Real-name authentication method for global quantum security encryption machine

Abstract

The invention relates to the technical field of information security, in particular to a real-name authentication method for a global quantum security encryption machine. According to the scheme of the invention, real-name binding is carried out on the user and the client device thereof and the quantum security encryption machine based on the quantum security CA certificate, and each user and device are ensured to have a unique and unforgeable identity label, so that unauthorized access is effectively prevented, and the system security is improved. And meanwhile, through a periodic verification mechanism, the identity can be confirmed regularly after the equipment is accessed, illegal use and potential security threats are avoided, and the user information security is further guaranteed. Besides, a Toeplitz matrix is utilized to calculate a hash value, so that the hash value generated each time depends on a random number S and an irreducible polynomial P provided by the quantum security encryption machine, and high randomness and variability are ensured, thereby greatly reducing the risk that a pretending user and equipment send real-name access confirmation to the quantum security encryption machine, and enhancing the overall security.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method for real-name authentication of a global quantum security encryption machine. Background Art

[0002] With the rapid development of information technology, network security issues are becoming increasingly serious, especially in terms of privacy protection of individual users and information transmission security. Traditional encryption technology is unable to cope with increasingly complex network attacks and data theft. Therefore, as an emerging security protection method, the importance and application potential of quantum secure encryption technology are gradually being valued.

[0003] The global quantum security encryption machine is an encryption device designed for personal terminals. It can provide users with secure quantum communication services by connecting to a personal computer through a network cable. The design concept of this device is to ensure the absolute security of information during transmission through quantum key distribution and quantum state encryption. Through the global quantum security encryption machine, users can not only achieve secure communication with other quantum security devices, but also protect sensitive information from being stolen or tampered with.

[0004] However, since the global quantum security encryption machine is an external device, its portability allows the device to be moved or replaced at any time. Although this flexibility is convenient, it also raises a series of security risks. Although the global quantum security encryption machine implements an access authentication process when accessing the network to ensure the legitimacy of the device itself, this authentication mechanism cannot be effectively bound to the connected personal computer. This means that unauthorized users can easily connect the global quantum security encryption machine to other personal computers or devices, leading to potential risks of illegal use.

[0005] Therefore, when individual users use the global quantum security encryption machine, how to ensure the security of the device and prevent it from being misappropriated or illegally used by others has become an urgent problem to be solved. Summary of the invention

[0006] To solve the above problems, this application discloses a method for real-name authentication of a global quantum security encryption machine, comprising the following steps:

[0007] The quantum security encryption machine registers the quantum CA certificate with the quantum CA authorization center according to the user's real identity information and user private key PVK sent by the client, and downloads and stores the issued quantum CA certificate through the user's private key PVK. The quantum CA certificate includes the user's public certificate PCE and the user's quantum CA privacy identity OID, thereby completing the binding of the quantum security encryption machine with the user's real-name system;

[0008] The quantum security encryption machine receives the access request from the client, generates the public certificate framework information according to the user private key PVK in the access request, and returns it to the client with the generated random number S and irreducible polynomial P;

[0009] The client calculates the hash Hk of the user's private key PVK according to the hash algorithm specified in the public certificate framework information; constructs the user's public certificate PCE' with the obtained hash Hk and the user's real identity information according to the format requirements of the public certificate framework information; then constructs a ToePlitz matrix based on the random number S and the irreducible polynomial P to calculate the hash Hc of the user's public certificate PCE'; and sends an access confirmation message to the quantum secure encryption machine carrying the calculated hash Hc;

[0010] The quantum secure encryption machine calculates the hash Hs corresponding to the user's public certificate PCE stored locally based on the generated random number S and the irreducible polynomial P, verifies whether the hash Hs is consistent with the received hash Hc, and confirms that the authentication is successful when the verification is consistent. For this purpose, the client and the user open the quantum secure encryption channel, otherwise it remains closed.

[0011] In the above scheme, the configuration method of the quantum secure encryption machine includes:

[0012] On the client side, configure the access base station information and quantum CA authorization center information for the quantum security encryption machine through the configuration port;

[0013] The quantum security encryption machine initiates an access authentication request to the configured access base station to verify the legitimacy of the quantum security encryption machine.

[0014] In the above scheme, the quantum secure encryption machine further registers the quantum CA certificate with the quantum CA authorization center based on the client device information, the user's real identity information and the user's private key PVK, thereby completing the binding of the user, the client device and the quantum secure encryption machine.

[0015] In the above scheme, the quantum secure encryption machine and the client perform periodic identity authentication to verify the bound client.

[0016] In the above scheme, the method of periodic identity authentication includes:

[0017] The quantum security encryption machine periodically sends a real-name access verification message to the client, which carries a random number s' and an irreducible polynomial P', and s' and P' are different each time they are sent;

[0018] The client receives the verification message, constructs a ToePlitz matrix according to the random number s' and the irreducible polynomial P', performs hash calculation on the user's public certificate, and generates a hash value H'c;

[0019] The client sends a real-name access confirmation message to the quantum security encryption machine, and the confirmation message carries a hash value H'c;

[0020] The quantum secure encryption machine receives the real-name access confirmation message, extracts the hash value H'c, and then calculates the hash value H's based on the locally stored user public certificate and the random number s' and the irreducible polynomial P'; verifies whether the hash value H'c is consistent with H's. If H'c is consistent with H's, the quantum secure encryption channel is kept open; if not, another verification is attempted; if the second verification is still inconsistent, the quantum secure encryption channel is closed and the quantum secure encryption communication service is stopped.

[0021] The solution of this application uses the quantum secure CA certificate to bind users and their client devices to the quantum secure encryption machine in real name, so that each user and device has a unique and unforgeable identity during use. This real-name binding mechanism effectively prevents unauthorized users or devices from accessing and improves the overall security of the system.

[0022] By introducing a periodic verification mechanism, the problem of quantum security encryption machines being connected to other client devices after real-name access is successful is solved. This measure ensures that the device can periodically confirm its identity even after access, thereby preventing illegal use and potential security threats, and further protecting the user's information security.

[0023] The ToePlitz matrix is ​​used to calculate the hash value, ensuring that each generated hash value depends on the random number s and irreducible polynomial PP provided by the quantum security encryption machine. This design makes the generated hash value highly random and variable each time, greatly reducing the risk of someone pretending to be a user or device and sending a real-name access confirmation to the quantum security encryption machine. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 This is a timing diagram of the real-name authentication process of the global quantum secure encryption machine in an embodiment of the present application;

[0025] Figure 2 A schematic diagram of a method flow chart of a real-name authentication process of a global quantum secure encryption machine in an embodiment of the present application;

[0026] Figure 3 This is a flow chart of a configuration method of a quantum secure encryption machine in an embodiment of the present application;

[0027] Figure 4 This is a flow chart of a method for periodic identity authentication in an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0029] Example: Figure 1-2 As shown, a method for real-name authentication of a global quantum security encryption machine includes the following steps:

[0030] S101: The quantum security encryption machine registers the quantum CA certificate with the quantum CA authorization center according to the user's real identity information and user private key PVK sent by the client, and downloads and stores the issued quantum CA certificate through the user's private 1111212123 PVK. The quantum CA certificate includes the user's public certificate PCE and the user's quantum CA privacy identity OID, thereby completing the binding of the quantum security encryption machine with the user's real-name system;

[0031] The user's real identity information includes name, ID number, etc. The user's private key PVK is the corresponding user account key; the Quantum CA Authorization Center verifies the user's identity

[0032] Information and private key PVK, if the verification is successful, a quantum CA certificate will be issued;

[0033] The user public certificate PCE contains the user's public information and encrypted data, which is used to verify the user's identity in digital communications and ensure the security and credibility of information transmission. It is issued and signed by the quantum CA authorization center and combined with quantum encryption (encrypted by quantum true random numbers) to provide a higher level of security.

[0034] The user quantum CA privacy identity OID is a unique identifier used to identify the user's privacy identity information in quantum security encryption authentication. It avoids directly using the user's real identity, enhances privacy protection, simplifies identity management, and improves security, ensuring effective identity authentication and data interaction between different systems;

[0035] The user private key PVK is used to ensure that only legitimate users can decrypt and obtain the quantum CA certificate;

[0036] The PCE and OID in the quantum CA certificate are used for subsequent identity authentication and encrypted communication;

[0037] S102: The quantum secure encryption machine receives an access request from the client, generates public certificate framework information based on the user private key PVK in the access request, and returns it to the client with the generated random number S and irreducible polynomial P;

[0038] The random number S and irreducible polynomial P are used for subsequent hash calculations to ensure the uniqueness and security of each authentication process;

[0039] S103: The client calculates the hash Hk of the user's private key PVK according to the hash algorithm specified in the public certificate framework information; constructs the user's public certificate PCE' with the obtained hash Hk and the user's real identity information according to the format requirements of the public certificate framework information; then constructs a ToePlitz matrix according to the random number S and the irreducible polynomial P to calculate the hash Hc of the user's public certificate PCE'; and sends an access confirmation message to the quantum secure encryption machine carrying the calculated hash Hc;

[0040] Specifically including: extracting the specified hash algorithm (such as SHA-256, SHA-3, etc.) from the public certificate framework information;

[0041] Hash the user's private key PVK using the extracted hash algorithm:

[0042] Hk=Hash algorithm (PVK)

[0043] Construct the user public certificate PCE':

[0044] Obtain the user's real identity information (such as name, email, address, etc.) based on the input;

[0045] According to the format requirements of the public certificate framework information, the hash Hk and the user's real identity information are combined to construct the user public certificate PCE'; its format may include:

[0046] Certificate version, user identity information, hash value Hk, certificate validity period, other metadata, etc.;

[0047] A ToePlitz matrix is ​​generated using a random number S and an irreducible polynomial P. The matrix construction process includes: setting the size of the matrix (the number of rows and columns); filling the first row and the first column of the matrix, and filling other elements according to the characteristics of the ToePlitz matrix.

[0048] Use the ToePlitz matrix to transform PCE', input the transformed result into the selected hash algorithm, and calculate the hash value:

[0049] Hc = hash algorithm (Toeplitz matrix transformation (PCE′));

[0050] A Toeplitz matrix is ​​a special matrix in which the elements of each row are constants from left to right. For example, given a random number S and an irreducible polynomial P, a Toeplitz matrix can be constructed as follows:

[0051] Assume that the random number S is a quantum true random number: S = [s 0 ,s 1 ,…,s n ]; the irreducible polynomial is p(x)=a 0 +a 1 x+…+a m x m ; We can create a Toeplitz matrix of size (n+1)×(mn+1), where the elements of S are filled on the diagonal, and the resulting Toeplitz matrix is:

[0052]

[0053] Construct an access confirmation message, including the calculated hash value Hc; wait for the response from the quantum secure encryption machine to confirm whether the access request is accepted to ensure the smooth progress of subsequent steps;

[0054] The hash algorithm provides data integrity and consistency verification. The use of the Toeplitz matrix makes hash calculations more secure and increases the ability to resist collision attacks.

[0055] S104: The quantum secure encryption machine calculates the hash Hs corresponding to the user's public certificate PCE stored locally based on the generated random number S and the irreducible polynomial P, verifies whether the hash Hs is consistent with the received hash Hc, and confirms that the authentication is successful when the verification is consistent. For this purpose, the client and the user open the quantum secure encryption channel, otherwise it remains closed.

[0056] like Figure 3 As shown, in a possible implementation, the configuration method of the quantum secure encryption machine includes:

[0057] S201: On the client side, configure the access base station information and quantum CA authorization center information for the quantum security encryption machine through the configuration port;

[0058] By obtaining the IP address or domain name of the access base station, ensure that the access base station supports the quantum secure communication protocol and can interact with the quantum secure encryption machine;

[0059] S202: The quantum secure encryption machine initiates an access authentication request to the configured access base station to verify the legitimacy of the quantum secure encryption machine.

[0060] In a quantum-safe encryption machine, the authentication request message is constructed and can include the following information:

[0061] A unique identifier of the encrypted machine (such as a serial number or ID); a current timestamp and a random number to ensure the uniqueness of the request; and possible additional information such as device type or software version.

[0062] Send a request to the access base station:

[0063] The constructed request message is sent to the API interface of the access base station through the configured port.

[0064] Make sure to use an appropriate communication protocol (such as HTTPS) to secure the request.

[0065] Receive Response:

[0066] Wait for the response from the access base station, which may include the authentication result (success or failure), session key or other additional information.

[0067] Make sure to receive the response within the allotted time to avoid timeouts.

[0068] Processing authentication results:

[0069] According to the received response, the legitimacy of the quantum security encryption machine is judged:

[0070] If the authentication is successful, continue with the subsequent operations.

[0071] If authentication fails, log the error and take appropriate error handling actions, such as retrying or notifying the user.

[0072] The quantum security encryption machine further registers the quantum CA certificate with the quantum CA authorization center based on the client device information, the user's real identity information and the user's private key PVK, thereby completing the binding of the user, the client device and the quantum security encryption machine.

[0073] The quantum security encryption machine collects client device information, user real identity information and user private key (PVK), builds a certificate issuance request (CSR), and submits the request to the quantum CA authorization center to register the quantum CA certificate. This process ensures the binding between the user, client device and quantum security encryption machine, thereby achieving secure identity authentication and communication.

[0074] The quantum secure encryption machine performs periodic identity authentication with the client to verify the bound client.

[0075] like Figure 4 As shown, the method for periodic identity authentication includes:

[0076] S301: The quantum secure encryption machine periodically sends a real-name access verification message to the client, the verification message carries a random number s' and an irreducible polynomial P', and s' and P' are different each time they are sent;

[0077] S302: The client receives the verification message, constructs a ToePlitz matrix according to the random number s' and the irreducible polynomial P', performs hash calculation on the user's public certificate, and generates a hash value H'c;

[0078] S303: The client sends a real-name access confirmation message to the quantum security encryption machine, and the confirmation message carries a hash value H'c;

[0079] S304: The quantum secure encryption machine receives the real-name access confirmation message, extracts the hash value H'c, and then calculates the hash value H's based on the locally stored user public certificate and the random number s' and the irreducible polynomial P'; verifies whether the hash value H'c is consistent with H's. If H'c is consistent with H's, the quantum secure encryption channel is kept open; if not, another verification is attempted; if the second verification is still inconsistent, the quantum secure encryption channel is closed and the quantum secure encryption communication service is stopped.

[0080] The above method can effectively prevent man-in-the-middle attacks by introducing random numbers s′ and irreducible polynomials P′, because each verification is independent and unpredictable. Using hash values ​​for identity authentication provides an efficient and secure method to ensure that both parties confirm their identities and avoid forgery and fraud. Periodic identity authentication enables the system to adapt to changes, regularly check the validity of the client, and ensure the security of long-term communications. The mechanism of closing the channel effectively prevents unauthorized access when anomalies are found, reducing the risk of information leakage. The solution can easily adapt to different application scenarios, meet various security requirements, and has good scalability and flexibility.

[0081] In summary, this periodic identity authentication scheme effectively improves the communication security between the quantum secure encryption machine and the client by introducing randomness and mathematical tools (such as Toeplitz matrix and hash function), ensuring the authenticity of the identity and the confidentiality of the communication. This mechanism not only improves the system's anti-attack capability, but also ensures the security and privacy of user data.

[0082] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for real-name authentication of a global quantum security encryption machine, characterized in that: The following steps are involved: The quantum security encryption machine registers the quantum CA certificate with the quantum CA authorization center according to the user's real identity information and user private key PVK sent by the client, and downloads and stores the issued quantum CA certificate through the user's private key PVK. The quantum CA certificate includes the user's public certificate PCE and the user's quantum CA privacy identity OID, thereby completing the binding of the quantum security encryption machine with the user's real-name system; The quantum security encryption machine receives the access request from the client, generates the public certificate framework information according to the user private key PVK in the access request, and returns it to the client with the generated random number S and irreducible polynomial P; The client calculates the hash H of the user's private key PVK according to the hash algorithm specified in the public certificate framework information. k ; According to the format requirements of the public certificate framework information, the obtained hash H k and the user's real identity information to construct a user public certificate PCE'; then construct a ToePlitz matrix according to the random number S and the irreducible polynomial P to calculate the hash Hc of the user public certificate PCE'; and send an access confirmation message to the quantum security encryption machine carrying the calculated hash Hc; The quantum secure encryption machine calculates the hash Hs corresponding to the user's public certificate PCE stored locally based on the generated random number S and the irreducible polynomial P, verifies whether the hash Hs is consistent with the received hash Hc, and confirms that the authentication is successful when the verification is consistent. For this purpose, the client and the user open the quantum secure encryption channel, otherwise it remains closed.

2. The method according to claim 1, characterized in that The configuration method of the quantum secure encryption machine includes: On the client side, configure the access base station information and quantum CA authorization center information for the quantum security encryption machine through the configuration port; The quantum security encryption machine initiates an access authentication request to the configured access base station to verify the legitimacy of the quantum security encryption machine.

3. The method according to claim 1, characterized in that The quantum security encryption machine further registers the quantum CA certificate with the quantum CA authorization center based on the client device information, the user's real identity information and the user's private key PVK, thereby completing the binding of the user, the client device and the quantum security encryption machine.

4. The method according to claim 1, characterized in that: The quantum secure encryption machine performs periodic identity authentication with the client to verify the bound client.

5. The method according to claim 1, characterized in that: The periodic identity verification method includes: The quantum security encryption machine periodically sends a real-name access verification message to the client, which carries a random number s' and an irreducible polynomial P', and s' and P' are different each time they are sent; The client receives the verification message, constructs a ToePlitz matrix according to the random number s' and the irreducible polynomial P', performs hash calculation on the user's public certificate, and generates a hash value H'c; The client sends a real-name access confirmation message to the quantum security encryption machine, wherein the confirmation message carries a hash value H'c; The quantum secure encryption machine receives the real-name access confirmation message, extracts the hash value H'c, and then calculates the hash value H's based on the locally stored user public certificate and the random number s' and the irreducible polynomial P'; verifies whether the hash value H'c is consistent with H's. If H'c is consistent with H's, the quantum secure encryption channel is kept open; if not, another verification is attempted; if the second verification is still inconsistent, the quantum secure encryption channel is closed and the quantum secure encryption communication service is stopped.

Images