantum key technology, please refer to Figure 1 and Figure 2 As shown, this embodiment proposes a quantum computing method for a power information system, comprising the following steps:

[0063] S1. The quantum security service system calls the customer service service to obtain a quantum key, called the first quantum key. The quantum key is a symmetric key stored in the quantum security service system and the quantum security CA service center.

[0064] It should be noted that both the quantum security business system and the quantum security CA service center have the function of generating quantum keys. By obtaining the same binary bit random sequence, the same quantum key can be generated according to the symmetric cryptographic algorithm. Therefore, the quantum security CA service center can find the corresponding and identical quantum key through the information of the quantum key, such as the key ID. Among them, the quantum key QK is composed of the key identifier QK ID and key value QK VAL It consists of two parts. ID Index for the key, QK VAL The length of is 256 bits. That is, QK = <QK ID ,QK VAL >, QK ID Used to uniquely index a key, QK VAL It is the key used for encryption and decryption.

[0065] S2. The quantum security service system generates a first quantum certificate for the first quantum key, and initiates a request for issuing the first quantum certificate to a quantum security CA service center;

[0066] The certificate generation method in S2 can be SM2 algorithm, using QK VAL Replace the multiplication point k in the SM2 algorithm to generate a quantum certificate. Since the specific calculation process only involves the replacement of the numerical value in the SM2 algorithm, this embodiment will not elaborate on this process.

[0067] The request for issuing the quantum certificate in S2 includes a signature based on the quantum certificate, a key identifier QK of the first quantum key, ID and encrypted identity information.

[0068] The above-mentioned identity information is usually a string that can uniquely identify the identity and is used as input for certificate issuance. For example, if a national standard camera uses a certificate for identity authentication, the national standard ID (a 16-byte string) of the camera is usually used as the identity information when registering the certificate.

[0069] The first quantum certificate includes public and private key information, the identity information of the first quantum certificate includes index information of the certificate, so that the quantum security CA service center can find the stored certificate information, and the first quantum key includes a key identifier and a key value.

[0070] It should be noted that the index of the quantum certificate can be used in QSCA using QKID The joint index of QCS ID. Since QSCA stores all QEs registered by QCS, an ID is needed to uniquely identify QCS. ID Mainly used to find QK that generates QE VAL , and index the transmission key during the registration and update process of QE. In QCS, because QCS knows its own ID, it no longer needs to store the ID, so the index of QE in QCS can only be QK ID .

[0071] S3. Receive the verification result from the Quantum Security CA Service Center:

[0072] When the verification result is a verification failure, the quantum security business system calls the customer business service again to obtain a quantum key;

[0073] When the verification result is that the verification is passed, the quantum security CA service center stores and decrypts the first quantum certificate, and sends a confirmation message to the quantum security business system;

[0074] The aforementioned quantum security CA service center issues the first quantum certificate, including:

[0075] The quantum key stored in the quantum security CA service center is searched through the key identifier corresponding to the quantum certificate to obtain the second quantum key QK*;

[0076] Generate a second quantum certificate QE* using the second quantum key;

[0077] If the second quantum certificate is the same as the first quantum certificate, the verification succeeds; otherwise, the verification fails.

[0078] Specifically, after receiving the request content, QSCA uses QK ID Find the corresponding QK* and use QK* to generate QE*. Due to the key negotiation capability of the quantum key distribution network, QK*=QK and QE*=QE.

[0079] QSCA uses QE* to verify the signature, and after the signature is verified, the key value QK* of the second quantum key is used VAL Decrypt to obtain the identity information, store the identity information together with QE* in the cryptographic module, and send a confirmation to the QCS.

[0080] S4. The quantum security service system stores the first quantum certificate and the identity information of the first quantum certificate.

[0081] Embodiment 2

[0082] Embodiment 2 is based on Embodiment 1 and mainly describes the update process of the quantum certificate.

[0083] Please refer to Figure 3 The certificate update process diagram shown in the figure, the quantum security service system regularly initiates certificate update to the quantum security CA service center, including the following steps:

[0084] The quantum security business system calls the customer business service to obtain the third quantum key;

[0085] The third quantum certificate QE is generated by the third quantum key new ;

[0086] Send the previous quantum certificate index and the third quantum certificate to the quantum security CA service center and initiate an update request; the request content includes the identifier QK of the third quantum key id , old QE encrypted with symmetric encryption algorithm old Corresponding index and use of QE new The signature generated for the request content, the key used for symmetric encryption is QK VAL ;

[0087] The quantum security CA service center authenticates the quantum security CA service center, and after the authentication is passed, searches the storage location through the previous quantum certificate index, uses the third quantum certificate to update the previous quantum certificate, and sends a confirmation result to the quantum security business system.

[0088] Please refer to Example 1 for the verification method of the Quantum Security CA Service Center, which will not be elaborated here. old Transfer to the expired certificate library for archiving and QE new storage.

[0089] Security can be further guaranteed by updating the certificate. The certificate update time can be set according to needs, such as one day.

[0090] Embodiment 3

[0091] Embodiment 3 mainly describes the certificate query process.

[0092] Please refer to Figure 4 As shown in the flowchart, the quantum security business system can also query quantum certificates, including:

[0093] The quantum security business system calls the customer business service to obtain the temporary key and reads the stored first quantum certificate;

[0094] Send the key identifier of the temporary key, the index of the first quantum certificate and the query request to the quantum security CA service center;

[0095] The Quantum Security CA Service Center performs identity authentication through the received key identification and index;

[0096] After the verification is successful, the public key of the first quantum certificate stored is queried, and the public key and the verification result are returned to the quantum security service system.

[0097] Embodiment 4

[0098] Embodiment 4 provides a quantum-resistant computing system for an electric power information system.

[0099] Please refer to Figure 5 As shown, a quantum-resistant computing system for an electric power information system includes a quantum security CA service center, a quantum key distribution network, and several quantum security business systems;

[0100] The quantum key distribution network is used to generate a binary bit random sequence, and the quantum security CA service center and the quantum security business system obtain the binary bit random sequence to generate a quantum key;

[0101] The quantum security CA service center and the quantum security business system perform the anti-quantum computing method of the power information system described in Examples 1 to 3.

[0102] Please refer to Figure 6 As shown, the quantum security CA service center includes a quantum key management system, a cryptographic module and a customer service. The quantum key management system is used to obtain a binary bit random sequence from a quantum key distribution network and generate a quantum key, and also provides an interface for obtaining keys to customer service;

[0103] The cryptographic module is used to securely store quantum keys and quantum certificate data generated by a quantum key management system;

[0104] In this embodiment, the cryptographic algorithms include but are not limited to SM2, SM3, and SM4.

[0105] The client service is used to use quantum certificates to protect the quantum security service system. Specifically, the client service obtains QK from the cryptographic module and uses QK in QK to VAL Generate QE and securely store the private key of QE in the cryptographic module. The management of QE includes but is not limited to generation, query, backup / restore, and cancellation.

[0106] The private key of the above quantum certificate QE is QK in QK VAL , and QKMS calls the cryptographic module to calculate the public key based on the private key through the ECC algorithm. The certificate formats include but are not limited to PEM, PFX, and CER.

[0107] The quantum key distribution network includes QKD nodes and an optical fiber network between the nodes, which is used to synchronize quantum keys between QKD nodes. The quantum key distribution network uses a quantum key agreement algorithm to continuously negotiate between QKD nodes to generate a binary bit random sequence. The quantum key agreement algorithm includes a decoyed state BB84 protocol, a device-independent quantum key distribution protocol, and a dual-field quantum key distribution protocol.

[0108] Please refer to Figure 7 As shown, the quantum security business system includes a quantum key management system, a cryptographic module and a customer business service. The quantum key management system QKMS is used to obtain a binary bit random sequence negotiated from a QKD network and generate a quantum key QK and provide an interface for obtaining QK to the CS service. The cryptographic module is used to securely store the QK and certificate data generated by the QKMS. The customer business service is used to use the quantum certificate QE to securely protect its business system.

[0109] Preferably, the client service obtains QK from the cryptographic module and uses QK in QK VAL Generate QE and securely store the private key of QE in the cryptographic module. The specific business content scope of CS services includes but is not limited to power transmission and distribution, dispatching and command, and real-time data monitoring.

[0110] Embodiment 5

[0111] Embodiment 5 is a specific implementation description corresponding to the above embodiment.

[0112] This embodiment discloses a system implementation method for increasing the quantum computing resistance of the CA service of the power information system. The system can refer to Figure 5 The specific implementation steps are as follows:

[0113] Step 1: Deploy a quantum secure CA service (QSCA) in the head office computer room and install the QKMS component and cryptographic module component.

[0114] Step 2: Deploy a power distribution management business system (QCS1) in the subsidiary's computer room and install the quantum key management system (QKMS) component and cryptographic module component, and set the identity information to ID1, which is a 16-byte serial number.

[0115] Step 3: deploy a power distribution collection and control system (QCS2) in the subsidiary factory and install the QKMS component and the password module component, and set the identity information to ID2, which is a 16-byte serial number.

[0116] Step 4: Ensure the network connectivity between the head office, subsidiary computer rooms, and subsidiary factories, ensure that QCS1 and QCS2 can access the quantum security CA service center QSCA normally, and ensure that QCS1 and QCS1 are reachable to each other.

[0117] Step 5: Build a QKD network between the head office, subsidiary computer rooms, and subsidiary factories.

[0118] Step 6: Start the QKD network and let it continuously negotiate to generate a binary bit random sequence.

[0119] Step 7: Start the quantum security CA service, the power distribution management business system, and the QKMS in the power distribution acquisition control system to ensure that QKMS can continuously obtain quantum keys from the QKD network and store them in the cryptographic module.

[0120] Step 8: Start the certificate issuance function in QCS1.

[0121] Step 9: In QCS1, QKMS obtains QK1 from the cryptographic module. QKMS calls the cryptographic module's public and private key pair generation algorithm based on QK1. VAL Generate a public-private key pair QE1, QE1 is composed of <QE1 PUB , QE1 PRI > Composition, among which, QE1 PUB and QE1 PRI Represents the public key and private key respectively.

[0122] Step 10: QCS1 constructs a certificate issuance request, and the request content is QK1 ID ||SM4_ENC(ID1,QK1 VAL )||Sign1[QK1 ID ||SM4_ENC(identity information, QK1 VAL ),QE1 PRI ], where ENC represents the encryption algorithm, i.e. the call of the algorithm function, and Sign represents the signature algorithm; and the request content is sent to QSCA.

[0123] Step 11: After QSCA receives the request, the CA service uses the parsed QK1 ID Search QKMS for the corresponding QK1* VAL , and call the public and private key pair generation algorithm of the cryptographic module based on QK1* VAL Generate a public-private key pair QE1*.

[0124] Step 12, in QSCA, the CA service uses QE1* to verify the signature of the request content, Verify(Sign1,QE1* PUB), where Verify represents the signature verification algorithm; if the signature verification passes, decryption is performed to obtain ID1.

[0125] Step 13. In QSCA, call QKMS using ID1 and QK1 ID As a joint index, QE1* is stored in the secure storage area of ​​the cryptographic module.

[0126] Step 14: QSCA sends a confirmation message to QCS1.

[0127] Step 15, in QCS1, after receiving the confirmation message, call QKMS and use QK1 ID As an index, QE1 is stored in the secure storage area of ​​the cryptographic module.

[0128] Step 16. Repeat steps 8-15 in QCS2 to issue the certificate.

[0129] Step 17, set the certificate renewal period for QCS1 and QCS2 to 1 day, and start the certificate renewal process at 12:00 am every day.

[0130] Step 18: In QCS1, QKMS obtains QK2 from the cryptographic module. QKMS calls the cryptographic module's public and private key pair generation algorithm based on QK2. VAL Generate a public-private key pair QE2, QE2 is composed of <QE2 PUB , QE2 PRI >Composition.

[0131] Step 19: QCS1 constructs a certificate update request with the content of QK2 ID ||SM4_ENC(QK1 ID , QK2 VAL )||Sign2[QK2 ID ||SM4_ENC(QK1 ID , QK1 VAL ),QE2 PRI ] and send it to QSCA.

[0132] Step 20: After QSCA receives the request, the CA service uses the parsed QK2 ID Search QKMS for the corresponding QK2* VAL , and call the public and private key pair generation algorithm of the cryptographic module based on QK2* VAL Generate a public-private key pair QE2*.

[0133] Step 21, in QSCA, the CA service uses QE2* to verify the signature of the request content, Verify(Sign2,QE2* PUB ), if the signature verification is successful, decryption is performed to obtain QK1ID .

[0134] Step 22, in QSCA, call QKMS using QK1 ID Use QE1* and ID1 as indexes, transfer QE1* to the expired certificate library (the expired certificate is stored for 3 months and will be completely deleted after the expiration date), and use ID1 and QK2 ID As a joint index, QE2* is stored in the secure storage area of ​​the cryptographic module.

[0135] Step 23, QSCA sends confirmation information to QCS1.

[0136] Step 24, in QCS1, after receiving the confirmation message, call QKMS and use QK1 ID As an index, QE2 is stored in the secure storage area of ​​the cryptographic module.

[0137] Step 25, repeat steps 18-24 in QCS2 to periodically update the certificate.

[0138] Step 26, QCS1 obtains the public key of QCS2 by executing the certificate query function.

[0139] Step 27, in QCS1, QKMS obtains the temporary quantum key QKT from the cryptographic module and retrieves the pre-stored certificate QEX and certificate index QK1 ID .

[0140] Step 28: QCS1 constructs a certificate query request, request content = QKT ID ||QK1 ID ||SM4_ENC(ID2,QKT VAL )||Sign3[QKT ID ||QK1 ID ||SM4_ENC(ID2,QKT VAL ),QEX PRI ] and send it to QSCA.

[0141] Step 29: After QSCA receives the request, the CA service uses the parsed QKT ID Look up the corresponding QKT* from QKMS VAL , and according to the analyzed QK1 ID Look up the corresponding QEX* from QKMS.

[0142] Step 30, in QSCA, the CA service uses QEX* to verify the signature of the request content, Verify(Sign3,QEX* PUB ), if the signature verification is successful, decryption is performed to obtain ID2.

[0143] Step 31, in QSCA, call QKMS and use ID2 as an index to find the current certificate QEY of QCS2.

[0144] Step 32, QSCA constructs response data, data format = SM4_ENC (QEY PUB , QKT* VAL ) and returns it to QCS1.

[0145] Step 33: After QCS1 receives the return data, use QKT VAL Decrypt the returned data to get QEY PUB .

[0146] Step 34, in QCS1, call QKMS to obtain QEY PUB Stored in a secure area within the cryptographic module.

[0147] Step 34, use the same method in QCS2 to obtain the public key QEX of QCS1 PUB .

[0148] Step 35, data is encrypted and transmitted between QCS1 and QCS2, and QKMS is directly called to obtain a temporary QK from the cryptographic module to serve as a session key.

[0149] Step 36, in QCS1, QKMS obtains the temporary quantum key QKA from the cryptographic module and retrieves the pre-stored certificate QEX. The above QKA is the same as the aforementioned QKT, both representing temporary quantum keys. Different letters are used in this embodiment to distinguish different steps.

[0150] Step 37, QCS1 constructs encrypted transmission data, format = QKA ID ||SM4_ENC(Data, QKA VAL ).

[0151] Step 38: For particularly important sensitive information, integrity and non-repudiation need to be added while security is given priority. The data format constructed by QCS1 becomes QKA. ID ||SM4_ENC(Data, QKA VAL )||Sign4[SM3(QKA ID ||SM4_ENC(Data, QKA VAL )),QEX PRI ].

[0152] Step 39, QCS1 sends the constructed data to QCS2.

[0153] Step 40, after QCS2 receives the data, QKMS uses the parsed QKA ID Find the corresponding QKA for the index VAL , and retrieve the previously stored public key QEX of QCS1 from the cryptographic module PUB .

[0154] Step 41, after QCS2 receives the data, if there is signature data, it first verifies the signature data Verify (Sign4, QEX PUB ), otherwise the found QKA can be used directly VAL Decrypted data

[0155] For those skilled in the art, various other corresponding changes and deformations can be made according to the technical solutions and concepts described above, and all of these changes and deformations should fall within the protection scope of the claims of the present invention.

Claims

1. A quantum computing method for power information system, characterized in that: The following steps are involved: The quantum security service system calls the customer service service to obtain a quantum key, called the first quantum key, which is a symmetric key stored in the quantum security service system and the quantum security CA service center; The quantum security service system generates a first quantum certificate for the first quantum key, and initiates a request for issuing the first quantum certificate to the quantum security CA service center; Receive verification results from the Quantum Security CA Service Center: When the verification result is a verification failure, the quantum security business system calls the customer business service again to obtain a quantum key; When the verification result is that the verification is passed, the quantum security CA service center stores and decrypts the first quantum certificate, and sends a confirmation message to the quantum security business system; The quantum security service system stores the first quantum certificate and the identity information of the first quantum certificate.

2. The quantum computing method for power information system according to claim 1, characterized in that: The request for issuing the quantum certificate includes a signature based on the quantum certificate, a key identifier of the first quantum key, and encrypted identity information.

3. The anti-quantum computing method of the power information system according to claim 2, characterized in that: The quantum security CA service center issues the first quantum certificate, including: The quantum key stored in the quantum security CA service center is searched through the key identifier corresponding to the quantum certificate to obtain the second quantum key; generating a second quantum certificate using the second quantum key; If the second quantum certificate is the same as the first quantum certificate, the verification succeeds; otherwise, the verification fails.

4. The anti-quantum computing method of the power information system according to claim 1, characterized in that: The quantum security service system periodically initiates certificate updates to the quantum security CA service center, including the following steps: The quantum security business system calls the customer business service to obtain the third quantum key; Generate a third quantum certificate using the third quantum key; Send the previous quantum certificate index and the third quantum certificate to the quantum security CA service center and initiate an update request; The quantum security CA service center authenticates the quantum security CA service center, and after the authentication is passed, searches the storage location through the previous quantum certificate index, uses the third quantum certificate to update the previous quantum certificate, and sends a confirmation result to the quantum security business system.

5. The quantum computing method for power information system according to claim 1, characterized in that: The quantum security service system can also perform quantum certificate query, including: The quantum security business system calls the customer business service to obtain the temporary key and reads the stored first quantum certificate; Send the key identifier of the temporary key, the index of the first quantum certificate and the query request to the quantum security CA service center; The Quantum Security CA Service Center performs identity authentication through the received key identification and index; After the verification is successful, the public key of the first quantum certificate stored is queried, and the public key and the verification result are returned to the quantum security service system.

6. The anti-quantum computing method of the power information system according to claim 1, characterized in that: The first quantum certificate includes public and private key information, the identity information of the first quantum certificate includes index information of the certificate, and the first quantum key includes a key identifier and a key value.

7. A quantum computing system for a power information system, characterized in that: Including quantum security CA service center, quantum key distribution network and several quantum security business systems; The quantum key distribution network is used to generate a binary bit random sequence, and the quantum security CA service center and the quantum security business system obtain the binary bit random sequence to generate a quantum key; The quantum security CA service center and the quantum security business system execute the anti-quantum computing method of the power information system as described in any one of claims 1 to 6.

8. The quantum computing resistant system of the electric power information system according to claim 7, characterized in that: The quantum key distribution network includes QKD nodes and an optical fiber network between the nodes, which is used to synchronize quantum keys between QKD nodes. The quantum key distribution network uses a quantum key agreement algorithm to continuously negotiate between QKD nodes to generate a binary bit random sequence. The quantum key agreement algorithm includes a BB84 protocol, a device-independent quantum key distribution protocol, and a dual-field quantum key distribution protocol.

9. The quantum computing resistant system of the electric power information system according to claim 7, characterized in that: The quantum security CA service center and quantum security business system include quantum key management system, cryptographic module and customer business services; The quantum key management system is used to obtain a binary bit random sequence from a quantum key distribution network and generate a quantum key, and also provides an interface for obtaining the key to the customer service; The cryptographic module is used to securely store quantum keys and quantum certificate data generated by a quantum key management system; The client business service is used to use quantum certificates to securely protect the quantum security business system.

10. The quantum computing resistant system of the electric power information system according to claim 9, characterized in that: The password module includes a password calculation area and a secure storage area. The password calculation area is calculated by SM2, SM3, and SM4, and the secure storage area is used to store sensitive data; The private key of the quantum certificate is the key value of the quantum key, and the public key of the quantum certificate is calculated by inputting the private key into the ECC algorithm. The formats of the quantum certificate include PEM, PFX, and CER.

Images