A method and device for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate

Abstract

The present invention relates to the field of information security, and provides a method and device for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate, the method comprising: obtaining a traditional certificate corresponding to a post-quantum certificate; obtaining a user key identifier or a user-specific name of a traditional certificate; filling the user key identifier of the traditional certificate into the certificate to be signed of the post-quantum certificate as the serial number of the post-quantum certificate, or filling the user-specific name of the traditional certificate into the certificate to be signed of the post-quantum certificate as the user-specific name of the post-quantum certificate, and completing the construction of the post-quantum certificate to be signed; using a post-quantum algorithm to sign the certificate to be signed, and generating a post-quantum signature value; encapsulating the certificate to be signed, the post-quantum algorithm ID and the post-quantum signature value into a post-quantum certificate. The present invention solves the problem that the corresponding relationship between traditional certificates and post-quantum certificates is difficult to maintain and be effective, and realizes a stable and easy-to-check corresponding relationship between traditional certificates and post-quantum certificates.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and device for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate. Background Art

[0002] Digital certificates play a vital role in public key infrastructure (PKI), providing a safe and reliable way to verify identity and encrypt data, thereby ensuring the security of information transmission. A standard digital certificate usually contains the certificate owner's information, the owner's public key, the certificate authority's information, and the digital signature of the certificate content by the certificate authority CA using its private key. These elements together guarantee the integrity and authenticity of the certificate, making digital certificates an effective means of proving the authenticity of the public key and the identity of the owner.

[0003] With the rapid development of quantum computer technology, traditional public key cryptographic algorithms, such as RSA, SM2, and ECC, are facing the threat of being cracked by quantum computers. Once quantum computers crack these traditional public key algorithms, existing PKI technology will no longer be secure. After a quantum computer cracks the traditional CA key, it can forge the signature of the CA on the digital certificate, and then arbitrarily replace the owner information in the traditional certificate, making the traditional digital certificate unreliable. In order to meet this challenge, the Post-Quantum Cryptography (PQC) technology came into being. The PQC algorithm is designed to resist the attack of quantum computers. It is based on several types of mathematical problems that are considered difficult to crack even in the face of quantum computers. However, due to the relatively short development time of post-quantum algorithms, there is currently no post-quantum algorithm whose performance and security are accepted by everyone at the same time. Therefore, the industry tends to use post-quantum cryptographic algorithms in combination with ordinary public key cryptographic algorithms, and use post-quantum certificates as a supplement to traditional certificates to make up for the shortcomings of traditional certificates that cannot resist quantum computer attacks.

[0004] Although using post-quantum certificates as a supplement to traditional certificates can improve the security of the system to a certain extent, it also brings new challenges. Summary of the invention

[0005] The present invention provides a method and device for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate, which solves the problem in the prior art that the corresponding relationship between a traditional certificate and a post-quantum certificate is difficult to maintain and be effective, and realizes a stable and easy-to-check corresponding relationship between the traditional certificate and the post-quantum certificate.

[0006] The present invention provides a method for establishing a correspondence between a post-quantum certificate and a traditional certificate, comprising the following steps:

[0007] Obtain the traditional certificate corresponding to the post-quantum certificate;

[0008] Obtaining a user key identifier of the traditional certificate;

[0009] Fill the user key identifier of the traditional certificate into the certificate to be signed of the post-quantum certificate as the serial number of the post-quantum certificate, and complete the construction of the post-quantum certificate to be signed;

[0010] Sign the certificate to be signed using a post-quantum algorithm to generate a post-quantum signature value;

[0011] The certificate to be signed, the post-quantum algorithm ID and the post-quantum signature value are encapsulated into a post-quantum certificate.

[0012] According to a method for establishing a correspondence between a post-quantum certificate and a traditional certificate provided by the present invention, after obtaining the post-quantum certificate, the method further includes: obtaining a user key identifier of the traditional certificate; using the user key identifier of the traditional certificate as a serial number to search for the certificate and find the corresponding post-quantum certificate.

[0013] According to a method for establishing a correspondence between a post-quantum certificate and a traditional certificate provided by the present invention, after obtaining the post-quantum certificate, the method further includes: obtaining the serial number of the post-quantum certificate; using the serial number of the post-quantum certificate as a user key identifier to search for the certificate and find the corresponding traditional certificate.

[0014] According to a method for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate provided by the present invention, the post-quantum certificate serial number also includes a number; the method also includes: using the lowest byte of the post-quantum certificate serial number as the number of the post-quantum certificate; storing the user key identifier of the traditional certificate in other high byte parts of the post-quantum certificate serial number except the lowest byte, so as to achieve a one-to-many relationship between a traditional certificate and multiple post-quantum certificates.

[0015] A method for establishing a correspondence between a post-quantum certificate and a traditional certificate, comprising:

[0016] Obtain the traditional certificate corresponding to the post-quantum certificate;

[0017] Obtaining a subject distinguished name of the traditional certificate;

[0018] Filling the user's unique name of the traditional certificate into the certificate to be signed of the post-quantum certificate as the user's unique name of the post-quantum certificate, and completing the construction of the post-quantum certificate to be signed;

[0019] Sign the certificate to be signed using a post-quantum algorithm to generate a post-quantum signature value;

[0020] The certificate to be signed, the post-quantum algorithm ID and the post-quantum signature value are encapsulated into a post-quantum certificate.

[0021] According to a method for establishing a correspondence between a post-quantum certificate and a traditional certificate provided by the present invention, after obtaining the post-quantum certificate, the method further includes: obtaining a user-specific name of the traditional certificate; searching for the post-quantum certificate using the user-specific name as a filtering condition to find the corresponding post-quantum certificate.

[0022] The present invention also provides a device for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate, comprising the following modules:

[0023] A traditional certificate acquisition module, used to obtain the traditional certificate corresponding to the post-quantum certificate;

[0024] A traditional certificate attribute value acquisition module, used to obtain a user key identifier or a user distinguished name of the traditional certificate;

[0025] A certificate to be signed construction module, used to fill the user key identifier of the traditional certificate as the serial number of the post-quantum certificate into the certificate to be signed of the post-quantum certificate, or fill the user distinguished name of the traditional certificate as the user distinguished name of the post-quantum certificate into the certificate to be signed of the post-quantum certificate, and complete the construction of the post-quantum certificate to be signed;

[0026] A signature module, used to sign the certificate to be signed using a post-quantum algorithm to generate a post-quantum signature value;

[0027] The encapsulation module is used to encapsulate the certificate to be signed, the post-quantum algorithm ID and the post-quantum signature value into a post-quantum certificate.

[0028] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate as described in any one of the above is implemented.

[0029] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a method for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate as described in any one of the above.

[0030] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements the method for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate as described in any of the above.

[0031] The present invention provides a method and device for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate, including the following beneficial effects: by using the user key identifier or user proprietary name of the traditional certificate as the serial number of the post-quantum certificate, a stable corresponding relationship is established, so that the post-quantum certificate can be effectively connected with the traditional certificate, and signed by a post-quantum algorithm, thereby enhancing the security of the certificate. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 It is a schematic diagram of the issuance process of a post-quantum certificate when a corresponding relationship is established between a user key identifier (SubjectKeyID) and a post-quantum certificate provided by the present invention.

[0034] Figure 2 This is one of the flow charts of searching the corresponding post-quantum certificate through a traditional certificate provided by the present invention.

[0035] Figure 3 It is a schematic diagram of the process of searching for the corresponding traditional certificate through a post-quantum certificate provided by the present invention.

[0036] Figure 4 It is a schematic diagram of the issuance process of a post-quantum certificate when a corresponding relationship is established between a user's proper name (SubjectDN) and a post-quantum certificate provided by the present invention.

[0037] Figure 5 This is the second flow chart of searching the corresponding post-quantum certificate through a traditional certificate provided by the present invention.

[0038] Figure 6 It is a structural schematic diagram of a device for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate provided by the present invention.

[0039] Figure 7 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] Some terms involved in the present invention are explained below.

[0042] Public key cryptographic algorithm: also known as asymmetric cryptographic algorithm, is a cryptographic technology used for data signing and encryption. Common algorithms include RSA, SM2 and ECC. It uses a pair of keys: public key and private key. There is a one-to-one correspondence between the two. The private key needs to be kept confidential, and the public key can be publicly disseminated. When signing, the signer uses the private key to operate on the data to obtain the signature result; when verifying the signature, the verifier uses the public key to operate on the signature result to verify the correctness of the signature result.

[0043] Digital certificate: An electronic document issued by an authoritative certificate authority (CA) to prove the authenticity of the public key and the identity of the owner. It mainly consists of basic user information, user public key, and CA signature value of user information.

[0044] Traditional certificate: A digital certificate issued using traditional public key cryptography algorithms such as RSA, SM2, and ECC.

[0045] Post-Quantum Cryptography (PQC) refers to an encryption algorithm that is still secure in the presence of quantum computers. Common signature algorithms include Dilithium, Falcon, and SPHINCS+, and encryption algorithms include Kyber.

[0046] Post-quantum certificate: A digital certificate issued using a post-quantum cryptographic algorithm.

[0047] SubjectKeyID (SubjectKeyIdentifier): Subject key identifier, one of the extended attributes of the certificate, generated by the hash value of the certificate public key. When the certificate is renewed, it remains unchanged as long as the key of the certificate remains unchanged.

[0048] SubjectDN (Subject Distinguished Name): Subject Distinguished Name, which is one of the basic attributes of a certificate.

[0049] serialNumber: Certificate serial number, an attribute of the certificate. It must be unique within the same CA.

[0050] Digital certificates play a vital role in public key infrastructure (PKI), ensuring the security of information transmission by providing a safe and reliable way to verify identity and encrypt data.

[0051] A standard digital certificate usually contains the following information:

[0052] Certificate owner information: such as name, email address, organization name, etc., used to identify the holder of the certificate.

[0053] Owner public key: Paired with the holder's private key and used to encrypt and verify digital signatures.

[0054] Certificate authority information: Information about the authoritative entity that issues, manages, and revokes certificates.

[0055] Digital signature: The certificate authority (CA) signs the certificate content using its private key to ensure the integrity and authenticity of the certificate.

[0056] A digital certificate is a digital certificate that contains a digital signature from the CA to ensure that its content cannot be tampered with. It can therefore be used to prove the authenticity of the public key and the identity of the owner.

[0057] With the continuous development of quantum computer technology, the Shor algorithm applied to quantum computers can break traditional public key algorithms such as RSA, SM2 and ECC, making the existing PKI technology no longer secure. After a quantum computer breaks the traditional CA key, it can forge the CA's signature on the digital certificate, and then arbitrarily replace the owner information in the traditional certificate, making the traditional digital certificate no longer reliable.

[0058] In order to resist the attacks of quantum computers, when issuing traditional certificates to customers, post-quantum certificates can also be provided in addition to improve security. Post-Quantum Cryptography (PQC) technology has been studied in depth. It is a type of cryptographic algorithm designed to resist attacks by quantum computers. PQC algorithms are mainly based on several types of mathematical problems, which are considered difficult to crack even in the face of quantum computers. Among them, PQC algorithms based on lattice-based, code-based, multivariate quadratic equations, hash functions, and isogeny-based problems have received considerable attention. Different types of post-quantum cryptographic algorithms have different characteristics (key and ciphertext size, running time, etc.) and different security because they are based on different mathematical problems.

[0059] Since the development time of post-quantum algorithms is relatively short, there is no post-quantum algorithm whose performance and security are accepted by everyone at the same time. In addition, since there is no mature standard for post-quantum cryptographic algorithms, the industry currently tends to use post-quantum cryptographic algorithms and ordinary public key cryptographic algorithms in a mixed way, and use post-quantum certificates as a supplement to traditional certificates to make up for the shortcomings of traditional certificates that cannot resist quantum computer attacks. In order to ensure the convenient use of application systems, in this application mode, it is necessary to establish a correspondence between post-quantum certificates and traditional certificates. When using traditional certificates to do business, you can quickly find the corresponding post-quantum certificate; at the same time, it is best to quickly check the corresponding expired traditional certificate through the post-quantum certificate.

[0060] To solve this problem, IBM's invention patent proposes a solution. A method, computer program product, and system for binding a post-quantum certificate to a traditional certificate are provided. The method includes selecting a traditional certificate in a certificate chain owned by the owner. The method also includes calculating a fingerprint of the traditional certificate. The method also includes generating a post-quantum certificate with the same information field as the traditional certificate, and using the fingerprint to fill in the serial number of the post-quantum certificate. The post-quantum certificate is used as an extension of the first traditional certificate, which provides authentication and verification between the client and the server using a signature algorithm with post-quantum capabilities.

[0061] However, the method of using the fingerprint of the traditional certificate as the serial number of the post-quantum certificate proposed in the above method for binding the post-quantum certificate to the traditional certificate has the following problems:

[0062] 1. After the traditional certificate is re-signed, the corresponding relationship between the two will no longer exist.

[0063] After the traditional certificate is reissued, the certificate fingerprint will change, and the correspondence between the post-quantum certificate and the traditional certificate will be destroyed.

[0064] The existence of post-quantum certificates is to make up for the problem that the public key in traditional certificates cannot resist quantum computer attacks. When a traditional certificate is renewed or reissued, its key remains unchanged, and its binding relationship with the post-quantum certificate also needs to remain unchanged.

[0065] 2. It is easy to find a post-quantum certificate from a traditional certificate, but it is difficult to reverse-check the corresponding traditional certificate from a post-quantum certificate.

[0066] When the fingerprint of the traditional certificate is used as the serial number of the post-quantum certificate, if the traditional certificate is known, the serial number of the post-quantum certificate can be obtained by calculating its fingerprint, and the post-quantum certificate can be quickly located. However, if the post-quantum certificate is known, since its serial number is the fingerprint of the traditional certificate, the data information of the traditional certificate cannot be directly deduced from the fingerprint. To reverse check the corresponding traditional certificate, it is necessary to calculate the fingerprint of the traditional certificate one by one and then compare them, which is a relatively difficult process.

[0067] The certificate fingerprint binds all the data of the certificate. When the correspondence between traditional certificates and post-quantum certificates is established through it, the correspondence between the two is too strict and is not applicable in some actual scenarios.

[0068] In addition to the certificate fingerprint, the SubjectKeyID and SubjectDN of a certificate can also mark a certificate. The SubjectKeyID is bound to the certificate's key and remains unchanged as long as the key remains unchanged. The correspondence between it and the certificate is weaker than that between it and the certificate fingerprint. The SubjectDN marks the user of the certificate, and the correspondence between it and the certificate is further weakened.

[0069] In order to meet the needs of establishing different strength correspondences between traditional certificates and post-quantum certificates in different application scenarios, the present invention proposes a method for establishing a correspondence between traditional certificates and post-quantum certificates using SubjectDN and SubjectKeyID. The present invention mainly proposes two methods for establishing a correspondence between post-quantum certificates and traditional certificates, respectively establishing such a correspondence based on the SubjectKeyID and SubjectDN of traditional certificates.

[0070] When establishing a correspondence based on the SubjectKeyID of a traditional certificate, as long as the key of the traditional certificate remains unchanged, the correspondence between the traditional certificate and the post-quantum certificate can continue to exist. When establishing a correspondence based on the SubjectDN of a traditional certificate, just ensure that the SubjectDN of the certificate remains unchanged, and the correspondence between the two certificates can also be guaranteed to be valid for a long time.

[0071] These two methods of establishing correspondence are applicable to various scenarios with different strength requirements for the correspondence between traditional certificates and post-quantum certificates.

[0072] Its features are as follows:

[0073] 1. When a traditional certificate establishes a correspondence with a post-quantum certificate through SubjectKeyID, as long as the key of the certificate remains unchanged, the correspondence between the two will always exist even if the traditional certificate is reissued. At the same time, the post-quantum certificate can quickly find the corresponding traditional certificate.

[0074] 2. When a traditional certificate establishes a correspondence with a post-quantum certificate through SubjectDN, the correspondence between the two will always exist as long as the certificate SubjectDN remains unchanged. The corresponding traditional certificate can also be quickly found through the post-quantum certificate.

[0075] Combine the following Figure 1-Figure 7 Embodiments of the present invention are described in detail.

[0076] Figure 1 This is one of the flow charts of the method for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate provided by the present invention, such as Figure 1 As shown, the method comprises the following steps:

[0077] S110. Obtain a traditional certificate corresponding to the post-quantum certificate.

[0078] S120. Obtain a user key identifier of a traditional certificate.

[0079] S130. Fill the user key identifier of the traditional certificate into the certificate to be signed of the post-quantum certificate as the serial number of the post-quantum certificate, and complete the construction of the post-quantum certificate to be signed.

[0080] S140. Use a post-quantum algorithm to sign the certificate to be signed and generate a post-quantum signature value.

[0081] S150, encapsulating the certificate to be signed, the post-quantum algorithm ID and the post-quantum signature value into a post-quantum certificate.

[0082] Specifically, method 1: establish a corresponding relationship between SubjectKeyID and post-quantum certificate.

[0083] When establishing a correspondence with a post-quantum certificate through SubjectKeyID, before issuing the post-quantum certificate, first obtain the traditional certificate corresponding to the post-quantum certificate.

[0084] Then, obtain the value of the SubjectKeyIdentifier attribute of the traditional certificate. The SubjectKeyIdentifier of the certificate is generated by the hash value of its public key. Due to the anti-collision property of the hash algorithm, the SubjectKeyIdentifier is unique and has an association relationship with the key of the certificate.

[0085] Subsequently, the SubjectKeyIdentifier of the traditional certificate is filled into the certificate to be signed (TBSCertificate) of the post-quantum certificate as the serial number of the post-quantum certificate, completing the construction of the post-quantum certificate to be signed.

[0086] Then use the post-quantum algorithm to sign TBSCertificate and generate a post-quantum signature value.

[0087] Finally, TBSCertificate, post-quantum algorithm ID, and post-quantum signature value are encapsulated into a post-quantum certificate.

[0088] By using the SubjectKeyIdentifier of the traditional certificate as the serial number of the post-quantum certificate, a correspondence between the two is established. As long as the key of the traditional certificate remains unchanged, this correspondence will continue to exist even if it is reissued, thereby ensuring that the post-quantum certificate can quickly find the corresponding traditional certificate while maintaining the stability and reliability of the correspondence.

[0089] According to a method for establishing a correspondence between a post-quantum certificate and a traditional certificate provided by the present invention, after obtaining the post-quantum certificate, the user key identifier of the traditional certificate is obtained; the certificate is searched using the user key identifier of the traditional certificate as the serial number to find the corresponding post-quantum certificate.

[0090] Specifically, the process of searching for the corresponding post-quantum certificate from a traditional certificate is as follows: Figure 2 shown.

[0091] First, get the SubjectKeyIdentifier of the legacy certificate.

[0092] Then, use the SubjectKeyIdentifier of the traditional certificate as the serial number serialNumber to search for the certificate to find the corresponding post-quantum certificate.

[0093] By using the SubjectKeyIdentifier of the traditional certificate as key retrieval information, the corresponding post-quantum certificate can be located quickly and accurately. This SubjectKeyIdentifier-based search method simplifies the certificate matching process, improves the certificate retrieval efficiency, and ensures the establishment of an efficient and reliable correspondence between traditional certificates and post-quantum certificates.

[0094] According to a method for establishing a correspondence between a post-quantum certificate and a traditional certificate provided by the present invention, after obtaining the post-quantum certificate, the serial number of the post-quantum certificate is obtained; the serial number of the post-quantum certificate is used as a user key identifier to search for the certificate, and the corresponding traditional certificate can be found.

[0095] Specifically, the process of searching for the corresponding traditional certificate by a quantum certificate is as follows: Figure 3 shown.

[0096] First, get the serialNumber of the post-quantum certificate.

[0097] Then, you can use the serialNumber of the quantum certificate as the SubjectKeyIdentifier to look up the certificate and find the corresponding traditional certificate.

[0098] With the help of the correspondence between the serial number of the post-quantum certificate and the SubjectKeyIdentifier of the traditional certificate, it is possible to easily reverse search from the post-quantum certificate to its corresponding traditional certificate. This reverse search mechanism enhances the flexibility of certificate management, improves the interoperability of the certificate application system, and ensures the two-way traceability of the correspondence between the post-quantum certificate and the traditional certificate.

[0099] According to a method for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate provided by the present invention, the post-quantum certificate serial number also includes a number; the lowest byte of the post-quantum certificate serial number is used as the number of the post-quantum certificate; and the user key identifier of the traditional certificate is stored in the other high byte parts of the post-quantum certificate serial number except the lowest byte, so as to realize the establishment of a one-to-many relationship between a traditional certificate and multiple post-quantum certificates.

[0100] Specifically, a method for establishing a corresponding relationship between SubjectKeyID and multiple post-quantum certificates is used.

[0101] 1. The above scheme realizes the establishment of a direct relationship between a traditional certificate and a post-quantum certificate. Due to the diversity of post-quantum algorithms, it may be necessary to issue multiple post-quantum certificates containing different algorithms for the same ordinary certificate in the future. In order to achieve the establishment of a one-to-many relationship between ordinary certificates and multiple post-quantum certificates, the lowest byte of the post-quantum certificate serial number can be used as the certificate number (its value is 0~255), and the SubjectKeyID of the ordinary certificate can be stored in the high byte part of the post-quantum certificate serial number. For example, the serial number of post-quantum No. 1 of the ordinary certificate with SubjectKeyID AAA is AAA1.

[0102] 2. The serial number of the post-quantum certificate can only take part of the SubjectKeyID of the ordinary certificate instead of all of it. The SubjectKeyID of the certificate is generated by the hash value of its public key, which has sufficient anti-collision ability. In general, it is also feasible to use part of the SubjectKeyID, such as the high 16 bytes, as the serial number of the post-quantum certificate.

[0103] By flexibly using the SubjectKeyID information of traditional certificates to construct the serial number of post-quantum certificates, not only can a one-to-many correspondence between the same traditional certificate and multiple post-quantum certificates with different algorithms be established, but the effective utilization and flexibility of the serial number can also be improved, adapting to the needs of post-quantum algorithm diversity, and providing a more efficient and convenient solution for the integrated management of traditional and post-quantum certificates.

[0104] Figure 4 This is a second flow chart of the method for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate provided by the present invention, such as Figure 4 As shown, the method comprises the following steps:

[0105] S410. Obtain a traditional certificate corresponding to the post-quantum certificate.

[0106] S420: Obtain the user distinguished name of the traditional certificate.

[0107] S430: Fill the user distinguished name of the traditional certificate into the certificate to be signed of the post-quantum certificate as the user distinguished name of the post-quantum certificate, and complete the construction of the post-quantum certificate to be signed.

[0108] S440. Use a post-quantum algorithm to sign the certificate to be signed and generate a post-quantum signature value.

[0109] S450, encapsulate the certificate to be signed, the post-quantum algorithm ID and the post-quantum signature value into a post-quantum certificate.

[0110] Specifically, method 2: establish a corresponding relationship between the SubjectDN and the post-quantum certificate.

[0111] When establishing a correspondence with a post-quantum certificate through SubjectDN, before issuing the post-quantum certificate, first obtain the traditional certificate corresponding to the post-quantum certificate.

[0112] Then, obtain the value of the SubjectDN attribute of the traditional certificate. The SubjectDN of the certificate marks the user of the certificate. If the SubjectDN of the certificates are the same, it means that the users are also the same, and a corresponding relationship is naturally established between the certificates.

[0113] Subsequently, the SubjectDN of the traditional certificate is filled into the TBSCertificate of the post-quantum certificate as the SubjectDN of the post-quantum certificate, completing the construction of the post-quantum certificate to be signed.

[0114] Then use the post-quantum algorithm to sign TBSCertificate and generate a post-quantum signature value.

[0115] Finally, TBSCertificate, post-quantum algorithm ID, and post-quantum signature value are encapsulated into a post-quantum certificate.

[0116] By directly using the SubjectDN of the traditional certificate as the SubjectDN of the post-quantum certificate, a correspondence between the two is easily established while maintaining the consistency of the certificate user information. As long as the SubjectDN of the traditional certificate remains unchanged, this correspondence will continue to exist, thereby achieving an effective association between the post-quantum certificate and the traditional certificate, facilitating the management and use of certificates.

[0117] According to a method for establishing a correspondence between a post-quantum certificate and a traditional certificate provided by the present invention, after obtaining the post-quantum certificate, the user's unique name of the traditional certificate is obtained; the post-quantum certificate is searched using the user's unique name as a filtering condition to find the corresponding post-quantum certificate.

[0118] Specifically, the process of searching for the corresponding post-quantum certificate from a traditional certificate is as follows: Figure 5 As shown. First, obtain the SubjectDN of the existing traditional certificate. Then, use the SubjectDN as the filter condition to search for the post-quantum certificate, and you can find the corresponding post-quantum certificate.

[0119] Since the DN of the traditional certificate and the post-quantum certificate are the same, the method of searching for the corresponding traditional certificate through the post-quantum certificate is the same as the above method. First, obtain the SubjectDN of the existing post-quantum certificate. Then, use the SubjectDN as the filter condition to search for the traditional certificate to find the corresponding traditional certificate.

[0120] By utilizing the SubjectDN information shared by traditional certificates and post-quantum certificates, two-way rapid search and matching between the two is achieved, simplifying the management process of certificate correspondence, improving the accuracy and efficiency of certificate retrieval, and ensuring the convenience and reliability of the correspondence between traditional certificates and post-quantum certificates in the certificate application system.

[0121] Based on the above scheme, the two methods for establishing a corresponding relationship between post-quantum certificates and traditional certificates proposed in the present invention have the following advantages over the prior art:

[0122] 1. The method of establishing a corresponding relationship between traditional certificates and post-quantum certificates through SubjectKeyID.

[0123] When a traditional certificate is reissued, as long as the key remains unchanged, the correspondence between the post-quantum certificate and the traditional certificate can still be maintained.

[0124] The corresponding traditional certificate can be quickly found through the post-quantum certificate.

[0125] 2. The method of establishing a corresponding relationship between traditional certificates and post-quantum certificates through SubjectDN.

[0126] When a traditional certificate is reissued, as long as the SubjectDN remains unchanged, the correspondence between the post-quantum certificate and the traditional certificate can still be maintained.

[0127] The corresponding traditional certificate can be quickly found through the post-quantum certificate.

[0128] The following is a description of the device for establishing a correspondence between a post-quantum certificate and a traditional certificate provided by the present invention. The device for establishing a correspondence between a post-quantum certificate and a traditional certificate described below and the method for establishing a correspondence between a post-quantum certificate and a traditional certificate described above can be referenced to each other.

[0129] like Figure 6 The present invention shows a device for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate, comprising:

[0130] A traditional certificate acquisition module 610, used to acquire a traditional certificate corresponding to a post-quantum certificate;

[0131] A traditional certificate attribute value acquisition module 620, used to acquire a user key identifier or a user distinguished name of a traditional certificate;

[0132] The certificate-to-be-signed construction module 630 is used to fill the user key identifier of the traditional certificate as the serial number of the post-quantum certificate into the certificate-to-be-signed of the post-quantum certificate, or fill the user distinguished name of the traditional certificate as the user distinguished name of the post-quantum certificate into the certificate-to-be-signed of the post-quantum certificate, and complete the construction of the post-quantum certificate-to-be-signed;

[0133] Signature module 640, used to sign the certificate to be signed using a post-quantum algorithm to generate a post-quantum signature value;

[0134] The encapsulation module 650 is used to encapsulate the certificate to be signed, the post-quantum algorithm ID and the post-quantum signature value into a post-quantum certificate.

[0135] Figure 7 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 7 As shown, the electronic device may include: a processor 710, a communication interface 720, a memory 730 and a communication bus 740, wherein the processor 710, the communication interface 720 and the memory 730 communicate with each other through the communication bus 740. The processor 710 may call the logic instructions in the memory 730 to execute a method for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate, the method comprising: obtaining a traditional certificate corresponding to the post-quantum certificate; obtaining a user key identifier or a user proprietary name of the traditional certificate; filling the user key identifier of the traditional certificate as the serial number of the post-quantum certificate into the certificate to be signed of the post-quantum certificate, or filling the user proprietary name of the traditional certificate as the user proprietary name of the post-quantum certificate into the certificate to be signed of the post-quantum certificate, and completing the construction of the post-quantum certificate to be signed; using the post-quantum algorithm to sign the certificate to be signed to generate a post-quantum signature value; encapsulating the certificate to be signed, the post-quantum algorithm ID and the post-quantum signature value into a post-quantum certificate.

[0136] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0137] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the method for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate provided by the above methods, the method including: obtaining a traditional certificate corresponding to the post-quantum certificate; obtaining a user key identifier or a user-specific name of the traditional certificate; filling the user key identifier of the traditional certificate as the serial number of the post-quantum certificate into the certificate to be signed of the post-quantum certificate, or filling the user-specific name of the traditional certificate as the user-specific name of the post-quantum certificate into the certificate to be signed of the post-quantum certificate, and completing the construction of the post-quantum certificate to be signed; using a post-quantum algorithm to sign the certificate to be signed to generate a post-quantum signature value; encapsulating the certificate to be signed, the post-quantum algorithm ID and the post-quantum signature value into a post-quantum certificate.

[0138] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to execute the method for establishing a corresponding relationship between a post-quantum certificate and a traditional certificate provided by the above methods, the method comprising: obtaining a traditional certificate corresponding to the post-quantum certificate; obtaining a user key identifier or a user distinguished name of the traditional certificate; filling the user key identifier of the traditional certificate as the serial number of the post-quantum certificate into the certificate to be signed of the post-quantum certificate, or filling the user distinguished name of the traditional certificate as the user distinguished name of the post-quantum certificate into the certificate to be signed of the post-quantum certificate, and completing the construction of the post-quantum certificate to be signed; signing the certificate to be signed using a post-quantum algorithm to generate a post-quantum signature value; encapsulating the certificate to be signed, the post-quantum algorithm ID and the post-quantum signature value into a post-quantum certificate.

[0139] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0140] Through the description of the above implementation modes, those skilled in the art can clearly understand that each implementation mode can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on such an understanding, the above technical solution can essentially or in other words be embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0141] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for establishing a correspondence between a post-quantum certificate and a traditional certificate, characterized in that: include: Obtain the traditional certificate corresponding to the post-quantum certificate; Obtaining a user key identifier of the traditional certificate; Fill the user key identifier of the traditional certificate into the certificate to be signed of the post-quantum certificate as the serial number of the post-quantum certificate, and complete the construction of the post-quantum certificate to be signed; Sign the certificate to be signed using a post-quantum algorithm to generate a post-quantum signature value; Encapsulating the certificate to be signed, the post-quantum algorithm ID, and the post-quantum signature value into a post-quantum certificate; After obtaining the post-quantum certificate, obtain the user key identifier of the traditional certificate; Searching for a certificate using the user key identifier of the traditional certificate as a serial number to find the corresponding post-quantum certificate; After obtaining the post-quantum certificate, obtain the serial number of the post-quantum certificate; Using the serial number of the post-quantum certificate as the user key identifier to search for the certificate, and find the corresponding traditional certificate; The serial number of the post-quantum certificate also includes a number; the lowest byte of the serial number of the post-quantum certificate is used as the number of the post-quantum certificate; the user key identifier of the traditional certificate is stored in the other high byte parts of the serial number of the post-quantum certificate except the lowest byte, so as to realize the establishment of a one-to-many relationship between a traditional certificate and multiple post-quantum certificates.

2. A method for establishing a correspondence between a post-quantum certificate and a traditional certificate, characterized in that: include: Obtain the traditional certificate corresponding to the post-quantum certificate; Obtaining a subject distinguished name of the traditional certificate; Filling the user's unique name of the traditional certificate into the certificate to be signed of the post-quantum certificate as the user's unique name of the post-quantum certificate, and completing the construction of the post-quantum certificate to be signed; Sign the certificate to be signed using a post-quantum algorithm to generate a post-quantum signature value; Encapsulating the certificate to be signed, the post-quantum algorithm ID and the post-quantum signature value into a post-quantum certificate; After obtaining the post-quantum certificate, obtain the user's unique name of the traditional certificate; Searching for a post-quantum certificate using the user's unique name as a filter condition to find a corresponding post-quantum certificate; After obtaining the post-quantum certificate, obtain the user's unique name of the existing post-quantum certificate, use the user's unique name as a filter condition to search for traditional certificates, and find the corresponding traditional certificate.

3. A device for establishing a correspondence between a post-quantum certificate and a traditional certificate, characterized in that: include: A traditional certificate acquisition module, used to obtain the traditional certificate corresponding to the post-quantum certificate; A traditional certificate attribute value acquisition module, used to obtain a user key identifier or a user distinguished name of the traditional certificate; A certificate to be signed construction module, used to fill the user key identifier of the traditional certificate as the serial number of the post-quantum certificate into the certificate to be signed of the post-quantum certificate, or fill the user distinguished name of the traditional certificate as the user distinguished name of the post-quantum certificate into the certificate to be signed of the post-quantum certificate, and complete the construction of the post-quantum certificate to be signed; A signature module, used to sign the certificate to be signed using a post-quantum algorithm to generate a post-quantum signature value; An encapsulation module, used to encapsulate the certificate to be signed, the post-quantum algorithm ID and the post-quantum signature value into a post-quantum certificate; The device is also used to: obtain the user key identifier of the traditional certificate after obtaining the post-quantum certificate; use the user key identifier of the traditional certificate as the serial number to search for the certificate and find the corresponding post-quantum certificate; The device is also used to: obtain the user's proprietary name of the traditional certificate after obtaining the post-quantum certificate; Searching for a post-quantum certificate using the user's unique name as a filter condition to find a corresponding post-quantum certificate; The device is also used to: after obtaining the post-quantum certificate, obtain the serial number of the post-quantum certificate; use the serial number of the post-quantum certificate as the user key identifier to search for the certificate and find the corresponding traditional certificate.

4. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the method for establishing a correspondence between a post-quantum certificate and a traditional certificate as described in any one of claims 1 to 2 is implemented.

5. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for establishing a correspondence between a post-quantum certificate and a traditional certificate as described in any one of claims 1 to 2 is implemented.

6. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method for establishing a correspondence between a post-quantum certificate and a traditional certificate as described in any one of claims 1 to 2 is implemented.

Images