Anti-quantum negotiation key synchronization method and device in cluster deployment mode

Abstract

The invention provides an anti-quantum negotiation key synchronization method and device in a cluster deployment mode, electronic equipment and a computer readable storage medium, and the method comprises the steps that a data cache server receives identity authentication data and a session key which are sent by first node equipment and obtained after identity authentication and key negotiation with second node equipment, encrypting the session key through a protection key in a preset encryption algorithm to obtain a ciphertext key and a protection key index, and sending the protection key index, the ciphertext key and the identity authentication data to a third node device; and the third node device obtains the protection key through the protection key index, decrypts the ciphertext key by using the protection key to obtain the session key, and performs data transmission by using the session key. According to the invention, the negotiation result data is received and the update data is sent to other node equipment, so that the problem of single-point failure easily caused by directly sending the secret key to other node equipment through one central node is avoided, and the data transmission efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of quantum-resistant communication technology, and in particular to a quantum-resistant negotiation key synchronization method, device, electronic device and computer-readable storage medium in a cluster deployment mode. Background Art

[0002] When the access service load and pressure increase, the demand can be met by deploying servers in a cluster without reducing the service quality.

[0003] In cluster deployment mode, when encrypting and protecting communication data, multiple node devices need to establish connections between systems, negotiate keys and manage keys. In order to synchronize keys and improve communication efficiency, existing key synchronization schemes mainly distribute keys to other node devices through a central node or obtain keys based on traditional cryptographic exchange protocols when node devices communicate.

[0004] Relying on a central node to distribute keys often leads to single point failure problems. At the same time, in a cluster environment, the steps for node devices to obtain keys through traditional cryptographic exchange protocols are cumbersome, and it is inefficient to ensure that each node device obtains the key. Summary of the invention

[0005] The embodiments of the present invention provide a quantum-resistant negotiation key synchronization method, device, electronic device and computer-readable storage medium in a cluster deployment mode to solve the problems of single point failure prone to key synchronization in the prior art and low efficiency in obtaining keys through traditional cryptographic exchange protocols.

[0006] In a first aspect, an embodiment of the present invention provides a quantum-resistant negotiation key synchronization method in a cluster deployment mode, which is applied to a data cache server in a service cluster. The method includes:

[0007] receiving identity authentication data and a ciphertext key sent by a first node device, wherein the identity authentication data is obtained after the first node device performs identity authentication with the second node device according to a preset quantum-resistant identity authentication algorithm, and the ciphertext key is obtained by encrypting a session key obtained by the first node device after performing key negotiation with the second node device according to the preset quantum-resistant key negotiation algorithm, using a protection key to encrypt the session key;

[0008] The session key of the cluster is encrypted by using the protection key in the preset encryption algorithm to obtain the ciphertext key and the protection key index; the protection key index is used to indicate the protection key;

[0009] The protection key index, the ciphertext key and the identity authentication data are sent to a third node device in the service cluster except the first node device and the second node device. The third node device obtains the protection key through the protection key index, uses the protection key to decrypt the ciphertext key to obtain the session key, and uses the session key to perform the key negotiation.

[0010] In a second aspect, an embodiment of the present invention provides a quantum-resistant negotiation key synchronization method in a cluster deployment mode, which is applied to a first node device in a service cluster, where the first node device is any node device in the service cluster, and the method includes:

[0011] According to a preset quantum-resistant authentication algorithm, identity authentication is performed with the second node device, and identity authentication data is obtained and sent to the data cache server for storage; the identity authentication data is used to be transmitted by the data cache server to a third node device in the service cluster other than the first node device and the second node device, and is used by the third node device for identity authentication; the second node device is a node device that has established a communication connection with the first node device;

[0012] According to a preset quantum-resistant key negotiation algorithm, key negotiation is performed with the second node device to obtain a private key and a session key, the session key is encrypted to form a ciphertext key and sent to the data cache server for storage; the session key is encrypted by the data cache server using a protection key in a preset encryption algorithm to obtain a ciphertext key and a protection key index; the protection key index is used to indicate the protection key; the data cache server is further used to send the protection key index and the ciphertext key to the third node device, so that the third node device can obtain the protection key through the protection key index after passing the identity authentication according to the identity authentication data, and use the protection key to decrypt the ciphertext key to obtain the session key, and use the session key to transmit data.

[0013] In a third aspect, an embodiment of the present invention further provides a quantum-resistant negotiation key synchronization method in a cluster deployment mode, which is applied to any third node device in a service cluster, where the any third node device is one of the node devices in the service cluster except the first node device and the second node device, and the method includes:

[0014] Receive the protection key index, ciphertext key and identity authentication data sent by the data cache server in the service cluster, where the protection key index and the ciphertext key are obtained by sending the identity authentication data and the session key to the data cache server in the service cluster by the first node device, and encrypting the session key by the protection key in the preset encryption algorithm; the identity authentication data is obtained by the first node device and the second node device performing identity authentication according to a preset quantum-resistant identity authentication algorithm, and the identity authentication data is sent to the data cache server for storage;

[0015] The protection key is obtained through the protection key index, and the ciphertext key is decrypted through the protection key to obtain the session key.

[0016] In a fourth aspect, an embodiment of the present invention further provides a quantum-resistant negotiation key synchronization device in a cluster deployment mode, which is applied to a data cache server in a service cluster, and the device includes:

[0017] A first receiving module is configured to receive identity authentication data and a ciphertext key sent by a first node device, wherein the identity authentication data is obtained after the first node device performs identity authentication with the second node device according to a preset quantum-resistant identity authentication algorithm, and the ciphertext key is obtained by encrypting a session key using a protection key after the first node device performs key negotiation with the second node device according to the preset quantum-resistant key negotiation algorithm;

[0018] A first encryption module, used to encrypt the session key of the cluster by using a protection key in a preset encryption algorithm to obtain a ciphertext key and a protection key index; the protection key index is used to indicate the protection key;

[0019] The first sending module is used to send the protection key index, the ciphertext key and the identity authentication data to a third node device in the service cluster except the first node device and the second node device, the third node device obtains the protection key through the protection key index, uses the protection key to decrypt the ciphertext key to obtain the session key, and uses the session key to perform the key negotiation.

[0020] In a fifth aspect, an embodiment of the present invention further provides a quantum-resistant negotiation key synchronization device in a cluster deployment mode, which is applied to a first node device in a service cluster, where the first node device is any node device in the service cluster, and the device includes:

[0021] An identity authentication module, used to perform identity authentication with a second node device according to a preset quantum-resistant identity authentication algorithm, obtain identity authentication data and send it to a data cache server for storage; the identity authentication data is used to be transmitted by the data cache server to a third node device in the service cluster other than the first node device and the second node device, and is used by the third node device for identity authentication; the second node device is a node device that has established a communication connection with the first node device;

[0022] A key negotiation module is used to perform key negotiation with the second node device according to a preset quantum-resistant key negotiation algorithm, obtain a private key and a session key, encrypt the session key to form a ciphertext key and send it to the data cache server for storage; the session key is encrypted by the data cache server using a protection key in a preset encryption algorithm to obtain a ciphertext key and a protection key index; the protection key index is used to indicate the protection key; the data cache server is also used to send the protection key index and the ciphertext key to the third node device, so that the third node device can obtain the protection key through the protection key index after passing the identity authentication according to the identity authentication data, and use the protection key to decrypt the ciphertext key to obtain the session key, and use the session key to transmit data.

[0023] In a sixth aspect, an embodiment of the present invention further provides a quantum-resistant negotiation key synchronization device in a cluster deployment mode, which is applied to any third node device in a service cluster, where the any third node device is one of the node devices in the service cluster except the first node device and the second node device, and the device includes:

[0024] A second receiving module is used to receive the protection key index, ciphertext key and identity authentication data sent by the data cache server in the service cluster, wherein the protection key index and the ciphertext key are the identity authentication data and the session key sent by the first node device to the data cache server in the service cluster, and the session key is encrypted by the protection key in the preset encryption algorithm; the identity authentication data is obtained by the first node device and the second node device performing identity authentication according to the preset quantum-resistant identity authentication algorithm, and the identity authentication data is sent to the data cache server for storage;

[0025] The decryption module is used to obtain the protection key through the protection key index, and decrypt the ciphertext key through the protection key to obtain the session key.

[0026] In a seventh aspect, an embodiment of the present invention further provides an electronic device, including: a processor;

[0027] a memory for storing instructions executable by the processor;

[0028] The processor is configured to execute the instructions to implement the above method.

[0029] In an eighth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to perform the above method.

[0030] In an example of the present invention, the negotiation result data is stored in a data cache server through a node device in a server cluster, wherein the negotiation result data includes a protection key index and a key ciphertext. The data cache server sends updated authentication data and key ciphertext data to other node devices in the service cluster. Other node devices decrypt the key ciphertext through the protection key index and the server cipher machine to obtain a session key. The present invention receives new identity authentication data and key ciphertext data through a data cache server and sends update data to other node devices, thereby avoiding the problem of single point failure when a central node fails while directly sending keys to other node devices through a central node device. Instead, the node device sends data to the data cache server and stores it, and then the data cache server sends it to other node devices. There is no need to directly transmit data through the central node and other node devices, thereby avoiding the problem of single point failure. At the same time, the data cache server sends update data to other node devices, and the data cache server always stores the latest data. The data cache server sends session keys to the node devices, and the node devices do not need to negotiate keys with many node devices through traditional cryptographic exchange protocols and send session keys multiple times. There is no need to send repeated session keys multiple times in a cluster environment, which reduces the steps for node devices to synchronously obtain keys and improves data transmission efficiency.

[0031] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a flowchart of the steps of a quantum-resistant negotiation key synchronization method in a cluster deployment mode provided by an embodiment of the present application;

[0033] Figure 2 This is another step flow chart of a method for quantum-resistant negotiation key synchronization in a cluster deployment mode provided by an embodiment of the present application;

[0034] Figure 3 This is another step flow chart of a method for quantum-resistant negotiation key synchronization in a cluster deployment mode provided by an embodiment of the present application;

[0035] Figure 4 It is a flowchart of the interactive steps of a quantum-resistant negotiation key synchronization method in a cluster deployment mode provided by an embodiment of the present application;

[0036] Figure 5 This is a functional structure diagram of a server cryptographic machine provided in an embodiment of the present application;

[0037] Figure 6 It is a system block diagram of a quantum-resistant negotiation key synchronization method under different service cluster deployment modes provided in an embodiment of the present application;

[0038] Figure 7 This is a flow chart of the initiator session key synchronization provided by an embodiment of the present application;

[0039] Figure 8 It is a receiving end session key synchronization flow chart provided by an embodiment of the present application;

[0040] Fig. 9 It is a block diagram of a device for quantum-resistant negotiation key synchronization in a cluster deployment mode provided by an embodiment of the present application;

[0041] Fig.10 It is a block diagram of another device for synchronizing quantum-resistant negotiation keys in a cluster deployment mode provided by an embodiment of the present application;

[0042] Fig.11 It is a block diagram of another device for synchronizing quantum-resistant negotiation keys in a cluster deployment mode provided by an embodiment of the present application;

[0043] Fig.12 is a block diagram of an apparatus of the present application;

[0044] Fig.13 It is a schematic diagram of the structure of the server in some embodiments of the present application. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] The terms "first", "second", etc. in the specification and claims of the present invention are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable when appropriate, so that the embodiments of the present invention can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, the term "and / or" in the specification and claims is used to describe the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. In the embodiments of the present invention, the term "multiple" refers to two or more, and other quantifiers are similar.

[0047] Traditional computers may be good at difficult tasks, such as sorting through huge databases of molecules. But they often don't work well when it comes to solving more complex problems. Complex problems are those where a large number of variables interact in complex ways. Simulating the behavior of individual atoms in a molecule is a complex problem because all the different electrons affect each other. Quantum algorithms take a new approach to solving these kinds of complex problems: creating a multidimensional computational space. This approach has proven to be much more efficient when solving complex problems such as chemical simulations.

[0048] The Shure quantum algorithm is the first quantum algorithm with a clear purpose and outstanding application value. It poses a threat to one of the best public key schemes today. The rapid development of quantum computing technology poses a serious threat to existing public key cryptographic systems. Traditional key negotiation and synchronization methods are no longer safe under quantum computing attacks. Therefore, studying quantum-resistant key negotiation methods and applying them to distributed cluster systems has become a technical problem that needs to be solved urgently.

[0049] When the business volume of the server increases, the same business can be deployed on multiple servers through cluster deployment. If one node device fails, other node devices can work normally without affecting the operation of the entire business. Each node device is not indispensable. Multiple node devices can alleviate concurrency pressure, and the system is easy to expand and deploy. You only need to deploy the same application on a new server and distribute user requests to multiple servers with the same functions and configure load balancing, which can effectively reduce the system pressure brought about by the increase in business.

[0050] Connect multiple node devices together and deploy the same service to form a service cluster. When the service cluster receives a communication service, it assigns a specific task to a node device. The node devices establish a connection and negotiate keys. The data to be transmitted is encrypted and transmitted using the session key to ensure the security of data communication. After the node devices are connected and the keys are negotiated, when the service cluster performs communication services again, the node device that performs communication services again is not the node device that established the connection for the first time. Therefore, it is necessary to establish a connection again to negotiate keys and use the session key to symmetrically encrypt the data transmission to complete the communication service. For the same service cluster, different node devices can share a set of session key information. The repeated establishment of connections and key negotiations for different nodes undoubtedly adds many unnecessary steps and reduces the efficiency of data communication. When other node devices need to use the session key, the session key can also be sent to the central node through the node device, and then sent to different node devices that need the session key by the central node. However, the central node may fail when processing data requests and transmissions. Once the central node fails, it will cause the interruption of the session key synchronization process of the remaining node devices, affecting the synchronization effect of the node device session key. This single point failure problem has a great impact on the service cluster, so the impact of single point failures on the functions of the service cluster should be avoided as much as possible.

[0051] Figure 1 , is a flowchart of the steps of a quantum-resistant negotiation key synchronization method in a cluster deployment mode provided by an embodiment of the present invention, which is applied to a data cache server in a service cluster, such as Figure 1 As shown, the method may include:

[0052] Step 101: Receive identity authentication data and a ciphertext key sent by a first node device.

[0053] In the embodiment of the present application, the service cluster is a collection of multiple node devices that have deployed the same service. By processing communication services through the service cluster, tasks can be assigned to multiple node devices, alleviating high concurrency pressure. Adjusting the task volume of multiple node devices to achieve load balancing can better improve the utilization of hardware resources and improve the completion effect of communication services.

[0054] For example, if a service cluster has two node devices, when processing access services, it can divide the business volume equally among each node, allowing each node device to process half of the business volume. If the service cluster adds one more node device at this time, the three node devices will divide the business volume equally, and each node device will process one-third of the business volume. For the service cluster, the working time can be reduced by one-sixth when processing the access services.

[0055] In addition, in the embodiment of the present application, a data cache server is also set up in the service cluster. The data cache server is a server that performs a cache service function and is used to store the authentication data and ciphertext keys sent by the node devices. When the remaining node devices send a request for the session key to the data cache server, the authentication data, ciphertext key and protection key index are sent to the node device that initiated the request. When other node devices need session keys to process communication services, they can initiate a request to the data cache server without having to establish a connection with the receiving node device on a cluster scale and repeatedly negotiate keys, thereby improving the efficiency of the node device in processing communication services. Moreover, as a server, the data cache server is essentially better at storing data and responding based on the requests of the node devices, so that the session key synchronization work within the service cluster can be carried out stably.

[0056] Among them, the authentication data is a data packet including an authentication certificate and a signature. The node device verifies whether the device being connected is a node device of the target service cluster by signing and verifying the signature. It can also determine whether the transmitted data has been tampered with or whether there is packet loss, thereby ensuring data transmission security. At the same time, the authentication data can be used to distinguish the service cluster to which the receiving end of the data transmission belongs, so as to store and distinguish all personalized information of the receiving end including session key data. After identity authentication, key negotiation is performed to obtain the session key. The session key is an encryption algorithm. When data is transmitted between node devices, in order to avoid malicious operations such as leakage or tampering of the transmitted data, the transmitted data needs to be encrypted. The encryption algorithm used to encrypt the transmitted data is the session key. After the node device encrypts the transmitted data with the session key, it is difficult to crack the encrypted transmitted data even if it is intercepted during the transmission process, reducing the possibility of data leakage or tampering.

[0057] In the embodiment of the present application, after the first node device obtains the session key and identity authentication data for data transmission, the ciphertext key, protection key index and identity authentication data are sent to the data cache server, wherein the first node device is the initiator node device that first connects to the receiving node device when the initiator service cluster does not have the identity authentication data, encryption key and protection key index of the receiving service cluster. The second node device is the node device that establishes a connection between the receiving service cluster and the first node device. The identity authentication data is obtained by the first node device after identity authentication with the second node device through a preset quantum-resistant identity authentication algorithm, and the session key is obtained by the first node device after key negotiation with the second node device according to the preset quantum-resistant key negotiation algorithm.

[0058] Step 102: Encrypt the session key of the cluster using the protection key in the preset encryption algorithm to obtain a ciphertext key and a protection key index; the protection key index is used to indicate the protection key.

[0059] Among them, the preset encryption algorithm is specifically implemented by the server cryptographic machine. The server cryptographic machine uses the protection key in the built-in cryptographic set to encrypt the session key and return the protection key index. The protection key index is the index value of the protection key in the cryptographic set, which is used to indicate the specific protection key. The server cryptographic machine sends the above data to the data cache server. After receiving the protection key index sent by the data cache server, the node device determines the protection key according to the built-in cryptographic set, which is used to decrypt the ciphertext key to obtain the session key.

[0060] Specifically, the protection key is an encryption algorithm built into each node device and server cipher machine. The specific protection key can be determined through the protection key index. Since the protection key only exists inside the hardware device and is not transmitted, using the protection key to encrypt the session key can prevent the session key from being tampered with, thereby ensuring the authenticity and stability of the session key.

[0061] For example, when the data cache server sends the authentication data, ciphertext key and protection key index to the first node device, since what is transmitted is the protection key index and not the specific protection key, it cannot be obtained by a third party. Therefore, even if the third party obtains the ciphertext key, it cannot be cracked to obtain the session key, or even tamper with the session key. If the session key is not encrypted with the protection key, the third party tampered with the session key and sent it to the first node device, and then the first node device uses the tampered session key to symmetrically encrypt the transmission data and intercept the data after sending it, and use the third party's own protection key to decrypt the encrypted transmission data, leak the data or tamper with the data before sending it to the second node device.

[0062] The embodiment of the present application uses the encryption algorithm built into the server cryptographic machine, specifically using a protection key to encrypt the session key, the ciphertext key is the session key encrypted by the server cryptographic machine, the protection key index is used to indicate the corresponding protection key, and the protection key is used to decrypt the ciphertext key to obtain the session key.

[0063] Step 103: Send the protection key index, the ciphertext key, and the identity authentication data to a third node device in the service cluster except the first node device and the second node device.

[0064] In the embodiment of the present application, after the third node device receives the protection key index, it can obtain the protection key according to the protection key index, use the protection key to decrypt the ciphertext key to obtain the session key, and use the session key to encrypt the transmission data for data transmission with the third node device at the receiving end.

[0065] The third node devices are all node devices in the initiator service cluster and the receiver service cluster except the first node device and the second node device.

[0066] In addition, based on the request of the third node device, the data cache server sends the identity authentication data, the protection key index and the ciphertext key to the third node device, so that the third node device obtains the above data and thus obtains the identity authentication data and the session key. The third node device directly uses the session key to encrypt the transmission data and sends it to the receiving service cluster. In the case where the two service clusters have established a connection and conducted key negotiation, the third node device avoids repeated key negotiation processes, omits unnecessary steps, and improves data transmission efficiency.

[0067] In the embodiment of the present application, a data cache server is used to store data used for data transmission, which is convenient for centralized management and maintenance. At the same time, as a database, it has strong stability in storing data and transmitting data according to requests. Compared with the related technology that uses a central node to send data used for data transmission to a third node device, the number of requests processed by the central node is limited, and it is easy to fail, resulting in a single point failure problem, causing the paralysis of the key synchronization function within the service cluster. Therefore, the use of a data cache server makes the key synchronization function within the service cluster more secure.

[0068] For example, when the first node device sends the data used for data transmission to the central node, the central node needs to store this data, and the amount of stored data is limited. When it receives the request data sent by the third node device, it must also respond. At the same time, the central node device has its own pending business. Therefore, the concurrency pressure of the central node is relatively high. When the processing speed of the central node is affected, the key synchronization speed within the cluster will be affected. Once the central node fails, it will cut off the connection between the remaining node devices due to its special nature as the central node, paralyzing the key synchronization function within the service cluster.

[0069] In summary, the embodiment of the present invention stores the negotiation result data in the data cache server through a node device in the server cluster, wherein the negotiation result data includes a protection key index and a key ciphertext. The data cache server sends the updated authentication data and key ciphertext data to other node devices in the service cluster. The other node devices decrypt the key ciphertext through the protection key index and the server cipher machine to obtain the session key. The present invention receives new identity authentication data and key ciphertext data through a data cache server and sends update data to other node devices, thereby avoiding the problem of single point failure when a central node fails while directly sending keys to other node devices through a central node. Instead, the node device sends data to the data cache server and stores the data, which is then sent by the data cache server to other node devices. There is no need to directly transmit data through the central node and other node devices, thereby avoiding the problem of single point failure. At the same time, the data cache server sends update data to other node devices, and the data cache server always stores the latest data. The data cache server sends session keys to the node devices, and the node devices do not need to negotiate keys with many node devices through traditional cryptographic exchange protocols and send session keys multiple times. There is no need to send repeated session keys multiple times in a cluster environment, which reduces the steps for node devices to synchronously obtain keys and improves data transmission efficiency.

[0070] Figure 2 , is a flowchart of the steps of a quantum-resistant negotiation key synchronization method in a cluster deployment mode provided by an embodiment of the present invention, which is applied to a first node device in a service cluster, wherein the first node device is any node device in the service cluster, such as Figure 2 As shown, the method may include:

[0071] Step 201: Perform identity authentication with the second node device according to a preset quantum-resistant identity authentication algorithm, obtain identity authentication data and send it to a data cache server for storage.

[0072] Specifically, the first node device obtains a Post-Quantum Cryptography (PQC) certificate, an elliptic curve public key cryptography algorithm (SM2, an elliptic curve asymmetric encryption algorithm) certificate, and data with a signature of the first node device from the server cryptographic machine, packages them to generate a first authentication certificate, and sends it to the second node device; the second node device receives the first authentication certificate sent by the first node device and performs signature verification, and after successful verification, sends the second authentication certificate corresponding to the second node device to the first node device; after the first node device passes the verification, it integrates the first authentication certificate and the second authentication certificate into identity authentication data and sends it to the second node device, and starts the subsequent process.

[0073] Among them, the preset quantum-resistant authentication algorithm adopts the PQC algorithm, which aims to focus on finding one or more difficult mathematical problems that are unsolvable in polynomial time on quantum computers. The PQC algorithm designed based on these difficult problems can resist the attack of quantum computers to a certain extent, protect the communication security under quantum attacks, and encrypt the authentication data by avoiding mathematical problems with quantum characteristics, so that the transmitted authentication data in the authentication process has the characteristics of resisting quantum attacks; PQC: A cryptographic technology designed to resist quantum computer attacks, mainly including encryption algorithms based on lattice theory, multivariate polynomials and codes. Its design purpose is to ensure the security of the encryption system after the maturity of quantum computers.

[0074] Elliptic Curve Cryptography (ECC): An asymmetric encryption algorithm based on elliptic curve mathematics, whose security is based on the discrete logarithm problem on the elliptic curve.

[0075] Elliptic Curve Public Key Cryptography Algorithm SM2: An ECC elliptic curve asymmetric encryption algorithm.

[0076] Step 202: perform key negotiation with the second node device according to a preset quantum-resistant key negotiation algorithm to obtain a private key and a session key, encrypt the session key to form a ciphertext key, and send it to the data cache server for storage.

[0077] Specifically, the first node device uses the PQC encryption algorithm to package the initiator's identity authentication data and the initiator's session key data to generate first key-encrypted data, and sends it to the second node device; after the second node device receives the first key-encrypted data sent by the first node device, it packages the second node device's responder identity authentication data and the responder's session key using the PQC encryption algorithm to generate second key-encrypted data and sends it to the first node device, and the first node device sends a response message integrating the first key-encrypted data and the second key-encrypted data to the second node device. At this time, both the first node device and the second node device obtain the session key.

[0078] In the embodiment of the present application, both the identity authentication and key negotiation processes involve three data transmissions, similar to the three-way handshake of a Transmission Control Protocol (TCP) connection, in order to enable the first node device and the second node device to determine that the other party has received their messages, thereby achieving reliable data transmission.

[0079] For example, the first node device sends a first authentication certificate to the second node device, the second node device generates a second authentication certificate and sends it to the first node device, at which point the first node device can determine that the second node device has received the information it has sent, the first node device integrates the first authentication certificate and the second authentication certificate and sends them to the second node device, at which point the second node device can determine that the first node device has received the data it has transmitted. If the data is only transmitted twice, then only the initiator, that is, the first node device, can determine that the second node device has received the data it has transmitted, and the second node device cannot determine whether the first node device has received the data it has sent.

[0080] In summary, the embodiment of the present invention stores the negotiation result data in the data cache server through a node device in the server cluster, wherein the negotiation result data includes a protection key index and a key ciphertext. The data cache server sends the updated authentication data and key ciphertext data to other node devices in the service cluster. The other node devices decrypt the key ciphertext through the protection key index and the server cipher machine to obtain the session key. The present invention receives new identity authentication data and key ciphertext data through a data cache server and sends update data to other node devices, thereby avoiding the problem of single point failure when a central node fails while directly sending keys to other nodes through a central node. Instead, the node sends data to the data cache server and stores it, and then the data cache server sends it to other node devices. There is no need to directly transmit data through the central node and other node devices, thereby avoiding the problem of single point failure. At the same time, the data cache server sends update data to other node devices, and the data cache server always stores the latest data. The data cache server sends session keys to node devices, and there is no need for node devices to negotiate keys with many node devices through traditional cryptographic exchange protocols and send session keys multiple times. There is no need to send repeated session keys multiple times in a cluster environment, which reduces the steps for node devices to synchronously obtain keys and improves data transmission efficiency.

[0081] Figure 3 , is a flowchart of the steps of a quantum-resistant negotiation key synchronization method in a cluster deployment mode provided by an embodiment of the present invention, which is applied to any third node device in a service cluster, wherein any third node device is one of the node devices in the service cluster except the first node device and the second node device, such as Figure 3 As shown, the method may include.

[0082] Step 301: Receive the protection key index, ciphertext key and identity authentication data sent by a data cache server in a service cluster.

[0083] In an embodiment of the present application, the third node device obtains the protection key index ciphertext key and identity authentication data used for communicating with the third node device at the receiving end through the data cache server in the service cluster. In the related technology, the third node device and the third node device at the receiving end need to perform key negotiation before communicating. For the two service clusters, the data obtained by the third node device and the third node device at the receiving end through identity authentication and key negotiation are consistent with the data when the first node device and the second node device perform identity authentication and key negotiation. Repeated identity authentication and key negotiation will increase the data transmission steps and reduce the efficiency. Therefore, the third node device obtains the protection key index ciphertext key and identity authentication data through the data cache server, which improves the reusability of these data, reduces the steps of data transmission required by the two service clusters again, and improves the transmission efficiency.

[0084] Step 302: Obtain the protection key through the protection key index, and decrypt the ciphertext key through the protection key to obtain the session key.

[0085] In an embodiment of the present application, a protection key is obtained by indicating a password set through a protection key index, thereby avoiding the transmission of the protection key. The password set is built into each node device and cannot be accessed by outsiders. Even if the outside world obtains the protection key index, it cannot obtain the password set and thus the protection key, thereby ensuring the security of the protection key.

[0086] For example, after the third-node device receives the authentication data, protection key index and ciphertext key sent by the data cache server, it finds the protection key used to decrypt the ciphertext key in its own built-in password set through the protection key index. Since the password set is built into the third-node device, the first node device and the server cipher machine, it cannot be obtained by access from the outside. Even if the protection key index is obtained, there is no way to crack the ciphertext key to obtain the session key. Therefore, the security of the protection key is guaranteed while also ensuring the security of the session key.

[0087] In summary, the embodiment of the present invention stores the negotiation result data in the data cache server through a node device in the server cluster, wherein the negotiation result data includes a protection key index and a key ciphertext. The data cache server sends the updated authentication data and key ciphertext data to other node devices in the service cluster. The other node devices decrypt the key ciphertext through the protection key index and the server cipher machine to obtain the session key. The present invention receives new identity authentication data and key ciphertext data through a data cache server and sends update data to other node devices, thereby avoiding the problem of single point failure when a central node fails while directly sending keys to other node devices through a central node. Instead, the node device sends data to the data cache server and stores the data, which is then sent by the data cache server to other node devices. There is no need to directly transmit data through the central node and other node devices, thereby avoiding the problem of single point failure. At the same time, the data cache server sends update data to other node devices, and the data cache server always stores the latest data. The data cache server sends session keys to the node devices, and the node devices do not need to negotiate keys with many node devices through traditional cryptographic exchange protocols and send session keys multiple times. There is no need to send repeated session keys multiple times in a cluster environment, which reduces the steps for node devices to synchronously obtain keys and improves data transmission efficiency.

[0088] Figure 4 , is a flowchart of the steps of a quantum-resistant negotiation key synchronization method in a cluster deployment mode provided by an embodiment of the present invention, such as Figure 4 As shown, the method may include:

[0089] Step 401: The first node device performs identity authentication with the second node device according to a preset quantum-resistant identity authentication algorithm, obtains identity authentication data, and sends it to a data cache server for storage.

[0090] This step may specifically refer to the above step 201, which will not be described in detail here.

[0091] Optionally, step 401 may specifically include:

[0092] Sub-step 4011: The first node device generates a first authentication certificate through the preset quantum-resistant algorithm, and sends the first authentication certificate to the second node device in the service cluster.

[0093] Specifically, the first authentication certificate includes the PQC certificate, the SM2 certificate and the signature data of the first node device. By sending the first authentication certificate to the second node device, the second node device clarifies the quantum-resistant encryption algorithm used by the first node device from the first authentication certificate sent by the first node device, and verifies the signature of the first node device to ensure the authenticity of the identity of the first node device.

[0094] Sub-step 4012: the first node device receives the second authentication certificate returned by the second node device after verifying the first authentication certificate, generates the identity authentication data according to the first authentication certificate and the second authentication certificate, and sends it to the data cache server for storage.

[0095] In an embodiment of the present invention, the second authentication certificate includes a PQC certificate, an SM2 certificate, and data of a signature of a second node device. By sending the second authentication certificate to the first node device, the second authentication certificate sent by the first node device from the second node device clarifies the quantum-resistant encryption algorithm used by the second node device, and at the same time verifies the signature of the second node device to ensure the authenticity of the identity of the second node device.

[0096] Step 402: The first node device performs key negotiation with the second node device according to a preset quantum-resistant key negotiation algorithm to obtain a private key and a session key, encrypts the session key to form a ciphertext key, and sends the ciphertext key to the data cache server for storage.

[0097] This step may be specifically referred to as the above step 202, which will not be described in detail here.

[0098] Optionally, step 402 may specifically include:

[0099] Sub-step 4021: The first node device generates first key encrypted data through the preset quantum-resistant algorithm, and sends the first key encrypted data to the second node device in the service cluster.

[0100] In an embodiment of the present invention, the first key encrypted data includes the initiator identity authentication data and the initiator session key data encrypted by the PQC algorithm. By sending the first key encrypted data to the second node device, the second node device obtains the session key of the first node device from the first key encrypted data sent by the first node device.

[0101] Sub-step 4022: the first node device receives the second key encrypted data returned by the second node device after verifying the first key encrypted data, generates the session key data according to the first key encrypted data and the second key encrypted data, encrypts the session key to form a ciphertext key and sends it to the data cache server for storage.

[0102] Specifically, the second key encrypted data includes the responder identity authentication data and the responder session key encrypted by the PQC algorithm. By sending the second key encrypted data to the first node device, the first node device obtains the session key of the second node device from the second key encrypted data sent by the second node device.

[0103] Step 403: The data cache server receives the identity authentication data and the ciphertext key sent by the first node device.

[0104] This step may specifically refer to the above step 101, which will not be described in detail here.

[0105] Step 404: The data cache server encrypts the session key of the cluster using the protection key in the preset encryption algorithm to obtain the ciphertext key and the protection key index.

[0106] This step may specifically refer to the above step 102, which will not be described in detail here.

[0107] Optionally, step 404 may specifically include:

[0108] Sub-step 4041, the data cache server detects the connection status of the server cryptographic machine, the working status of the server cryptographic machine and the correctness of the cryptographic algorithm of the server cryptographic machine by calling the self-test interface to obtain the test result.

[0109] In an embodiment of the present application, the data cache server calls the initialization self-test interface provided by the server cryptographic machine to detect the connection status of the server cryptographic machine, the working status and the correctness of the cryptographic algorithm, and whether the server cryptographic machine functions normally. When an abnormality occurs in the server cryptographic machine, timely feedback is provided and the specific fault point is identified to ensure the normal operation of the service cluster.

[0110] like Figure 5 The functional structure of the server cipher machine is shown below:

[0111] In the embodiment of the present application, the initiator service application calls the initiator server cryptographic machine interface, and the receiving end service application calls the receiving end server cryptographic machine interface to implement the quantum-resistant key negotiation function. The server cryptographic machine provides self-checking, key destruction, identity authentication, key negotiation, symmetric encryption and symmetric decryption functions. The self-checking function is used to detect the connection status of the server cryptographic machine, the working status of the server cryptographic machine and the correctness of the cryptographic algorithm of the server cryptographic machine; the key destruction function is used to destroy unused session keys in a timely manner; the identity authentication function is used for identity authentication between node devices; the key negotiation function is used for session key negotiation between two node devices; symmetric encryption is used to encrypt the transmission data to generate encrypted ciphertext; symmetric decryption is used to decrypt the encrypted ciphertext after receiving the encrypted ciphertext to generate plaintext data.

[0112] The server cryptographic machine is used to operate the data that needs to be encrypted in the service cluster, and the relevant functions are integrated into the server cryptographic machine, which reduces the functional pressure of the node equipment and data cache server, and integrates the data encryption related functions into the server cryptographic machine to facilitate subsequent maintenance and development.

[0113] Among them, the initiator business application includes the initiator data cache server and all the initiator node devices, such as: the first node device and the initiator third node device; the receiving end business application includes the receiving end data cache server and the receiving end node devices, such as: the second node device and the receiving end third node device.

[0114] Sub-step 4042: When the detection result indicates that the connection status and the working status are enabled and the cryptographic algorithm is correct, the data cache server obtains the ciphertext key and the protection key index obtained by the server cryptographic machine after encrypting the session key with the protection key.

[0115] In this embodiment, by detecting the connection status, working status and correctness of the cryptographic algorithm between the data cache server and the server cryptographic machine, it is determined whether the server cryptographic machine is operating normally. Once an abnormality occurs in the server cryptographic machine, timely feedback can be provided to reduce the situation where the protection of the session key is weakened due to the failure of the server cryptographic machine.

[0116] Step 405: The data cache server sends the protection key index, the ciphertext key, and the identity authentication data to a third node device in the service cluster except the first node device and the second node device.

[0117] This step may be specifically referred to as the above step 103, which will not be described in detail here.

[0118] Optionally, step 405 may specifically include:

[0119] Sub-step 4051: The data cache server sends the protection key index, the ciphertext key and the identity authentication data to the third node device in response to the acquisition request of the third node device.

[0120] Among them, the third node device initiates a request to the data cache server, and the data cache server sends the corresponding authentication data, key index and ciphertext key information required by the third node device. When the third node device initiates a response, the data cache server sends the above request data. The above request data can be sent on demand to different node devices, and the management of identity authentication data, key index and ciphertext key is integrated in the data cache server, which facilitates data management and saves storage space of other node devices.

[0121] Step 406: The third node device receives the protection key index, the ciphertext key, and the identity authentication data sent by the data cache server in the service cluster.

[0122] This step may be specifically referred to as the above step 301, which will not be described in detail here.

[0123] Step 407: The third node device obtains the protection key through the protection key index, and decrypts the ciphertext key through the protection key to obtain the session key.

[0124] This step may be specifically referred to as the above step 302, which will not be described in detail here.

[0125] Optionally, the method further includes:

[0126] Step 408: When the data cache server detects that the life cycle of the session key has expired, it calls a key destruction interface to destroy the session key.

[0127] The life cycle is the validity period of a session key. The life cycle can be uniformly set at a fixed time, and the session key can be destroyed when the life cycle expires. The frequency of use of the session key can also be detected. The life cycle is the interval between the use of the session key. When the session key has not been used for a period of time, it is considered that the life cycle has expired and the session key destruction interface is called. This application does not limit the method used to define the life cycle.

[0128] In an embodiment of the present application, when the life cycle of a session key expires, the key destruction interface is called to destroy the session key. Unused session keys are destroyed in a timely manner, saving storage space on the data cache server. At the same time, the session key is given a valid time so that the quantum computer does not have enough time to crack the session key, thereby ensuring the security of the session key and improving the security of data transmission.

[0129] Optionally, the method further includes:

[0130] Step 409: The first node device, in response to the communication request with the second node device, encrypts the transmission data using the session key obtained through the key negotiation to obtain encrypted transmission data.

[0131] Step 410: The first node device transmits the encrypted transmission data to the second node device, so that the second node device uses the private key to decrypt the encrypted transmission data to obtain the transmission data.

[0132] For steps 409-410, the first node uses the session key to symmetrically encrypt the transmission data. Since the protection key is in the second node device and there is no possibility of leakage in the service cluster of the second node device, the session key of the first node device cluster has not been tampered with, and there is no situation where a third party maliciously intercepts and tampers with the information to be transmitted and then forwarded to the second node device, it is guaranteed that the transmission data can only be decrypted and obtained through the second node device.

[0133] In an embodiment of the present application, after the first node device performs identity authentication and key negotiation with the second node device, it responds to the communication request of the second node device, directly uses the session key after the key negotiation to symmetric encrypt the transmitted data, obtains the identity authentication data and the session key, and sends them to the data cache server, thereby eliminating the process of sending a request to the data cache server to obtain the identity authentication data, the protection key index and the ciphertext key, saving the data encryption step and improving the data transmission efficiency.

[0134] Specifically, the symmetric encryption algorithm is a symmetric key encryption interface based on the SM4 algorithm (a block cipher algorithm). SM4 is a block cipher algorithm suitable for scenarios where key exchange is not required. It can prevent plaintext data from being stolen. At the same time, it has fast encryption and decryption speeds and is suitable for encryption scenarios with relatively large data content.

[0135] In addition, the server cryptographic machine can also provide a symmetric key decryption interface based on the SM4 algorithm. The symmetric decryption interface based on the SM4 algorithm can be used to decrypt the ciphertext data using the session key to obtain the plaintext data.

[0136] Optionally, the method further includes:

[0137] Step 411, the first node device responds to the communication request with the second node device, sends a request to the data cache server according to the identity authentication data, obtains the ciphertext key and the protection key index corresponding to the identity authentication data returned by the data cache server, and uses the protection key index to decrypt the ciphertext key to obtain the session key.

[0138] Step 412: The first node device encrypts the transmission data using the session key to obtain encrypted transmission data.

[0139] Step 413: The first node device transmits the encrypted transmission data to the second node device, so that the second node device uses the private key to decrypt the encrypted transmission data to obtain the transmission data.

[0140] For steps 411-413, after the first node device responds to the communication request of the second node device, it does not retain the authentication data and session key, and does not specifically distinguish whether the current node device belongs to the first node device or the third node device, so that all node devices have the same functions and uniformly send requests to the data cache server to obtain the authentication data, protection key index and ciphertext key, which reduces the logical judgment function, reduces the possibility of vulnerabilities, and reduces development costs.

[0141] Optionally, the method further includes:

[0142] Step 414: The third node device establishes a connection with the third node device at the receiving end, and obtains communication information of the third node device at the receiving end.

[0143] Specifically, the third node device establishes a TCP connection with the third node device at the receiving end, and determines the service cluster of the third node device at the receiving end through an Internet Protocol (IP) address.

[0144] Among them, the TCP transmission protocol is a reliable transmission protocol working at the transport layer. It is based on the transmission confirmation mechanism of byte streams to achieve reliability assurance. The concept of window length is introduced to control the adaptive transmission bandwidth through the sending window to prevent continuous link congestion. Its original design was to solve the problem of reliable data transmission in long-distance complex networks. It is universal, but has significant disadvantages: large retransmission delay (hundreds of milliseconds), complex and inefficient protocols, and cannot meet the transmission requirements of devices that pursue the physical limits of processors, such as base stations and other telecommunications equipment.

[0145] Step 415: The third node device sends a request to the data cache server to determine the identity authentication data matching the communication information, and obtains the session key corresponding to the identity authentication data matching the communication information from the data cache server.

[0146] In addition, when any node device performs identity authentication and key negotiation between service clusters, it cannot be determined whether the node device is the first node device or the third node device. It first defaults to the third node device and initiates a request to the data cache server. If identity authentication data matching the communication information can be found, the node is the third node device, otherwise it is the first node device.

[0147] For example, if the third node device sends a request to the cache server and cannot find the authentication data that matches the communication information, it means that identity authentication and key negotiation have not been performed between the service clusters or the session key obtained by the key negotiation has been destroyed due to expiration of its life cycle. At this time, the third node device is actually the first node device, and the third node device at the receiving end is actually the second node device, and the steps described in step 401 are executed.

[0148] Step 416: The third node device uses the session key to encrypt the transmission data, and sends the encrypted transmission data.

[0149] In this embodiment, the third-node device uses the session key to symmetrically encrypt the transmission data. Since the protection key is in the third-node device at the receiving end and there is no possibility of leakage in the service cluster of the third-node device at the receiving end, the session key of the third-node device cluster has not been tampered with, and there is no situation where a third party maliciously intercepts and tampers with the information to be transmitted and then forwards it to the third-node device at the receiving end, it is ensured that the transmission data can only be decrypted and obtained through the third-node device at the receiving end.

[0150] Step 417: When receiving the ciphertext data, the third node device uses the private key to decrypt the ciphertext data to obtain the decrypted ciphertext data.

[0151] In this embodiment, the third node device only needs to initiate a request to the data cache server through communication information to obtain the identity authentication data, ciphertext key and protection key index corresponding to the third node device at the receiving end. There is no need to perform additional identity authentication and key negotiation processes again, making data transmission between third node devices more convenient.

[0152] Figure 6 The data cache server in different service clusters implements the process of sharing authentication results and session key information with node devices:

[0153] For service cluster A, after the first node device A1 and the second node device B1 perform identity authentication and key negotiation, the session key is encrypted by the server cryptographic machine to obtain the ciphertext key and the protection key index, and the identity authentication data, the protection key index and the ciphertext key are sent to the data cache server. The data cache server sends the identity authentication data, the ciphertext key and the protection key index to the third node device A2 to the third node device An in service cluster A. The third node device A2 uses symmetric decryption through the protection key index to obtain the protection key, and decrypts the ciphertext key to obtain the session key, and uses the session key to symmetric encrypt the transmission data to send it to the receiving end third node device B2.

[0154] For service cluster B, the data cache server of service cluster B sends identity authentication data, ciphertext key and protection key index to the third node device B2 to the third node device Bn in service cluster B. The third node device B2 uses symmetric decryption through the protection key index to obtain the protection key, decrypts the ciphertext key to obtain the session key, and uses the session key to symmetric encrypt the transmission data and sends it to the receiving end third node device A2.

[0155] Figure 7 The initiator session key synchronization process includes:

[0156] S1, the first node data A1 synchronizes the identity authentication data and session key to the data cache server;

[0157] S2, the data cache server sends a response message to the first node data A1;

[0158] S3. The data cache server sends updated session key data to the third node device A2;

[0159] S4. The third node device A2 sends a response message to the data cache server and uses the session key to encrypt the transmitted data;

[0160] S5. The data cache server sends updated session key data to the third node device An;

[0161] S6. The third node device An sends a response message to the data cache server and uses the session key to encrypt the transmitted data;

[0162] The encrypted transmission of session keys is not reflected in the process.

[0163] After the session key is negotiated, the first node device A1 sends the identity authentication data and the session key to the data cache server and receives a response from the data cache server. The third node devices A2 to the third node device An send requests to the data cache server. The data cache server sends the latest session key information to the third node devices A2 to the third node devices An respectively. The third node devices A2 to the third node devices An send response information to the data cache server and use the session key to encrypt the transmitted data.

[0164] Figure 8 The session key synchronization process for the receiving end includes:

[0165] M1, the second node data B1 synchronizes the identity authentication data and session key to the data cache server;

[0166] M2, the data cache server sends a response message to the second node data B1;

[0167] M3, the data cache server sends updated session key data to the third node device B2;

[0168] M4. The third node device B2 sends a response message to the data cache server and uses the session key to encrypt the transmitted data;

[0169] M5. The data cache server sends updated session key data to the third node device Bn;

[0170] M6. The third node device Bn sends a response message to the data cache server and uses the session key to encrypt the transmitted data;

[0171] The encrypted transmission of session keys is not reflected in the process.

[0172] After the session key is negotiated, the second node device B1 sends the authentication data and the session key to the data cache server and receives a response from the data cache server. The third node devices B2 to Bn send requests to the data cache server. The data cache server sends the latest session key information to the third node devices B2 to Bn respectively. The third node devices B2 to Bn send response information to the data cache server and use the session key to symmetrically encrypt the transmitted data.

[0173] In summary, in an embodiment of the present invention, a node device in a server cluster uses a preset quantum-resistant authentication algorithm and a preset quantum-resistant key negotiation algorithm to store the authentication data and the negotiation result data in a data cache server, wherein the negotiation result data includes a protection key index and a key ciphertext. The data cache server notifies other node devices in the service cluster to update the negotiation data, and other node devices decrypt the key ciphertext through the protection key index and the server cryptographic machine to obtain a session key. The present invention enables the data transmission between node devices to resist quantum attacks by using a preset quantum-resistant identity authentication algorithm and a preset quantum-resistant key negotiation algorithm in the node devices, reduces the risk of data being tampered with and cracked during data transmission, and improves the security of data transmission; the data cache server receives new identity authentication data and key ciphertext data and sends update data to other node devices, thereby avoiding the problem of directly sending keys to other node devices through a central node, which may cause a single point failure when the central node fails. The node device sends data to the data cache server and stores it, and then the data cache server sends it to other node devices, without directly transmitting data through the central node and other node devices, thereby avoiding the single point failure problem; at the same time, the data cache server sends update data to other node devices, and the data cache server always stores the latest data, and sends the session key to the node device by the data cache server, so that the node device does not need to negotiate keys with many node devices through the traditional cryptographic exchange protocol and send session keys multiple times. In a cluster environment, there is no need to send repeated session keys multiple times, thereby reducing the steps for node devices to synchronously obtain keys and improving data transmission efficiency.

[0174] Fig. 9 , is a quantum-resistant negotiation key synchronization device in a cluster deployment mode provided by an embodiment of the present invention, and the device may include:

[0175] The first receiving module 501 is used to receive identity authentication data and a ciphertext key sent by a first node device.

[0176] The first encryption module 502 is used to encrypt the session key of the cluster by using the protection key in the preset encryption algorithm to obtain the ciphertext key and the protection key index.

[0177] Optionally, the first encryption module 502 may specifically include:

[0178] The self-check submodule is used to detect the connection status of the server cryptographic machine, the working status of the server cryptographic machine and the correctness of the cryptographic algorithm of the server cryptographic machine by calling the self-check interface to obtain the detection result.

[0179] The first sending submodule is used to obtain the ciphertext key and the protection key index obtained by the server cryptographic machine after encrypting the session key with the protection key when the detection result indicates that the connection state and the working state are enabled and the cryptographic algorithm is correct.

[0180] The first sending module 503 is configured to send the protection key index, the ciphertext key, and the identity authentication data to a third node device in the service cluster except the first node device and the second node device.

[0181] Optionally, the first sending module 503 may specifically include:

[0182] The second sending submodule is used to send the protection key index, the ciphertext key and the identity authentication data to the third node device in response to the acquisition request of the third node device.

[0183] Optionally, the device further comprises:

[0184] The destruction module is used to call the key destruction interface to destroy the session key when it is detected that the life cycle of the session key expires.

[0185] In summary, in an embodiment of the present invention, a node device in a server cluster uses a preset quantum-resistant authentication algorithm and a preset quantum-resistant key negotiation algorithm to store the authentication data and the negotiation result data in a data cache server, wherein the negotiation result data includes a protection key index and a key ciphertext. The data cache server notifies other node devices in the service cluster to update the negotiation data, and other node devices decrypt the key ciphertext through the protection key index and the server cryptographic machine to obtain a session key. The present invention enables the data transmission between node devices to resist quantum attacks by using a preset quantum-resistant identity authentication algorithm and a preset quantum-resistant key negotiation algorithm in the node devices, reduces the risk of data being tampered with and cracked during data transmission, and improves the security of data transmission; the data cache server receives new identity authentication data and key ciphertext data and sends update data to other node devices, thereby avoiding the problem of directly sending keys to other node devices through a central node, which may cause a single point failure when the central node fails. The node device sends data to the data cache server and stores it, and then the data cache server sends it to other node devices, without directly transmitting data through the central node and other node devices, thereby avoiding the single point failure problem; at the same time, the data cache server sends update data to other node devices, and the data cache server always stores the latest data, and sends the session key to the node device by the data cache server, so that the node device does not need to negotiate keys with many node devices through the traditional cryptographic exchange protocol and send session keys multiple times. In a cluster environment, there is no need to send repeated session keys multiple times, thereby reducing the steps for node devices to synchronously obtain keys and improving data transmission efficiency.

[0186] Fig.10 , is a quantum-resistant negotiation key synchronization device in a cluster deployment mode provided by an embodiment of the present invention, and the device may include:

[0187] The identity authentication module 601 is used to perform identity authentication with the second node device according to a preset quantum-resistant identity authentication algorithm, obtain identity authentication data and send it to the data cache server for storage.

[0188] Optionally, the identity authentication module 601 may specifically include:

[0189] The second sending submodule is used to generate a first authentication certificate through the preset quantum-resistant algorithm, and send the first authentication certificate to the second node device in the service cluster.

[0190] The receiving submodule receives the second authentication certificate returned by the second node device after verifying the first authentication certificate, generates the identity authentication data according to the first authentication certificate and the second authentication certificate, and sends the identity authentication data to the data cache server for storage.

[0191] The key negotiation module 602 is used to perform key negotiation with the second node device according to a preset quantum-resistant key negotiation algorithm, obtain a private key and a session key, encrypt the session key to form a ciphertext key, and send it to the data cache server for storage.

[0192] Optionally, the key negotiation module 602 may specifically include:

[0193] A negotiation submodule is used to generate first key encrypted data through the preset quantum-resistant algorithm, and send the first key encrypted data to the second node device in the service cluster.

[0194] A response submodule is used to receive the second key encrypted data returned by the second node device after verifying the first key encrypted data, generate the session key data according to the first key encrypted data and the second key encrypted data, and send it to the data cache server for storage.

[0195] Optionally, the device further comprises:

[0196] The second encryption module is used to encrypt the transmission data with the session key obtained through the key negotiation in response to the communication request with the second node device to obtain the encrypted transmission data.

[0197] The second sending module is used to transmit the encrypted transmission data to the second node device, so that the second node device can use the protection key to decrypt the encrypted transmission data to obtain the transmission data.

[0198] Optionally, the device further comprises:

[0199] The first request module is used to respond to the communication request with the second node device, send a request to the data cache server according to the identity authentication data, and obtain the session key corresponding to the identity authentication data returned by the data cache server.

[0200] The third encryption module is used to encrypt the transmission data using the session key to obtain encrypted transmission data.

[0201] The third sending module is used to transmit the encrypted transmission data to the second node device, so that the second node device can use the protection key to decrypt the encrypted transmission data to obtain the transmission data.

[0202] In summary, in an embodiment of the present invention, a node device in a server cluster uses a preset quantum-resistant authentication algorithm and a preset quantum-resistant key negotiation algorithm to store the authentication data and the negotiation result data in a data cache server, wherein the negotiation result data includes a protection key index and a key ciphertext. The data cache server notifies other node devices in the service cluster to update the negotiation data, and other node devices decrypt the key ciphertext through the protection key index and the server cryptographic machine to obtain a session key. The present invention enables the data transmission between node devices to resist quantum attacks by using a preset quantum-resistant identity authentication algorithm and a preset quantum-resistant key negotiation algorithm in the node devices, reduces the risk of data being tampered with and cracked during data transmission, and improves the security of data transmission; the data cache server receives new identity authentication data and key ciphertext data and sends update data to other node devices, thereby avoiding the problem of directly sending keys to other node devices through a central node, which may cause a single point failure when the central node fails. The node device sends data to the data cache server and stores it, and then the data cache server sends it to other node devices, without directly transmitting data through the central node and other node devices, thereby avoiding the single point failure problem; at the same time, the data cache server sends update data to other node devices, and the data cache server always stores the latest data, and sends the session key to the node device by the data cache server, so that the node device does not need to negotiate keys with many node devices through the traditional cryptographic exchange protocol and send session keys multiple times. In a cluster environment, there is no need to send repeated session keys multiple times, thereby reducing the steps for node devices to synchronously obtain keys and improving data transmission efficiency.

[0203] Fig.11 , is a quantum-resistant negotiation key synchronization device in a cluster deployment mode provided by an embodiment of the present invention, and the device may include:

[0204] The second receiving module 701 is used to receive the protection key index, ciphertext key and identity authentication data sent by the data cache server in the service cluster.

[0205] The decryption module 702 is used to obtain the protection key through the protection key index, and decrypt the ciphertext key through the protection key to obtain the session key.

[0206] Optionally, the device further comprises:

[0207] The connection module establishes a connection with the third node device at the receiving end to obtain communication information of the third node device at the receiving end.

[0208] The second request module sends a request to the data cache server to determine the identity authentication data matching the communication information, and obtains the session key corresponding to the identity authentication data matching the communication information from the data cache server.

[0209] The fourth sending module encrypts the transmission data using the session key, and sends the encrypted transmission data.

[0210] The third receiving module, when receiving the ciphertext data, uses the protection key to decrypt the ciphertext data to obtain the decrypted ciphertext data.

[0211] In summary, in an embodiment of the present invention, a node device in a server cluster uses a preset quantum-resistant authentication algorithm and a preset quantum-resistant key negotiation algorithm to store the authentication data and the negotiation result data in a data cache server, wherein the negotiation result data includes a protection key index and a key ciphertext. The data cache server notifies other node devices in the service cluster to update the negotiation data, and other node devices decrypt the key ciphertext through the protection key index and the server cryptographic machine to obtain a session key. The present invention enables the data transmission between node devices to resist quantum attacks by using a preset quantum-resistant identity authentication algorithm and a preset quantum-resistant key negotiation algorithm in the node devices, reduces the risk of data being tampered with and cracked during data transmission, and improves the security of data transmission; the data cache server receives new identity authentication data and key ciphertext data and sends update data to other node devices, thereby avoiding the problem of directly sending keys to other node devices through a central node, which may cause a single point failure when the central node fails. The node device sends data to the data cache server and stores it, and then the data cache server sends it to other node devices, without directly transmitting data through the central node and other node devices, thereby avoiding the single point failure problem; at the same time, the data cache server sends update data to other node devices, and the data cache server always stores the latest data, and sends the session key to the node device by the data cache server, so that the node device does not need to negotiate keys with many node devices through the traditional cryptographic exchange protocol and send session keys multiple times. In a cluster environment, there is no need to send repeated session keys multiple times, thereby reducing the steps for node devices to synchronously obtain keys and improving data transmission efficiency.

[0212] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0213] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0214] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0215] An embodiment of the present application provides an account information management device, including a memory and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by one or more processors to include methods for performing one or more of the above embodiments.

[0216] Fig.12 8 is a block diagram of an account information management device 800 according to an exemplary embodiment. For example, the device 800 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0217] Reference Fig.12 , the device 800 may include one or more of the following components: a processing component 802 , a memory 804 , a power component 806 , a multimedia component 808 , an audio component 810 , an input / output (I / O) interface 812 , a sensor component 814 , and a communication component 816 .

[0218] The processing component 802 generally controls the overall operation of the device 800, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 802 may include one or more processors 820 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 802 may include one or more modules to facilitate the interaction between the processing component 802 and other components. For example, the processing component 802 may include a multimedia module to facilitate the interaction between the multimedia component 808 and the processing component 802.

[0219] The memory 804 is configured to store various types of data to support operations on the device 800. Examples of such data include instructions for any application or method operating on the device 800, contact data, phone book data, messages, pictures, videos, etc. The memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0220] The power supply component 806 provides power to the various components of the device 800. The power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the device 800.

[0221] The multimedia component 808 includes a screen that provides an output interface between the device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front camera and / or a rear camera. When the device 800 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0222] The audio component 810 is configured to output and / or input audio signals. For example, the audio component 810 includes a microphone (MIC), and when the device 800 is in an operating mode, such as a call mode, a recording mode, and a voice information processing mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 804 or sent via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting audio signals.

[0223] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: home button, volume button, start button, and lock button.

[0224] The sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for the device 800. For example, the sensor assembly 814 can detect the open / closed state of the device 800, the relative positioning of components, such as the display and keypad of the device 800, and the sensor assembly 814 can also search for changes in the position of the device 800 or a component of the device 800, the presence or absence of user contact with the device 800, the orientation or acceleration / deceleration of the device 800, and the temperature change of the device 800. The sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 814 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0225] The communication component 816 is configured to facilitate wired or wireless communication between the device 800 and other devices. The device 800 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency information processing (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0226] In an exemplary embodiment, the apparatus 800 may be implemented by one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0227] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, and the instructions can be executed by the processor 820 of the device 800 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0228] Fig.131 is a schematic diagram of the structure of the server in some embodiments of the present application. The server 1900 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPU) 1922 (for example, one or more processors) and memory 1932, and one or more storage media 1930 (for example, one or more mass storage devices) storing application programs 1942 or data 1944. Among them, the memory 1932 and the storage medium 1930 can be short-term storage or permanent storage. The program stored in the storage medium 1930 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server. Furthermore, the central processing unit 1922 can be configured to communicate with the storage medium 1930 and execute a series of instruction operations in the storage medium 1930 on the server 1900.

[0229] The server 1900 may also include one or more power supplies 1926, one or more wired or wireless network interfaces 1950, one or more input and output interfaces 1958, one or more keyboards 1956, and / or, one or more operating systems 1941, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.

[0230] A non-transitory computer-readable storage medium, when the instructions in the storage medium are executed by a processor of a device (server or terminal), enables the device to execute the above-mentioned embodiment method.

[0231] A non-temporary computer-readable storage medium, when the instructions in the storage medium are executed by the processor of the device (server or terminal), enables the device to perform the description of the method of the above embodiment, so it will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated. For technical details not disclosed in the computer program product or computer program embodiment involved in this application, please refer to the description of the method embodiment of this application.

[0232] In addition, it should be noted that: the embodiment of the present application also provides a computer program product or a computer program, which may include computer instructions, which may be stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor may execute the computer instructions so that the computer device performs the description of the method of the above embodiment, so it will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated. For technical details not disclosed in the computer program product or computer program embodiment involved in this application, please refer to the description of the method embodiment of this application.

[0233] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the application disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0234] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

[0235] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

[0236] The above is a detailed introduction to the quantum-resistant negotiated key synchronization method, device, electronic device and computer-readable storage medium in a cluster deployment mode provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the ideas of the present application, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A quantum-resistant negotiation key synchronization method in cluster deployment mode, characterized in that: Applied to a data cache server in a service cluster, the method comprises: receiving identity authentication data and a ciphertext key sent by a first node device, wherein the identity authentication data is obtained after the first node device performs identity authentication with the second node device according to a preset quantum-resistant identity authentication algorithm, and the ciphertext key is obtained by encrypting a session key obtained by the first node device after performing key negotiation with the second node device according to the preset quantum-resistant key negotiation algorithm, using a protection key to encrypt the session key; The session key of the cluster is encrypted by using the protection key in the preset encryption algorithm to obtain the ciphertext key and the protection key index; the protection key index is used to indicate the protection key; The protection key index, the ciphertext key and the identity authentication data are sent to a third node device in the service cluster except the first node device and the second node device. The third node device obtains the protection key through the protection key index, uses the protection key to decrypt the ciphertext key to obtain the session key, and uses the session key to perform the key negotiation.

2. The method according to claim 1, characterized in that The method of encrypting the session key of the cluster by using the protection key in the preset encryption algorithm to obtain the ciphertext key and the protection key index includes: By calling the self-check interface, the connection status of the server cryptographic machine, the working status of the server cryptographic machine and the correctness of the cryptographic algorithm of the server cryptographic machine are detected to obtain the detection result; When the detection result indicates that the connection state and the working state are enabled, and the cryptographic algorithm is correct, the ciphertext key and the protection key index obtained by encrypting the session key with the protection key by the server cryptographic machine are obtained.

3. The method according to claim 1, characterized in that The session key is set with a corresponding life cycle, and the method further includes: When it is detected that the life cycle of the session key expires, the key destruction interface is called to destroy the session key.

4. The method according to claim 1, characterized in that: The sending the protection key index, the ciphertext key, and the identity authentication data to a third node device in the service cluster except the first node device and the second node device includes: In response to the acquisition request of the third node device, the protection key index, the ciphertext key and the identity authentication data are sent to the third node device.

5. A quantum-resistant negotiation key synchronization method in cluster deployment mode, characterized in that: Applied to a first node device in a service cluster, where the first node device is any node device in the service cluster, the method includes: According to a preset quantum-resistant authentication algorithm, identity authentication is performed with the second node device, and identity authentication data is obtained and sent to the data cache server for storage; the identity authentication data is used to be transmitted by the data cache server to a third node device in the service cluster other than the first node device and the second node device, and is used by the third node device for identity authentication; the second node device is a node device that has established a communication connection with the first node device; According to a preset quantum-resistant key negotiation algorithm, key negotiation is performed with the second node device to obtain a private key and a session key, the session key is encrypted to form a ciphertext key and sent to the data cache server for storage; the session key is encrypted by the data cache server using a protection key in a preset encryption algorithm to obtain a ciphertext key and a protection key index; the protection key index is used to indicate the protection key; the data cache server is further used to send the protection key index and the ciphertext key to the third node device, so that the third node device can obtain the protection key through the protection key index after passing the identity authentication according to the identity authentication data, and use the protection key to decrypt the ciphertext key to obtain the session key, and use the session key to transmit data.

6. The method according to claim 5, characterized in that The method of performing identity authentication with the second node device according to a preset quantum-resistant identity authentication algorithm, obtaining identity authentication data and sending it to a data cache server for storage includes: Generate a first authentication certificate by using the preset quantum-resistant algorithm, and send the first authentication certificate to the second node device in the service cluster; Receive the second authentication certificate returned by the second node device after verifying the first authentication certificate, generate the identity authentication data according to the first authentication certificate and the second authentication certificate, and send it to the data cache server for storage; the second authentication certificate is generated by the second node device based on the preset anti-quantum algorithm.

7. The method according to claim 5, characterized in that The method of performing key negotiation with the second node device according to a preset quantum-resistant key negotiation algorithm, obtaining a private key and a session key of the second node device, encrypting the session key to form a ciphertext key and sending it to the data cache server for storage, includes: Generate first key encrypted data by using the preset quantum-resistant algorithm, and send the first key encrypted data to the second node device in the service cluster; Receive the second key encrypted data returned by the second node device after verifying the first key encrypted data, generate the session key data according to the first key encrypted data and the second key encrypted data, encrypt the session key to form a ciphertext key and send it to the data cache server for storage; the second key encrypted data is generated by the second node device based on the preset quantum-resistant algorithm.

8. The method according to claim 5, characterized in that The method further comprises: In response to a communication request with the second node device, encrypting the transmission data with the session key obtained through the key negotiation to obtain encrypted transmission data; The encrypted transmission data is transmitted to the second node device, so that the second node device uses the private key to decrypt the encrypted transmission data to obtain the transmission data.

9. The method according to claim 5, characterized in that The method further comprises: In response to a communication request with the second node device, sending a request to the data cache server according to the identity authentication data, obtaining the ciphertext key and the protection key index corresponding to the identity authentication data returned by the data cache server, and using the protection key index to decrypt the ciphertext key to obtain the session key; Encrypting the transmission data using the session key to obtain encrypted transmission data; The encrypted transmission data is transmitted to the second node device, so that the second node device uses the private key to decrypt the encrypted transmission data to obtain the transmission data.

10. A quantum-resistant negotiation key synchronization method in cluster deployment mode, characterized in that: Applied to any third node device in a service cluster, where the any third node device is one of the node devices in the service cluster except the first node device and the second node device, the method includes: Receive the protection key index, ciphertext key and identity authentication data sent by the data cache server in the service cluster, where the protection key index and the ciphertext key are obtained by sending the identity authentication data and the session key to the data cache server in the service cluster by the first node device, and encrypting the session key by the protection key in the preset encryption algorithm; the identity authentication data is obtained by the first node device and the second node device performing identity authentication according to a preset quantum-resistant identity authentication algorithm, and the identity authentication data is sent to the data cache server for storage; The protection key is obtained through the protection key index, and the ciphertext key is decrypted through the protection key to obtain the session key.

11. The method according to claim 10, characterized in that The method further comprises: Establishing a connection with a third node device at a receiving end to obtain communication information of the third node device at the receiving end; Sending a request to the data cache server to determine the identity authentication data matching the communication information, and obtaining the ciphertext key and the protection key corresponding to the identity authentication data matching the communication information from the data cache server; Decrypting the ciphertext key using the protection key to obtain the session key, encrypting the transmission data using the session key, and sending the encrypted transmission data to the third node device at the receiving end; When receiving the ciphertext data sent to the third node device at the receiving end, the ciphertext data is decrypted using the protection key to obtain the decrypted ciphertext data.

12. A quantum-resistant negotiation key synchronization device in cluster deployment mode, characterized in that: A data cache server applied to a service cluster, the device comprising: A first receiving module is configured to receive identity authentication data and a ciphertext key sent by a first node device, wherein the identity authentication data is obtained after the first node device performs identity authentication with the second node device according to a preset quantum-resistant identity authentication algorithm, and the ciphertext key is obtained by encrypting a session key using a protection key after the first node device performs key negotiation with the second node device according to the preset quantum-resistant key negotiation algorithm; A first encryption module, used to encrypt the session key of the cluster by using a protection key in a preset encryption algorithm to obtain a ciphertext key and a protection key index; the protection key index is used to indicate the protection key; The first sending module is used to send the protection key index, the ciphertext key and the identity authentication data to a third node device in the service cluster except the first node device and the second node device, the third node device obtains the protection key through the protection key index, uses the protection key to decrypt the ciphertext key to obtain the session key, and uses the session key to perform the key negotiation.

13. A quantum-resistant negotiation key synchronization device in cluster deployment mode, characterized in that: Applied to a first node device in a service cluster, the first node device is any node device in the service cluster, and the apparatus includes: An identity authentication module, used to perform identity authentication with a second node device according to a preset quantum-resistant identity authentication algorithm, obtain identity authentication data and send it to a data cache server for storage; the identity authentication data is used to be transmitted by the data cache server to a third node device in the service cluster other than the first node device and the second node device, and is used by the third node device for identity authentication; the second node device is a node device that has established a communication connection with the first node device; A key negotiation module is used to perform key negotiation with the second node device according to a preset quantum-resistant key negotiation algorithm, obtain a private key and a session key, encrypt the session key to form a ciphertext key and send it to the data cache server for storage; the session key is encrypted by the data cache server using a protection key in a preset encryption algorithm to obtain a ciphertext key and a protection key index; the protection key index is used to indicate the protection key; the data cache server is also used to send the protection key index and the ciphertext key to the third node device, so that the third node device can obtain the protection key through the protection key index after passing the identity authentication according to the identity authentication data, and use the protection key to decrypt the ciphertext key to obtain the session key, and use the session key to transmit data.

14. A quantum-resistant negotiation key synchronization device in cluster deployment mode, characterized in that: Applied to any third node device in a service cluster, where the any third node device is one of the node devices in the service cluster except the first node device and the second node device, the apparatus comprises: A second receiving module is used to receive the protection key index, ciphertext key and identity authentication data sent by the data cache server in the service cluster, wherein the protection key index and the ciphertext key are the identity authentication data and the session key sent by the first node device to the data cache server in the service cluster, and the session key is encrypted by the protection key in the preset encryption algorithm; the identity authentication data is obtained by the first node device and the second node device performing identity authentication according to the preset quantum-resistant identity authentication algorithm, and the identity authentication data is sent to the data cache server for storage; The decryption module is used to obtain the protection key through the protection key index, and decrypt the ciphertext key through the protection key to obtain the session key.

15. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method according to any one of claims 1 to 11.

16. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the method as claimed in any one of claims 1 to 11.

Images