SSLVPN identity authentication method, device and equipment for quantum key distribution

Abstract

The present application discloses an SSLVPN identity authentication method, apparatus and device for quantum key distribution, which belongs to the technical field of secure socket layer protocol server authentication. A quantum communication encryption channel is established between the client and the SSLVPN server through a quantum transceiver module to negotiate keys, and at the same time, the data transmission encryption is completed in combination with the SSL / TLS protocol. Through the quantum transceiver module, after each communication, the two parties regenerate and share a new shared key to avoid the security risks that may be caused by the long-term use of the same key. At the same time, the present application introduces a quantum enhanced identity authentication server for secondary authentication in the user identity authentication process, encrypts the biometric data through the quantum key, and transmits it to the identity authentication server to complete the biometric feature comparison, ensuring the data cannot be tampered with and has high confidentiality in the transmission link, thereby further improving the security and reliability of identity authentication.

Description

Technical Field

[0001] The present application belongs to the technical field of secure socket layer protocol server authentication, and in particular to SSLVPN identity authentication methods, devices and equipment for quantum key distribution. Background Art

[0002] SSL VPN (Secure Sockets Layer Virtual Private Network) is a security technology that uses the SSL (Secure Sockets Layer) protocol to implement remote access to an enterprise's internal network.

[0003] In the existing SSLVPN user authentication technology, although encryption technology is used, there are still many challenges, especially in key management, transmission security, and the potential threat of future quantum computers to classical encryption algorithms. Traditional SSLVPN methods are not ideal in the face of these challenges.

[0004] The invention patent with publication number "CN118316742B" discloses a digital certificate authentication method and system based on quantum key encryption. The method includes: injecting a quantum key digital certificate; when performing a quantum key distribution operation, setting the quantum key identity authentication operation between the two communicating parties, and using the properties of the quantum state to design an applicable protocol to perform a quantum key identity authentication operation; the two communicating parties use the quantum key distribution protocol to generate a set of random numbers to coordinate quantum keys, use the quantum key as a key parameter, perform data summary operations on the original quantum key, generate a quantum fusion session key, and establish a quantum SSL VPN encryption channel for encrypted communication. It solves the technical problems of low security in specific attack scenarios and low operating efficiency that make it difficult to apply to large-scale communication scenarios. However, the quantum key is stored in the initial U shield, which is called the quantum U shield. This design method affects the implementation of dynamic quantum key updates to a certain extent.

[0005] The existing SSLVPN user identity authentication methods have the following shortcomings:

[0006] 1. Existing SSLVPN methods rely on passwords for authentication, but passwords are vulnerable to guessing attacks, brute force attacks, and replay attacks, resulting in low security. Although authentication based on public key infrastructure (PKI) provides stronger security, key management still faces difficulties, especially in key generation, distribution, storage, and updating. Even with encryption protocols such as SSL / TLS, it is difficult to prevent security risks such as man-in-the-middle attacks (MITM).

[0007] 2. Existing SSLVPN user authentication methods lack adaptability to dynamic network environments and are unstable when network topology changes or network latency increases, which can easily lead to connection interruptions and authentication failures.

[0008] 3. Existing SSLVPN generates random numbers through a pseudo-random number generator for login verification, but this method may be predicted or reverse analyzed by attackers. Summary of the invention

[0009] This application aims to solve the potential security risks and risks in the SSLVPN authentication process of the prior art. The SSLVPN authentication method, device and equipment of quantum key distribution establish a secure channel through quantum communication to ensure that the authentication process is safer and more reliable. This technology is applied to computer network security, especially to enhance the security of remote access, and has broad application prospects. The technical solution is as follows:

[0010] On the one hand, a quantum key distribution SSLVPN authentication method is provided, including:

[0011] Step S1: The SSLVPN server and the client establish a quantum communication encryption channel through the quantum transceiver module to negotiate the key, and at the same time combine the SSL / TLS protocol to complete the data transmission encryption. The client and the SSLVPN server share the quantum key through the quantum communication network;

[0012] Step S2: The SSLVPN server receives and verifies the login request sent by the client through the quantum encryption channel;

[0013] Step S3: If the login request sent by the client in step S2 is verified, the SSLVPN server sends the encrypted request content to the identity authentication server through the quantum communication channel. After each request content data transmission is completed, the SSLVPN server and the identity authentication server will regenerate and share a new quantum key. The identity authentication server sends a biometric identification request to the client through the quantum encryption channel to perform secondary identity authentication of the user and compare biometric features;

[0014] Step S4: After the SSLVPN server receives the encrypted authentication result sent by the identity authentication server through the quantum communication channel, it decrypts it using the shared new quantum key generated in step S3.

[0015] As a further technical solution, the quantum transceiver module is built into the SSLVPN server and identity authentication server, supporting the QKD quantum key distribution protocol and QRNG quantum random number generation.

[0016] According to a further technical solution, the encrypted request content in step S3 includes the user's unique identification, biometric authentication requirements and client device information.

[0017] According to a further technical solution, the login request in step S2 is the digital certificate of the client and the digital signature generated by the USBKey.

[0018] In a further technical solution, the SSLVPN server receives and verifies the login request sent by the client, including:

[0019] The SSLVPN server decrypts the login request sent by the client in step S2 using the shared quantum key;

[0020] The SSLVPN server uses the public key infrastructure (PKI) mechanism to verify the certificate chain using the root certificate issued by the certificate authority (CA).

[0021] After the certificate chain is verified, the SSLVPN server further verifies the digital signature generated by the client's USBKey;

[0022] If the client's identity is verified correctly through the certificate and signature, the SSLVPN server will generate and share a new quantum key through the quantum transceiver module to complete the client's identity authentication.

[0023] In a further technical solution, the steps of certificate chain verification include: checking whether the certificate is issued by a trusted certificate authority CA, verifying whether the certificate is within the validity period, and checking whether the certificate is revoked.

[0024] As a further technical solution, the identity authentication server sends a biometric identification request to the client through a quantum encryption channel, performs secondary identity authentication of the user and performs a comparison. The process includes:

[0025] The identity authentication server sends a biometric request to the client through a quantum encryption channel, and the biometric hardware on the client scans the user's biometric information through fingerprint or face recognition;

[0026] Transmit the user's biometric information and comparison request through a quantum encryption channel;

[0027] Transmitted through a quantum encrypted channel, the identity authentication server verifies whether the biometric data provided by the user matches the template in the database, the verification process and the comparison results.

[0028] After each communication, both parties will regenerate and share a new shared key as needed.

[0029] As a further technical solution, the data decrypted in step S4 will provide verification information, and the SSLVPN server will determine whether the user has passed the identity authentication based on the decrypted authentication:

[0030] If the decrypted authentication result indicates that the user identity authentication is successful, the SSLVPN server will allow the user to access VPN resources according to the authorization rules;

[0031] If the decrypted authentication result indicates that the verification fails, the user is denied access;

[0032] After the authentication result is sent and decrypted, the SSLVPN server and identity authentication server will update the quantum key through the quantum transceiver module.

[0033] On the other hand, the SSLVPN authentication device provided by the quantum key distribution includes:

[0034] Establish a module to establish a quantum communication encryption channel between the SSLVPN server and the client through the quantum transceiver module, conduct key negotiation, and combine the traditional SSL / TLS protocol to complete data transmission encryption. The client and the SSLVPN server share the quantum key through the quantum communication network;

[0035] The verification module is used for the SSLVPN server to receive and verify the login request sent by the client through the quantum encryption channel; if the client's digital certificate is verified, the SSLVPN server sends the encrypted request content to the identity authentication server through the quantum communication channel. After each request content data transmission is completed, the SSLVPN server and the identity authentication server will regenerate and share a new quantum key. The identity authentication server sends a biometric request to the client through the quantum encryption channel, performs the user's secondary identity authentication and compares it; after the SSLVPN server receives the encrypted authentication result sent by the identity authentication server through the quantum communication channel, it decrypts it by sharing the new quantum key.

[0036] On the other hand, a computer device is provided, comprising a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, the computer device is triggered to execute the SSLVPN authentication method of quantum key distribution.

[0037] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages:

[0038] 1. By establishing a secure channel through quantum communication, unforgeable key distribution is achieved, which effectively prevents the security threat of man-in-the-middle attacks and ensures the legitimacy of user identity and the validity of session keys.

[0039] 2. The use of quantum transceiver modules provides higher security. After each communication, both parties regenerate and share a new shared key to avoid security risks caused by long-term use of the same key.

[0040] 3. This application introduces a quantum-enhanced authentication server for secondary authentication during the user authentication process, encrypts the biometric data through a quantum key, and transmits it to the authentication server to complete the biometric feature comparison, ensuring the data is tamper-proof and highly confidential in the transmission link, thereby further improving the security and reliability of authentication.

[0041] 4. The SSLVPN server and identity authentication server of this application are both quantum-enhanced devices with built-in quantum transceiver modules that support QKD quantum key distribution and QRNG quantum random number generation. The keys generated by the quantum transceiver module are unpredictable and highly random, making the generated verification data impossible to calculate or predict in advance under any circumstances, greatly enhancing the randomness and unforgeability of identity authentication, making the generation of session keys more secure and reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0043] Figure 1 A flowchart of an SSLVPN identity authentication method for quantum key distribution provided in a preferred embodiment of the present application;

[0044] Figure 2 Schematic diagram of establishing data flow interaction for quantum communication encryption channel. DETAILED DESCRIPTION

[0045] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0046] like Figure 1 and Figure 2 As shown, the SSLVPN authentication method of quantum key distribution includes the following specific steps:

[0047] Step S1: A quantum communication encryption channel is established between the SSLVPN server and the client through a quantum transceiver module to negotiate keys. At the same time, the SSL / TLS protocol is combined to complete data transmission encryption. The client and the SSLVPN server share quantum keys through a quantum communication network.

[0048] The SSLVPN and identity authentication server in this embodiment are both quantum-enhanced devices with built-in quantum transceiver modules that support quantum key distribution (QKD) and quantum random number generation (QRNG). The quantum transceiver module is based on the BB84 quantum key distribution protocol.

[0049] Specifically, a secure quantum communication channel is established between the client and the SSLVPN server, and a shared encryption key is generated through the quantum transceiver module. The client and the SSLVPN server share the key through the quantum communication network for subsequent data encryption and decryption. The confidentiality of the communication process between the client and the SSLVPN server is guaranteed through quantum key distribution.

[0050] Step S2: The SSLVPN server receives and verifies the login request sent by the client through the quantum encryption channel;

[0051] Specifically, the client inserts the USBKey into the device, logs in and authenticates using the USBKey+PIN code, and uses the USBKey to generate a digital signature based on the public key infrastructure (PKI). The client submits the certificate and the digital signature generated by the USBKey to the SSLVPN server through a quantum encryption channel.

[0052] The SSLVPN server receives and verifies the login request sent by the client, including the following processing steps:

[0053] (1) The SSLVPN server first uses the shared key obtained through the quantum key distribution protocol (QKD) in the second step to decrypt the encrypted request sent by the client. This request contains the client's digital certificate and the signature generated by USBKey.

[0054] (2) The decrypted request content contains the client's digital certificate. The SSLVPN server uses the root certificate issued by the Certificate Authority (CA) through the Public Key Infrastructure (PKI) mechanism to verify the certificate chain to ensure the validity of the client certificate and the authenticity of its signature.

[0055] The steps of certificate chain verification include: checking whether the certificate is issued by a trusted certificate authority (CA), verifying whether the certificate is within the validity period, and checking whether the certificate has been revoked.

[0056] (3) After the certificate chain is verified, the SSLVPN server will further check the client's USBKey signature. Using the digital signature generated by the USBKey, the SSLVPN server can verify whether the client has used a legitimate private key to generate the signature, thereby confirming the authenticity of the client's identity.

[0057] (4) If the client's identity is verified correctly through the certificate and signature, the SSLVPN server will complete the client's identity authentication based on the shared key obtained by the quantum key distribution protocol (QKD).

[0058] Step S3: If the login request sent by the client in step S2 is verified, the SSLVPN server sends the encrypted request content to the identity authentication server through the quantum communication channel. After each request content data transmission is completed, the SSLVPN server and the identity authentication server will regenerate and share a new quantum key. The identity authentication server sends a biometric request to the client through the quantum encryption channel, performs secondary identity authentication of the user and compares the biometric features.

[0059] The request content in this embodiment includes the user's unique identification, biometric authentication requirements, device information, etc. The SSLVPN server and the identity authentication server will update the shared quantum key as needed. Specifically, after each request data transmission is completed, the two parties will regenerate and share a new key to ensure that the same key is no longer used in subsequent communications, preventing the potential security risks of a single key in long-term communications, such as key leakage, reuse attacks, and other issues.

[0060] The identity authentication server sends a biometric identification request to the client through a quantum encryption channel to perform secondary identity authentication and comparison. The process includes:

[0061] (1) The identity authentication server sends a biometric request to the client mobile device through a quantum encryption channel, and the biometric hardware on the device scans the user's biometric information through fingerprint or face recognition.

[0062] (2) The user's biometric information and comparison request will be transmitted through a quantum encryption channel to ensure data security during the information transmission, storage and verification process. Quantum encryption technology can effectively prevent eavesdropping and tampering in this link and ensure the confidentiality of biometric data.

[0063] (3) The identity authentication server verifies whether the biometric data provided by the user matches the template in the database. The verification process and comparison results are transmitted through a quantum encryption channel.

[0064] (4) After the entire biometric authentication process is completed, the authentication server and client device will update the shared quantum key. After each communication, both parties will regenerate and share a new shared key as needed to avoid the security risks that may arise from using the same key for a long time.

[0065] Step S4: After the SSLVPN server receives the encrypted authentication result sent by the identity authentication server through the quantum communication channel, it decrypts it using the shared new quantum key generated in step S3.

[0066] Specifically, the identity authentication server will encrypt the authentication result of the user's identity and send it to the SSLVPN server through the quantum communication channel. After receiving the encrypted authentication result sent by the identity authentication server, the SSLVPN server will decrypt it using the previously shared quantum key. The decrypted data will provide verification information, and the SSLVPN server will determine whether the user has passed the identity authentication based on the decrypted authentication.

[0067] If the decrypted authentication result indicates that the user identity authentication is successful, the SSLVPN server will allow the user to access VPN resources according to the authorization rules;

[0068] If authentication fails, user access is denied, ensuring that unauthorized users are not authorized to access network resources.

[0069] After the authentication result is sent and decrypted, the SSLVPN server and identity authentication server will update the key through the quantum key distribution protocol to ensure that subsequent communications use the new shared key, thereby improving the security of the system.

[0070] The SSLVPN identity authentication device for quantum key distribution provided in the present application adopts the SSLVPN identity authentication method for quantum key distribution, and the device comprises:

[0071] Establish a module to establish a quantum communication encryption channel between the SSLVPN server and the client through the quantum transceiver module, conduct key negotiation, and combine the traditional SSL / TLS protocol to complete data transmission encryption. The client and the SSLVPN server share the quantum key through the quantum communication network;

[0072] The verification module is used for the SSLVPN server to receive and verify the login request sent by the client through the quantum encryption channel; if the client's digital certificate is verified, the SSLVPN server sends the encrypted request content to the identity authentication server through the quantum communication channel. After each request content data transmission is completed, the SSLVPN server and the identity authentication server will regenerate and share a new quantum key. The identity authentication server sends a biometric request to the client through the quantum encryption channel, performs the user's secondary identity authentication and compares it; after the SSLVPN server receives the encrypted authentication result sent by the identity authentication server through the quantum communication channel, it decrypts it by sharing the new quantum key.

[0073] The present application provides a computer device, a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, the computer device is triggered to execute the SSLVPN authentication method of quantum key distribution.

[0074] In summary, the SSLVPN and identity authentication server of this application are both quantum-enhanced devices with built-in quantum transceiver modules that support quantum key distribution (QKD) and quantum random number generation (QRNG). This application uses a quantum transceiver module. After each communication, the two parties regenerate and share a new shared key to avoid the security risks that may arise from long-term use of the same key. At the same time, this application introduces a quantum-enhanced identity authentication server for secondary authentication during the user authentication process, encrypts the biometric data through a quantum key, and transmits it to the identity authentication server to complete the biometric feature comparison, ensuring that the data cannot be tampered with and has high confidentiality in the transmission link, thereby further improving the security and reliability of identity authentication.

[0075] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0076] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An SSLVPN identity authentication method based on quantum key distribution, characterized in that: include, Step S1: A quantum communication encryption channel is established between the SSLVPN server and the client to negotiate the key. At the same time, the encrypted data transmission is completed in combination with the SSL / TLS protocol. The client and the SSLVPN server share the quantum key through the quantum communication encryption channel. Step S2: The SSLVPN server receives and verifies the login request sent by the client through the quantum communication encryption channel. The login request includes the client's digital certificate and the digital signature generated by the USBKey; Step S3: If the digital certificate and digital signature are verified, the login request sent by the client is verified, and the SSLVPN server sends the encrypted request content to the identity authentication server through the quantum communication encryption channel. The encrypted request content includes the user's unique identifier, biometric authentication requirements and client device information; after each request content data transmission is completed, the SSLVPN server and the identity authentication server will regenerate and share a new quantum key, and the identity authentication server will send a biometric request to the client through the quantum communication encryption channel. The identity authentication server receives the user's biometric information sent by the client and performs a biometric comparison, performs a secondary identity authentication of the user, and obtains an authentication result; Step S4: After the SSLVPN server receives the encrypted authentication result sent by the identity authentication server through the quantum communication encryption channel, it uses the new quantum key regenerated in step S3 for decryption.

2. The SSLVPN identity authentication method of quantum key distribution according to claim 1, characterized in that: The SSLVPN server and identity authentication server are each equipped with a built-in quantum transceiver module to support the QKD quantum key distribution protocol and QRNG quantum random number generation.

3. The SSLVPN identity authentication method of quantum key distribution according to claim 1, characterized in that: The SSLVPN server receives and verifies the login request sent by the client, including: The SSLVPN server decrypts the login request sent by the client in step S2 using the shared quantum key; The SSLVPN server uses the public key infrastructure (PKI) mechanism to verify the certificate chain using the root certificate issued by the certificate authority (CA). After the certificate chain is verified, the SSLVPN server further verifies the digital signature generated by the client's USBKey; If the client's identity passes the certificate chain verification and signature verification, the client's login request is authenticated.

4. The SSLVPN identity authentication method of quantum key distribution according to claim 3, characterized in that: The steps of verifying the certificate chain include: checking whether the certificate is issued by a trusted certificate authority CA, verifying whether the certificate is within the validity period, and checking whether the certificate is revoked.

5. The SSLVPN identity authentication method of quantum key distribution according to claim 1, characterized in that: The identity authentication server sends a biometric identification request to the client through a quantum communication encryption channel. The identity authentication server receives the user's biometric information sent by the client and performs a biometric comparison, performs a secondary identity authentication of the user, and obtains an authentication result, including: The identity authentication server sends a biometric request to the client through a quantum communication encryption channel, and the biometric hardware on the client scans the user's biometric information through fingerprint or face recognition; The client sends the collected biometric information to the identity authentication server through a quantum communication encryption channel; The identity authentication server receives the biometric information and verifies whether the biometric information matches the user biometric template stored in the database; The identity authentication server sends the authentication result to the SSLVPN server through a quantum communication encryption channel.

6. The SSLVPN identity authentication method of quantum key distribution according to claim 2, characterized in that: Step S4 also includes: The SSLVPN server uses the new quantum key to decrypt the encrypted authentication result sent by the identity authentication server and obtain the authentication result; If the decrypted authentication result indicates that the user identity authentication is successful, the SSLVPN server will allow the user to access VPN resources according to the authorization rules; If the decrypted authentication result indicates that the verification failed, the SSLVPN server will deny user access; After the authentication result is sent and decrypted, the SSLVPN server and identity authentication server perform quantum key updates.

7. An SSLVPN identity authentication device for quantum key distribution, using the SSLVPN identity authentication method for quantum key distribution according to any one of claims 1 to 6, characterized in that: The device comprises, Establish a module for establishing a quantum communication encryption channel between the SSLVPN server and the client, performing key negotiation, and completing data encryption transmission in combination with the SSL / TLS protocol. The client and the SSLVPN server share the quantum key through the quantum communication encryption channel; The verification module is used for the SSLVPN server to receive and verify the login request sent by the client through the quantum communication encryption channel. The login request includes the client's digital certificate and the digital signature generated by the USBKey; if the digital certificate and the digital signature are verified, the login request sent by the client is verified, and the SSLVPN server sends the encrypted request content to the identity authentication server through the quantum communication encryption channel. The encrypted request content includes the user's unique identification, biometric authentication requirements and client device information; after each request content data transmission is completed, the SSLVPN server and the identity authentication server will regenerate and share a new quantum key, and the identity authentication server will send a biometric request to the client through the quantum communication encryption channel. The identity authentication server receives the user's biometric information sent by the client and performs a biometric comparison, performs a secondary identity authentication of the user, and obtains an authentication result; After the SSLVPN server receives the encrypted authentication result sent by the identity authentication server through the quantum communication encryption channel, it uses the new quantum key to decrypt.

8. A computer device, characterized in that: The computer device includes a memory for storing computer program instructions and a processor for executing the program instructions, wherein, when the computer program instructions are executed by the processor, the computer device is triggered to execute the SSLVPN authentication method for quantum key distribution as described in any one of claims 1 to 6.

Images