Quantum-resistant communication method and device between user identification module and service provider

Abstract

The present application provides a quantum-resistant communication method and device between a user identification module and a service provider. The method includes: the user identification module and the certificate provider perform two-way authentication for secure access services based on their respective certificates; based on the number theory research group encryption algorithm, the certificate provider and the service provider perform two-way authentication for sessions based on their respective certificates; based on the number theory research group encryption algorithm, the service provider and the mobile network operator perform two-way authentication based on their respective certificates; the mobile network operator encrypts the session key obtained through two-way authentication with the service provider using the Advanced Encryption Standard encryption algorithm and sends it to the user identification module so that the user identification module registers with the service provider; the user identification module encrypts the data to be transmitted using the session key and sends it to the service provider so that the service provider decrypts the received encrypted data to be transmitted based on the session key and obtains the data to be transmitted. This can improve the security of data communication.

Description

Technical Field

[0001] The present application relates to the field of computer communication technology, and in particular to a quantum-resistant communication method and device between a Subscriber Identity Module (SIM) and a Service Provider (SP). Background Art

[0002] The mobile internet assigns an identity, known as an International Mobile Subscriber Identity (IMSI), to network users accessing mobile devices. This identity allows network users to communicate with service providers based on the identity. A Subscriber Identity Module (SMI) is a small smart card embedded in a mobile device. The SMI card stores the user's unique IMSI and encryption key, ensuring access to mobile networks.

[0003] In mobile communications, the data security of both communicating parties is protected by keys. For example, the data sender, such as a service provider, encrypts the data to be transmitted using a symmetric encryption key, an RSA encryption key, or an asymmetric encryption key. The encrypted data is then sent to the data receiver, such as a SIM card, via the mobile network. After receiving the data, the data receiver decrypts it using a symmetric decryption key or an asymmetric decryption key to obtain the data to be transmitted. This ensures that data cannot be intercepted or tampered with during transmission by encrypting the data during transmission. However, with the continuous advancement of quantum computing technology, the parallelism of quantum computing can be exploited to quickly factorize large numbers. This will make it easy for quantum computers to crack widely used cryptographic codes, such as the RSA public key encryption system, reducing the security of data communications. Summary of the Invention

[0004] This application describes a quantum-resistant communication method and apparatus between a user identification module and a service provider.

[0005] In a first aspect, the present application provides a quantum-resistant communication method between a user identification module and a service provider, the method comprising:

[0006] The user identity module SIM and the certificate provider CP perform two-way authentication for secure access services based on their respective certificates;

[0007] Based on the NTRU encryption algorithm of the Number Theory Research Group, the certificate provider and service provider SP are authenticated based on their respective certificates.

[0008] Based on the encryption algorithm of the Number Theory Research Group, two-way authentication is performed for service providers and mobile network operators (MNOs) based on their respective certificates.

[0009] The mobile network operator encrypts the session key obtained through two-way authentication with the service provider using the Advanced Encryption Standard (AES) encryption algorithm and sends it to the user identity module (SIM) so that the SIM registers with the service provider.

[0010] The user identification module encrypts the data to be transmitted using the session key and sends the encrypted data to the service provider, so that the service provider decrypts the received encrypted data to be transmitted according to the session key to obtain the data to be transmitted.

[0011] Preferably, the user identification module and the certificate provider perform two-way authentication for secure access services based on their respective certificates, including:

[0012] The SIM uses the Advanced Encryption Standard (AES) encryption algorithm to encrypt the secure access service request carrying the SIM certificate and sends it to the CP.

[0013] After CP authenticates the SIM certificate carried in the encrypted secure access service request, it generates a temporary key. Using the Advanced Encryption Standard (AES) encryption algorithm, it signs and encrypts the temporary key and CP certificate, and then carries it in the secure access service request response and sends it to the SIM.

[0014] The SIM verifies the signature of the CP certificate carried in the secure access service request response.

[0015] Preferably, the step of signing and encrypting the temporary key and the CP certificate using the Advanced Encryption Standard encryption algorithm includes:

[0016] Use the CP private key generated based on the Advanced Encryption Standard encryption algorithm to sign the temporary key and CP certificate to obtain signature information;

[0017] The signature information is encrypted using the SIM public key generated based on the Advanced Encryption Standard encryption algorithm.

[0018] Preferably, the SIM verifies the signature of the CP certificate carried in the secure access service request response, including:

[0019] The SIM uses the SIM private key to verify the signature of the secure access service request response, obtains the signature information, uses the CP public key to decrypt the signature information, obtains the temporary key and CP certificate, stores the temporary key, and verifies the CP certificate.

[0020] Preferably, the method of performing bidirectional session authentication on the certificate provider and the service provider based on their respective certificates based on the encryption algorithm of the Number Theory Research Group includes:

[0021] CP uses the NTRU encryption algorithm to sign and encrypt the CP certificate and then sends it to the SP;

[0022] After the SP authenticates the CP certificate, it uses the NTRU encryption algorithm to sign and encrypt the SP certificate and then sends it to the CP;

[0023] After CP authenticates the SP certificate, it uses the NTRU encryption algorithm to send the generated temporary key to the SP;

[0024] The SP uses the temporary key and the AES-256 encryption algorithm to generate a session key and sends it to the CP.

[0025] Preferably, the CP uses the NTRU encryption algorithm to sign and encrypt the CP certificate, including:

[0026] CP uses the CP encryption private key generated by the NTRU encryption algorithm to sign the CP certificate and obtain the CP certificate signature information;

[0027] The SP encryption public key generated by the NTRU encryption algorithm is used to encrypt the CP certificate signature information.

[0028] Preferably, the NTRU encryption algorithm is used to sign and encrypt the SP certificate, including:

[0029] The SP uses the SP encryption private key generated by the NTRU encryption algorithm to sign the SP certificate and obtain the SP certificate signature information;

[0030] The CP encryption public key generated by the NTRU encryption algorithm is used to encrypt the SP certificate signature information.

[0031] Preferably, the method of performing two-way authentication of the service provider and the mobile network operator based on their respective certificates based on the Number Theory Research Group encryption algorithm includes:

[0032] The SP uses the NTRU encryption algorithm to send the SP certificate to the MNO;

[0033] The MNO authenticates the received SP certificate, uses the NTRU encryption algorithm, and sends the MNO certificate to the SP;

[0034] The SP authenticates the received MNO certificate and uses the NTRU encryption algorithm to send the encrypted session key to the MNO.

[0035] The MNO uses the NTRU encryption algorithm to decrypt the received encrypted session key to obtain the session key.

[0036] Preferably, the step of encrypting the data using the Advanced Encryption Standard (AES) encryption algorithm and then sending the data to the SIM so that the SIM registers with the SP includes:

[0037] The MNO uses the AES-256 encryption algorithm to encrypt the session key and send it to the SIM;

[0038] The SIM uses the AES-256 encryption algorithm to decrypt the received encrypted session key, obtain the session key, and return confirmation information to the MNO;

[0039] The MNO uses the AES-256 encryption algorithm to return a confirmation response message to the SIM card.

[0040] The SIM uses the AES-256 encryption algorithm and session key to send a service request to the SP;

[0041] The SP uses the AES-256 encryption algorithm and session key to return a service request response to the SIM.

[0042] Preferably, the user identification module encrypts the data to be transmitted using the session key and sends the encrypted data to the service provider, so that the service provider decrypts the received encrypted data to be transmitted according to the session key to obtain the data to be transmitted, including:

[0043] The SIM uses the Advanced Encryption Standard (AES) encryption algorithm to send a secure session request to the CP, which carries the session key negotiated between the SIM and the SP, as well as the SIM certificate, and performs mutual certificate authentication with the CP.

[0044] CP uses the encryption algorithm of the Number Theory Research Group to perform NTRU signature on the CP certificate and session key, and mutually authenticate the certificate with the SP;

[0045] The SP uses the Number Theory Research Group encryption algorithm to sign the SP certificate and session key using NTRU, and performs mutual certificate authentication with the MNO.

[0046] The MNO signs the MNO certificate and session key based on the Advanced Encryption Standard encryption algorithm, and mutually authenticates the certificate and session key with the SIM;

[0047] The SIM and SP transmit data based on the session key.

[0048] In a second aspect, the present application provides a quantum-resistant communication device between a user identification module and a service provider, the device comprising:

[0049] The first authentication module is used for the user identification module SIM and the certificate provider CP to perform two-way authentication for secure access services based on their respective certificates;

[0050] The second authentication module is used to perform two-way session authentication on the certificate provider and the service provider SP based on their respective certificates based on the NTRU encryption algorithm of the Number Theory Research Group;

[0051] The third authentication module is used to perform two-way authentication on the service provider and the mobile network operator (MNO) based on their respective certificates based on the Number Theory Research Group encryption algorithm;

[0052] The service registration module is used for the mobile network operator to encrypt the session key obtained through two-way authentication with the service provider using the Advanced Encryption Standard encryption algorithm and send it to the user identification module so that the user identification module can register with the service provider;

[0053] The data transmission module is used for the user identification module to encrypt the data to be transmitted using the session key and send it to the service provider, so that the service provider can decrypt the received encrypted data to be transmitted based on the session key and obtain the data to be transmitted.

[0054] Preferably, the first authentication module includes:

[0055] The encryption unit is used by the SIM to encrypt the security access service request carrying the SIM certificate using the Advanced Encryption Standard encryption algorithm and send it to the CP;

[0056] A temporary key generation unit is used to generate a temporary key after the CP authenticates the SIM certificate carried in the encrypted secure access service request. The temporary key and the CP certificate are signed and encrypted using the Advanced Encryption Standard encryption algorithm, and then carried in the secure access service request response and sent to the SIM.

[0057] The signature verification unit is used for the SIM to verify the CP certificate carried in the secure access service request response.

[0058] Preferably, the temporary key generation unit is specifically used to:

[0059] Use the CP private key generated based on the Advanced Encryption Standard encryption algorithm to sign the temporary key and CP certificate to obtain signature information;

[0060] The signature information is encrypted using the SIM public key generated based on the Advanced Encryption Standard encryption algorithm.

[0061] Preferably, the signature verification unit is specifically configured to:

[0062] The SIM uses the SIM private key to verify the signature of the secure access service request response, obtains the signature information, uses the CP public key to decrypt the signature information, obtains the temporary key and CP certificate, stores the temporary key, and verifies the CP certificate.

[0063] In a third aspect, the present application shows an electronic device, which includes: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the method described in any of the above aspects.

[0064] In a fourth aspect, the present application shows a non-temporary computer-readable storage medium, which, when the instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute the method described in any of the above aspects.

[0065] In a fifth aspect, the present application illustrates a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to execute the method as described in any of the above aspects.

[0066] The technical solution provided by this application may have the following beneficial effects:

[0067] Combining the NTRU encryption algorithm and the AES-256 encryption algorithm, the private key is not loaded onto the SIM card during the production phase. The NTRU encryption algorithm is used for signature and authentication, and the AES-256 encryption algorithm is used for encrypted communication between the SIM and the CP and the MNO. This ensures that the communication between the SIM and the SP is not attacked by quantum algorithms, thereby resisting post-quantum algorithm attacks, ensuring the confidentiality, integrity and information security of data transmission, and enhancing the security of data communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 This is a flowchart of the steps of the quantum-resistant communication method between the user identification module and the service provider of this application.

[0069] Figure 2 This is another step flow chart of the quantum-resistant communication method between the user identification module and the service provider of this application.

[0070] Figure 3 This is another step flow chart of the quantum-resistant communication method between the user identification module and the service provider of this application.

[0071] Figure 4 This is a structural block diagram of the user identification module of this application and the quantum-resistant communication device of the service provider.

[0072] Figure 5 This is a block diagram of an electronic device of the present application.

[0073] Figure 6 This is a block diagram of an electronic device of the present application. DETAILED DESCRIPTION

[0074] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0075] Shor's quantum algorithm is a type of quantum algorithm, also known as Shor's algorithm. Shor's quantum algorithm has a significant impact on cryptography, especially for public key encryption algorithms such as RSA that use large number factorization as a security basis. If the Shor algorithm can be effectively implemented on a quantum computer, traditional encryption systems will face the risk of cracking, so it is necessary to switch to quantum-resistant encryption algorithms.

[0076] The Number Theory Research Unit (NTRU) encryption algorithm is a lattice-based public-key encryption algorithm. While maintaining high security, it offers fast encryption and decryption speeds, as well as small key and ciphertext sizes. Due to its lattice-based design, the NTRU algorithm is more vulnerable to known quantum attacks. Compared to other encryption algorithms, the NTRU algorithm boasts faster encryption and decryption speeds, and generates relatively small ciphertext and key sizes, which helps improve overall system performance.

[0077] In theory, quantum computing can use Shor's quantum algorithm to crack traditional asymmetric encryption algorithms such as RSA and Digital Signature Algorithm (DSA) in polynomial time. However, for symmetric encryption algorithms such as AES-256, since symmetric encryption algorithms mainly rely on exhaustive key enumeration rather than number theory methods like Shor's quantum algorithm, quantum computing will not significantly increase the cracking speed of symmetric encryption. Therefore, the Advanced Encryption Standard (AES-256) encryption algorithm, as a symmetric encryption algorithm, has certain quantum resistance advantages in the face of possible future quantum computing attacks.

[0078] In this embodiment, the NTRU encryption algorithm and the AES-256 encryption algorithm are combined to propose a quantum secure communication method between the SIM card and the service provider (SP) that is resistant to quantum attacks. With the development of quantum computing, this method ensures that the communication between the SIM card and the SP is not attacked by quantum algorithms, thereby ensuring the confidentiality, integrity and information security of the communication content.

[0079] Reference Figure 1 , shows a flowchart of the steps of the quantum-resistant communication method between the user identification module and the service provider of the present application, which can be applied to electronic devices, wherein the method specifically may include the following steps:

[0080] S101, the user identification module and the certificate provider perform two-way authentication for secure access services based on their respective certificates;

[0081] In step S101, the SIM interacts with a Content Provider (CP) and requests a secure access service.

[0082] In this embodiment, as an optional embodiment, the user identification module and the certificate provider perform two-way authentication for secure access services based on their respective certificates, including:

[0083] A11, the SIM uses the Advanced Encryption Standard encryption algorithm to encrypt the secure access service request carrying the SIM certificate and sends it to the CP;

[0084] In this embodiment, the secure access service request is encrypted using a CP public key generated based on an Advanced Encryption Standard encryption algorithm.

[0085] In this embodiment, the secure access service request is a session request for requesting a secure access service.

[0086] A12: After authenticating the SIM certificate carried in the encrypted secure access service request, the CP generates a temporary key. Using the Advanced Encryption Standard (AES) encryption algorithm, the CP signs and encrypts the temporary key and the CP certificate. The CP then carries the key in a secure access service request response and sends it to the SIM.

[0087] In this embodiment, as an optional embodiment, the temporary key and the CP certificate are signed and encrypted using the Advanced Encryption Standard encryption algorithm, including:

[0088] Use the CP private key generated based on the Advanced Encryption Standard encryption algorithm to sign the temporary key and CP certificate to obtain signature information;

[0089] The signature information is encrypted using the SIM public key generated based on the Advanced Encryption Standard encryption algorithm.

[0090] A13: The SIM verifies the signature of the CP certificate carried in the secure access service request response.

[0091] In this embodiment, the SIM uses the SIM private key to verify the signature of the secure access service request response to obtain signature information, decrypts the signature information using the CP public key to obtain a temporary key and CP certificate, stores the temporary key, and verifies the CP certificate.

[0092] In this embodiment, the CP uses the AES-256 encryption algorithm and a temporary key to generate a session key. The SIM interacts with the CP and requests secure access to services. In response, the CP verifies the SP's certificate and then exchanges certificates.

[0093] S102. Based on the number theory research group encryption algorithm, perform bidirectional session authentication on the certificate provider and the service provider based on their respective certificates;

[0094] In this embodiment, as an optional embodiment, based on the Number Theory Research Group encryption algorithm, the certificate provider and the service provider are mutually authenticated based on their respective certificates, including:

[0095] B11, CP uses the NTRU encryption algorithm to sign and encrypt the CP certificate and sends it to the SP;

[0096] In this embodiment, as an optional embodiment, the CP uses the NTRU encryption algorithm to sign and encrypt the CP certificate, including:

[0097] CP uses the CP encryption private key generated by the NTRU encryption algorithm to sign the CP certificate and obtain the CP certificate signature information;

[0098] The SP encryption public key generated by the NTRU encryption algorithm is used to encrypt the CP certificate signature information.

[0099] In this embodiment, as an optional embodiment, the NTRU encryption algorithm is the NTRUSign algorithm. The NTRUSign algorithm is based on solving the approximate nearest vector problem in a special NTRU lattice. At the same security level, the NTRUSign algorithm requires less computational workload and lower power consumption than the ECDSA algorithm and the RSA algorithm.

[0100] In this embodiment, the basic operations of the NTRUSign algorithm are shown in Table 1.

[0101] Table 1

[0102]

[0103]

[0104] B12, after the SP authenticates the CP certificate, it uses the NTRU encryption algorithm to sign and encrypt the SP certificate and sends it to the CP;

[0105] In this embodiment, as an optional embodiment, the NTRU encryption algorithm is used to sign and encrypt the SP certificate, including:

[0106] The SP uses the SP encryption private key generated by the NTRU encryption algorithm to sign the SP certificate and obtain the SP certificate signature information;

[0107] The CP encryption public key generated by the NTRU encryption algorithm is used to encrypt the SP certificate signature information.

[0108] B13, after CP authenticates the SP certificate, it uses the NTRU encryption algorithm to send the generated temporary key to the SP;

[0109] In this embodiment, the authentication process is verified by the NTRU signature / encryption algorithm, which can ensure secure communication of the system in post-quantum technology.

[0110] B14, SP uses the temporary key and AES-256 encryption algorithm to generate a session key and sends it to CP.

[0111] In this embodiment, as an optional embodiment, the AES-256 encryption algorithm is used to generate the session key.

[0112] In this embodiment, the CP stores the session key.

[0113] In this embodiment, the legitimacy of the SIM and SP is verified by the CP, and the CP and SP use the NTRU signature / encryption algorithm to ensure secure communication of the mobile communication system in the post-quantum technology era.

[0114] S103. Based on the encryption algorithm of the Number Theory Research Group, the service provider and the mobile network operator are mutually authenticated based on their respective certificates.

[0115] In this embodiment, as an optional embodiment, based on the Number Theory Research Group encryption algorithm, two-way authentication is performed on the service provider and the mobile network operator based on their respective certificates, including:

[0116] C11, SP uses the NTRU encryption algorithm to send the SP certificate to the MNO;

[0117] C12, the MNO authenticates the received SP certificate, uses the NTRU encryption algorithm, and sends the MNO certificate to the SP;

[0118] C13, the SP authenticates the received MNO certificate, uses the NTRU encryption algorithm, and sends the encrypted session key to the MNO;

[0119] C14. The MNO uses the NTRU encryption algorithm to decrypt the received encrypted session key to obtain the session key.

[0120] In this embodiment, the legitimacy authentication between the CP and the SP, and between the SP and the Mobile Network Operator (MNO) is similar to the legitimacy authentication between the SIM and the SP. After mutually verifying the certificates, the SP transmits the session key to the MNO and receives a confirmation from the MNO.

[0121] In this embodiment, the security of the mutual authentication process between the MNO and the SP is ensured by the mutual authentication method of NTRU signature / encryption post-quantum resistance technology. After the MNO and the SP have mutually authenticated, the encrypted session key is shared between the MNO and the SP.

[0122] S104. The mobile network operator encrypts the session key obtained through two-way authentication with the service provider using the Advanced Encryption Standard (AES) encryption algorithm and sends it to the SIM card, so that the SIM card registers with the SP.

[0123] In this embodiment, as an optional embodiment, after being encrypted using the Advanced Encryption Standard encryption algorithm, the data is sent to the SIM so that the SIM registers with the SP, including:

[0124] At D11, the MNO encrypts the session key using the AES-256 encryption algorithm and sends it to the SIM.

[0125] In this embodiment, the MNO uses the SIM public key generated by the AES-256 encryption algorithm for encryption.

[0126] D12: The SIM uses the AES-256 encryption algorithm to decrypt the received encrypted session key, obtains the session key, and returns confirmation information to the MNO.

[0127] In this embodiment, after decrypting and obtaining the session key, the SIM generates a session key using the temporary key and the NTRU encryption algorithm. If the decrypted session key is consistent with the generated session key, a confirmation message is returned to the MNO.

[0128] In this embodiment, the MNO shares the session key with the SIM and receives confirmation information. The SIM receives the temporary key set by the CP and the session key encrypted by the SP using the temporary key.

[0129] At D13, the MNO uses the AES-256 encryption algorithm and returns a confirmation response message to the SIM card.

[0130] D14, SIM uses AES-256 encryption algorithm and session key to send a service request to the SP;

[0131] In this embodiment, the SIM uses the SIM private key generated by the AES-256 encryption algorithm to sign the session key, and then uses the SP public key generated by the AES-256 encryption algorithm to encrypt the service request containing the signed session key.

[0132] At D15, the SP uses the AES-256 encryption algorithm and session key to return a service request response to the SIM.

[0133] S105 . The SIM encrypts the data to be transmitted using the session key and sends the encrypted data to be transmitted to the SP, so that the SP decrypts the received encrypted data to be transmitted according to the session key to obtain the data to be transmitted.

[0134] In this embodiment, after the SIM and the SP register with each other, the session key is used to encrypt and decrypt the transmitted data to achieve data transmission.

[0135] In this embodiment, the SIM and the SP use the session key to confirm the service request over the communication network, and if there is no error, the requested service is started.

[0136] In this embodiment, as an optional embodiment, the SIM encrypts the data to be transmitted using the session key and sends the encrypted data to the SP, so that the SP decrypts the received encrypted data to be transmitted based on the session key to obtain the data to be transmitted, including:

[0137] E11: The SIM uses the Advanced Encryption Standard (AES) encryption algorithm to send a secure session request to the CP, which carries the session key negotiated between the SIM and the SP, and the SIM certificate, to perform mutual certificate authentication with the CP.

[0138] In this embodiment, to receive services from the SP, the SIM establishes a secure session request with the CP and sends its certificate. Furthermore, the SIM verifies the CP by requesting its certificate. The CP then sends its certificate for verification by the SIM and confirms receipt of the SIM certificate. This process uses symmetric encryption using a message authentication code (AES_MAC) method, using a key (KCP,SIM) shared by both the CP and the end node.

[0139] E12, CP uses the encryption algorithm of the Number Theory Research Group to sign the CP certificate and session key using NTRU, and performs mutual certificate authentication with the SP;

[0140] E13, the SP uses the Number Theory Research Group encryption algorithm to sign the SP certificate and session key using NTRU, and performs mutual certificate authentication with the MNO;

[0141] E14, the MNO signs the MNO certificate and session key based on the Advanced Encryption Standard encryption algorithm, and mutually authenticates the certificate and session key with the SIM;

[0142] E15, SIM and SP transmit data based on the session key.

[0143] In this embodiment, the NTRU algorithm ensures communication security, making it effective even in the post-quantum era. The mobile network operator is responsible for communication security, performing mutual authentication with the SIM card, sharing the session key, and confirming the authentication. This mutual authentication, shared session key, and confirmation process are all protected by the post-quantum-resistant AES-256 encryption algorithm. Ultimately, both the SIM card and the service provider (SP) obtain the session key, enabling the SIM card to securely request SP services and receive them.

[0144] Reference Figure 2 , shows another step flow chart of the quantum-resistant communication method between the user identification module and the service provider of the present application, which is a service registration process, wherein the method may specifically include the following steps:

[0145] S201. The SIM initiates a session request for secure access to a service. The session request carrying the SIM certificate is encrypted using the AES-256 encryption algorithm and sent to the CP.

[0146] S202. The CP decrypts the encrypted session request, authenticates the SIM certificate, generates a temporary key, carries the temporary key in the session request response, and sends it to the SIM;

[0147] S203. CP uses the NTRU signature / encryption algorithm to send the CP certificate to SP.

[0148] S204. The SP authenticates the CP certificate and uses the NTRU signature / encryption algorithm to send the SP certificate to the CP so that the CP authenticates the SP certificate.

[0149] In this embodiment, quantum-resistant bidirectional authentication is provided between the CP and the SP so as to share the session key with the SP.

[0150] S205. The CP uses the NTRU signature / encryption algorithm to send the generated temporary key to the SP.

[0151] S206. The SP generates an encrypted session key using the temporary key and the NTRU signature / encryption algorithm and sends it to the CP.

[0152] In this embodiment, the CP shares the temporary key allocated to the session request with the SP and confirms it, and the SP generates an encrypted session key using the temporary key.

[0153] S207. The SP uses the NTRU signature / encryption algorithm to send the SP certificate to the MNO.

[0154] S208. The MNO authenticates the received SP certificate and sends the MNO certificate to the SP using the NTRU signature / encryption algorithm.

[0155] In this embodiment, the MNO and SP perform bidirectional authentication. The security of the bidirectional authentication process is guaranteed by a bidirectional authentication method based on post-quantum resistance technology (NTRU signature / encryption algorithm), which can increase the difficulty of cracking quantum algorithms.

[0156] S209. The SP authenticates the received MNO certificate and uses the NTRU signature / encryption algorithm to send the encrypted session key to the MNO.

[0157] S210. The MNO uses the NTRU signature / encryption algorithm to decrypt the received encrypted session key to obtain the session key.

[0158] In this embodiment, after the MNO and the SP perform mutual authentication, the MNO and the SP share a session key.

[0159] S211. The MNO encrypts the session key using the AES-256 encryption algorithm and sends it to the SIM.

[0160] S212. The SIM receives the encrypted session key and returns a response message to the MNO.

[0161] S213. The SIM uses the AES-256 encryption algorithm to decrypt the received encrypted session key, obtains the session key, and returns a confirmation message to the MNO.

[0162] S214. The MNO uses the AES-256 encryption algorithm to return a confirmation response message to the SIM.

[0163] In this embodiment, the MNO shares the session key with the SIM and receives a confirmation message.

[0164] S215. The SIM uses the AES-256 encryption algorithm and the session key to send a service registration request to the SP.

[0165] S216. The SP uses the AES-256 encryption algorithm and the session key to return a service registration request response to the SIM.

[0166] In this embodiment, the SIM and the SP use a session key to confirm the service request on the mobile communication network. To simplify the diagram, in this application, steps S201 to S216 are illustrated as 1 to 16 respectively.

[0167] Reference Figure 3 , shows another step flow chart of the quantum-resistant communication method between the user identification module and the service provider of the present application, which is a data transmission process, wherein the method may specifically include the following steps:

[0168] S301. SIM sends a service request to CP.

[0169] In this embodiment, the service request is a secure session request, and the service request carries the session key and the SIM certificate negotiated between the SIM and the SP.

[0170] S302. The CP verifies the SIM certificate carried in the service request and returns a service request response to the SIM.

[0171] In this embodiment, the service request response carries a CP certificate.

[0172] In this embodiment, to receive services from the SP, the SIM establishes a secure session request with the CP and sends its certificate. Furthermore, the SIM requests the CP's certificate to authenticate the CP. The CP then sends its certificate for verification by the SIM and confirms that the CP has received the SIM's certificate.

[0173] S303. CP signs the certificate with NTRU and sends it to SP.

[0174] In this embodiment, the CP sends its certificate to the SP after signing it with NTRU and requests the SP's certificate to verify the SP. As an alternative embodiment, the certificate message is encrypted using the SP's public key using the post-quantum-resistant NTRU algorithm, signed with the CP's private key, and sent to the SP.

[0175] S304. After verifying the received NTRU-signed certificate, the SP performs NTRU signing on the SP certificate and sends it to the CP.

[0176] In this embodiment, the SP uses the CP's public key and the post-quantum-resistant NTRU algorithm to encrypt the SP's certificate, encapsulate it in a message, and signs the message with the SP's private key before transmitting the message to the CP. The SP and CP complete two-way verification.

[0177] In this embodiment, the two-way verification process uses the post-quantum-resistant NTRU algorithm for encryption and signing. The private key of the party signs the message digest, and the public key of the other party encrypts the message and signature.

[0178] S305. The CP encrypts the generated session key with the SP's public key and sends it to the SP.

[0179] In this embodiment, for secure communication between the SIM and the SP, the CP encrypts the generated session key using the SP's public key and sends it to the SP, to ensure that the SP securely receives the session key.

[0180] In this embodiment, as an optional embodiment, the CP uses its private key to sign the message containing the public key encrypted session key, so that the SP ensures that the received message comes from the CP.

[0181] S306: The SP confirms receipt of the session key, generates a confirmation message, signs the confirmation message using the SP's private key, encrypts it using the CP's public key, and sends it to the CP.

[0182] In this embodiment, the SP confirms receipt of the session key and signs the confirmation information with its private key.

[0183] S307. The SP signs and encrypts the SP certificate and sends it to the MNO.

[0184] In this embodiment, the SP sends its own certificate to the MNO and requests the MNO certificate to verify the MNO.

[0185] In this embodiment, the SP uses the MNO's public key to encrypt a message containing the SP's certificate using the post-quantum resistant NTRU algorithm, and then uses the SP's private key to sign the encrypted message.

[0186] S308. After verifying the SP certificate, the MNO signs and encrypts the MNO certificate and sends it to the SP.

[0187] In this embodiment, as a response to the certificate request, the MNO encrypts its certificate, then signs the encrypted certificate and transmits it to the SP.

[0188] In this embodiment, bidirectional authentication between the MNO and the SP is performed using the post-quantum-resistant NTRU algorithm. On the MNO side, the SP public key generated based on the NTRU algorithm is used to encrypt data, and the MNO private key is used to sign data.

[0189] S309. The SP encrypts and signs the session key and sends it to the MNO.

[0190] In this embodiment, the SP uses the MNO's public key to encrypt a message containing the session key using the NTRU algorithm and sends a confirmation request for the message. As an alternative embodiment, the SP uses its private key to sign the message and then sends the signed message to the MNO.

[0191] S310. The MNO decrypts and verifies the signature of the received message.

[0192] In this embodiment, the MNO uses its private key to sign the received confirmation message containing the session key.

[0193] S311. The MNO sends the MNO certificate to the SIM.

[0194] In this embodiment, the MNO sends its certificate to the SIM.

[0195] S312: After the SIM verifies the MNO certificate, it sends the SIM certificate to the MNO.

[0196] In this embodiment, the SIM sends its own certificate to the MNO for verification.

[0197] S313. After verifying the SIM certificate, the MNO encrypts the session key and sends it to the SIM.

[0198] In this embodiment, the MNO uses the public key of the SIM to encrypt the session key and send it to the SIM.

[0199] S314. The SIM returns a confirmation message to the MNO.

[0200] In this embodiment, the SIM confirms receipt of the session key.

[0201] S315. The SIM encrypts the service request based on the session key and sends it to the SP.

[0202] In this embodiment, the SIM uses the session key received from the MNO for encryption and requests services from the SP.

[0203] S316. The SP decrypts the service request using the session key, carries the decryption result in the service request response, and sends it to the SIM.

[0204] In this embodiment, the SP decrypts the service request with the session key, reads the content of the data passed in the service request, and presents it to the SIM. To simplify the diagram, steps S301 to S316 are illustrated as 1 to 16 in this application.

[0205] In this embodiment, after the SIM is confirmed, the SIM and the SP use the session key to provide services.

[0206] In this embodiment, the private key is not loaded onto the SIM card during the production phase, which is resistant to post-quantum algorithm attacks. This includes symmetric (AES-256) and lattice-based public key encryption algorithms (NTRU). The NTRU algorithm is used for signatures and authentication, while AES-256 is used for encrypted communications between the SIM card, the CP, and the MNO. The method of this embodiment uses symmetric (AES-256) and lattice-based public key encryption algorithms (NTRU) to resist post-quantum attacks and ensure the confidentiality and integrity of messages.

[0207] It should be noted that for the method embodiments, for simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all optional embodiments, and the actions involved are not necessarily required by this application.

[0208] Reference Figure 4 , shows a structural block diagram of the user identification module of the present application and the quantum-resistant communication device of the service provider, the device comprising:

[0209] The first authentication module 401 is used for the user identification module SIM and the certificate provider CP to perform two-way authentication for secure access services based on their respective certificates;

[0210] In this embodiment, as an optional embodiment, the first authentication module 401 includes:

[0211] The encryption unit (not shown in the figure) is used by the SIM to encrypt the secure access service request carrying the SIM certificate using the Advanced Encryption Standard encryption algorithm and send it to the CP;

[0212] A temporary key generation unit is used to generate a temporary key after the CP authenticates the SIM certificate carried in the encrypted secure access service request. The temporary key and the CP certificate are signed and encrypted using the Advanced Encryption Standard encryption algorithm, and then carried in the secure access service request response and sent to the SIM.

[0213] The signature verification unit is used for the SIM to verify the CP certificate carried in the secure access service request response.

[0214] In this embodiment, as an optional embodiment, the temporary key generation unit is specifically configured to:

[0215] Use the CP private key generated based on the Advanced Encryption Standard encryption algorithm to sign the temporary key and CP certificate to obtain signature information;

[0216] The signature information is encrypted using the SIM public key generated based on the Advanced Encryption Standard encryption algorithm.

[0217] In this embodiment, as an optional embodiment, the signature verification unit is specifically configured to:

[0218] The SIM uses the SIM private key to verify the signature of the secure access service request response, obtains the signature information, uses the CP public key to decrypt the signature information, obtains the temporary key and CP certificate, stores the temporary key, and verifies the CP certificate.

[0219] The second authentication module 402 is configured to perform a two-way session authentication on the certificate provider and the service provider SP based on their respective certificates based on the NTRU encryption algorithm of the Number Theory Research Group;

[0220] In this embodiment, as an optional embodiment, the second authentication module 402 is specifically configured to:

[0221] CP uses the NTRU encryption algorithm to sign and encrypt the CP certificate and then sends it to the SP;

[0222] After the SP authenticates the CP certificate, it uses the NTRU encryption algorithm to sign and encrypt the SP certificate and then sends it to the CP;

[0223] After CP authenticates the SP certificate, it uses the NTRU encryption algorithm to send the generated temporary key to the SP;

[0224] The SP uses the temporary key and the AES-256 encryption algorithm to generate a session key and sends it to the CP.

[0225] In this embodiment, as an optional embodiment, the CP uses the NTRU encryption algorithm to sign and encrypt the CP certificate, including:

[0226] CP uses the CP encryption private key generated by the NTRU encryption algorithm to sign the CP certificate and obtain the CP certificate signature information;

[0227] The SP encryption public key generated by the NTRU encryption algorithm is used to encrypt the CP certificate signature information.

[0228] In this embodiment, as an optional embodiment, the NTRU encryption algorithm is used to sign and encrypt the SP certificate, including:

[0229] The SP uses the SP encryption private key generated by the NTRU encryption algorithm to sign the SP certificate and obtain the SP certificate signature information;

[0230] The CP encryption public key generated by the NTRU encryption algorithm is used to encrypt the SP certificate signature information.

[0231] The third authentication module 403 is configured to perform bidirectional authentication on the service provider and the mobile network operator MNO based on their respective certificates based on the Number Theory Research Group encryption algorithm;

[0232] In this embodiment, as an optional embodiment, the third authentication module 403 is specifically configured to:

[0233] The SP uses the NTRU encryption algorithm to send the SP certificate to the MNO;

[0234] The MNO authenticates the received SP certificate, uses the NTRU encryption algorithm, and sends the MNO certificate to the SP;

[0235] The SP authenticates the received MNO certificate and uses the NTRU encryption algorithm to send the encrypted session key to the MNO.

[0236] The MNO uses the NTRU encryption algorithm to decrypt the received encrypted session key to obtain the session key.

[0237] The service registration module 404 is configured to encrypt the session key obtained through two-way authentication between the mobile network operator and the service provider using the Advanced Encryption Standard (AES) encryption algorithm and send the encrypted key to the user identification module (UIM) so that the user identification module can register with the service provider.

[0238] In this embodiment, as an optional embodiment, the service registration module 404 is specifically used to:

[0239] The MNO uses the AES-256 encryption algorithm to encrypt the session key and send it to the SIM;

[0240] The SIM uses the AES-256 encryption algorithm to decrypt the received encrypted session key, obtain the session key, and return confirmation information to the MNO;

[0241] The MNO uses the AES-256 encryption algorithm to return a confirmation response message to the SIM card.

[0242] The SIM uses the AES-256 encryption algorithm and session key to send a service request to the SP;

[0243] The SP uses the AES-256 encryption algorithm and session key to return a service request response to the SIM.

[0244] The data transmission module 405 is used for the user identification module to encrypt the data to be transmitted using the session key and send it to the service provider, so that the service provider can decrypt the received encrypted data to be transmitted according to the session key to obtain the data to be transmitted.

[0245] In this embodiment, as an optional embodiment, the data transmission module 405 is specifically configured to:

[0246] The SIM uses the Advanced Encryption Standard (AES) encryption algorithm to send a secure session request to the CP, which carries the session key negotiated between the SIM and the SP, as well as the SIM certificate, and performs mutual certificate authentication with the CP.

[0247] CP uses the encryption algorithm of the Number Theory Research Group to perform NTRU signature on the CP certificate and session key, and mutually authenticate the certificate with the SP;

[0248] The SP uses the Number Theory Research Group encryption algorithm to sign the SP certificate and session key using NTRU, and performs mutual certificate authentication with the MNO.

[0249] The MNO signs the MNO certificate and session key based on the Advanced Encryption Standard encryption algorithm, and mutually authenticates the certificate and session key with the SIM;

[0250] The SIM and SP transmit data based on the session key.

[0251] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0252] Optionally, an embodiment of the present application also provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and runnable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned method embodiment are implemented and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0253] The present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the various processes of the above-described method embodiments are implemented and the same technical effects are achieved. To avoid repetition, the details are not described here. The computer-readable storage medium may be, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0254] FIG5 is a block diagram of an electronic device 800 shown in the present application. For example, the electronic device 800 can be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0255] Reference Figure 5 , the electronic device 800 may include one or more of the following components: a processing component 802 , a memory 804 , a power component 806 , a multimedia component 808 , an audio component 810 , an input / output (I / O) interface 812 , a sensor component 814 , and a communication component 816 .

[0256] The processing component 802 generally controls the overall operation of the electronic device 800, such as operations associated with display, phone calls, data communications, camera operation, and recording operations. The processing component 802 may include one or more processors 820 to execute instructions to perform all or part of the steps of the above-described method. In addition, the processing component 802 may include one or more modules to facilitate interaction between the processing component 802 and other components. For example, the processing component 802 may include a multimedia module to facilitate interaction between the multimedia component 808 and the processing component 802.

[0257] The memory 804 is configured to store various types of data to support operations on the device 800. Examples of such data include instructions for any application or method operating on the electronic device 800, contact data, phone book data, messages, images, videos, etc. The memory 804 can be implemented by any type of volatile or non-volatile storage device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0258] The power supply component 806 provides power to the various components of the electronic device 800. The power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 800.

[0259] The multimedia component 808 includes a screen that provides an output interface between the electronic device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, slides, and gestures on the touch panel. The touch sensor can not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front camera and / or a rear camera. When the device 800 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera can receive external multimedia data. Each front camera and rear camera can be a fixed optical lens system or have a focal length and optical zoom capability.

[0260] The audio component 810 is configured to output and / or input audio signals. For example, the audio component 810 includes a microphone (MIC), which is configured to receive external audio signals when the electronic device 800 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signal can be further stored in the memory 804 or transmitted via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting audio signals.

[0261] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as a keyboard, click wheel, buttons, etc. These buttons may include but are not limited to: a home button, volume buttons, a start button, and a lock button.

[0262] The sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for the electronic device 800. For example, the sensor assembly 814 can detect the open / closed state of the device 800, the relative positioning of components, such as the display and keypad of the electronic device 800. The sensor assembly 814 can also detect changes in the position of the electronic device 800 or a component of the electronic device 800, the presence or absence of user contact with the electronic device 800, the orientation or acceleration / deceleration of the electronic device 800, and temperature changes of the electronic device 800. The sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 814 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0263] The communication component 816 is configured to facilitate wired or wireless communication between the electronic device 800 and other devices. The electronic device 800 can access a wireless network based on a communication standard, such as WiFi, an operator network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast operation information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0264] In an exemplary embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0265] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, and the instructions can be executed by the processor 820 of the electronic device 800 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0266] Figure 61 is a block diagram of an electronic device 1900 shown in the present application. For example, the electronic device 1900 can be provided as a server.

[0267] Reference Figure 6 The electronic device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions executable by the processing component 1922, such as an application. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute the instructions to perform the above-described method.

[0268] The electronic device 1900 may further include a power supply component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input / output (I / O) interface 1958. The electronic device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or the like.

[0269] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0270] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0271] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms without departing from the purpose of this application and the scope of protection of the claims, all of which are within the protection of this application.

[0272] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of this application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0273] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0274] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0275] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0276] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0277] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

[0278] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A quantum-resistant communication method between a user identification module and a service provider, characterized in that: The method comprises: The user identity module SIM and the certificate provider CP perform two-way authentication for secure access services based on their respective certificates; Based on the NTRU encryption algorithm of the Number Theory Research Group, the certificate provider and service provider SP are authenticated based on their respective certificates. Based on the encryption algorithm of the Number Theory Research Group, two-way authentication is performed for service providers and mobile network operators (MNOs) based on their respective certificates. The mobile network operator encrypts the session key obtained through two-way authentication with the service provider using the Advanced Encryption Standard (AES) encryption algorithm and sends it to the user identity module (SIM) so that the SIM registers with the service provider. The user identification module encrypts the data to be transmitted using the session key and sends the encrypted data to the service provider, so that the service provider decrypts the received encrypted data to be transmitted based on the session key to obtain the data to be transmitted; The user identification module and the certificate provider perform two-way authentication for secure access services based on their respective certificates, including: The SIM uses the Advanced Encryption Standard (AES) encryption algorithm to encrypt the secure access service request carrying the SIM certificate and sends it to the CP. After CP authenticates the SIM certificate carried in the encrypted secure access service request, it generates a temporary key. Using the Advanced Encryption Standard (AES) encryption algorithm, it signs and encrypts the temporary key and CP certificate, and then carries it in the secure access service request response and sends it to the SIM. The SIM verifies the signature of the CP certificate carried in the secure access service request response; The number theory research group encryption algorithm is based on which the certificate provider and the service provider perform two-way session authentication based on their respective certificates, including: CP uses the NTRU encryption algorithm to sign and encrypt the CP certificate and then sends it to the SP; After the SP authenticates the CP certificate, it uses the NTRU encryption algorithm to sign and encrypt the SP certificate and then sends it to the CP; After CP authenticates the SP certificate, it uses the NTRU encryption algorithm to send the generated temporary key to the SP; The SP uses the temporary key and the AES-256 encryption algorithm to generate a session key and sends it to the CP; The number theory research group encryption algorithm is based on which the service provider and mobile network operator are bidirectionally authenticated based on their respective certificates, including: The SP uses the NTRU encryption algorithm to send the SP certificate to the MNO; The MNO authenticates the received SP certificate, uses the NTRU encryption algorithm, and sends the MNO certificate to the SP; The SP authenticates the received MNO certificate and uses the NTRU encryption algorithm to send the encrypted session key to the MNO. The MNO uses the NTRU encryption algorithm to decrypt the received encrypted session key to obtain the session key.

2. The method according to claim 1, characterized in that The use of the Advanced Encryption Standard encryption algorithm to sign and encrypt the temporary key and CP certificate includes: Use the CP private key generated based on the Advanced Encryption Standard encryption algorithm to sign the temporary key and CP certificate to obtain signature information; The signature information is encrypted using the SIM public key generated based on the Advanced Encryption Standard encryption algorithm.

3. The method according to claim 1, characterized in that The SIM verifies the CP certificate carried in the secure access service request response, including: The SIM uses the SIM private key to verify the signature of the secure access service request response, obtains the signature information, uses the CP public key to decrypt the signature information, obtains the temporary key and CP certificate, stores the temporary key, and verifies the CP certificate.

4. The method according to claim 1, wherein The CP uses the NTRU encryption algorithm to sign and encrypt the CP certificate, including: CP uses the CP encryption private key generated by the NTRU encryption algorithm to sign the CP certificate and obtain the CP certificate signature information; The SP encryption public key generated by the NTRU encryption algorithm is used to encrypt the CP certificate signature information.

5. The method according to claim 1, wherein The NTRU encryption algorithm is used to sign and encrypt the SP certificate, including: The SP uses the SP encryption private key generated by the NTRU encryption algorithm to sign the SP certificate and obtain the SP certificate signature information; The CP encryption public key generated by the NTRU encryption algorithm is used to encrypt the SP certificate signature information.

6. The method according to claim 1, characterized in that The encrypted data is sent to the SIM card after being encrypted by the Advanced Encryption Standard (AES) algorithm, so that the SIM card can register with the SP. The encrypted data includes: The MNO uses the AES-256 encryption algorithm to encrypt the session key and send it to the SIM; The SIM uses the AES-256 encryption algorithm to decrypt the received encrypted session key, obtain the session key, and return confirmation information to the MNO; The MNO uses the AES-256 encryption algorithm to return a confirmation response message to the SIM card. The SIM uses the AES-256 encryption algorithm and session key to send a service request to the SP; The SP uses the AES-256 encryption algorithm and session key to return a service request response to the SIM.

7. The method according to claim 1, characterized in that The user identification module encrypts the data to be transmitted using the session key and sends the encrypted data to the service provider, so that the service provider decrypts the received encrypted data to be transmitted according to the session key to obtain the data to be transmitted, including: The SIM uses the Advanced Encryption Standard (AES) encryption algorithm to send a secure session request to the CP, which carries the session key negotiated between the SIM and the SP, as well as the SIM certificate, and performs mutual certificate authentication with the CP. CP uses the encryption algorithm of the Number Theory Research Group to perform NTRU signature on the CP certificate and session key, and mutually authenticate the certificate with the SP; The SP uses the Number Theory Research Group encryption algorithm to sign the SP certificate and session key using NTRU, and performs mutual certificate authentication with the MNO. The MNO signs the MNO certificate and session key based on the Advanced Encryption Standard encryption algorithm, and mutually authenticates the certificate and session key with the SIM; The SIM and SP transmit data based on the session key.

8. A quantum-resistant communication device between a user identification module and a service provider, characterized in that: The device comprises: The first authentication module is used for the user identification module SIM and the certificate provider CP to perform two-way authentication for secure access services based on their respective certificates; The second authentication module is used to perform two-way session authentication on the certificate provider and the service provider SP based on their respective certificates based on the NTRU encryption algorithm of the Number Theory Research Group; The third authentication module is used to perform two-way authentication on the service provider and the mobile network operator (MNO) based on their respective certificates based on the Number Theory Research Group encryption algorithm; The service registration module is used for the mobile network operator to encrypt the session key obtained through two-way authentication with the service provider using the Advanced Encryption Standard encryption algorithm and send it to the user identification module so that the user identification module can register with the service provider; The data transmission module is used for the user identification module to encrypt the data to be transmitted using the session key and send it to the service provider, so that the service provider can decrypt the received encrypted data to be transmitted based on the session key to obtain the data to be transmitted; The first authentication module includes: The encryption unit is used by the SIM to encrypt the security access service request carrying the SIM certificate using the Advanced Encryption Standard encryption algorithm and send it to the CP; A temporary key generation unit is used to generate a temporary key after the CP authenticates the SIM certificate carried in the encrypted secure access service request. The temporary key and the CP certificate are signed and encrypted using the Advanced Encryption Standard encryption algorithm, and then carried in the secure access service request response and sent to the SIM. The signature verification unit is used by the SIM to verify the CP certificate carried in the secure access service request response; The second authentication module is specifically used for: CP uses the NTRU encryption algorithm to sign and encrypt the CP certificate and then sends it to the SP; After the SP authenticates the CP certificate, it uses the NTRU encryption algorithm to sign and encrypt the SP certificate and then sends it to the CP; After CP authenticates the SP certificate, it uses the NTRU encryption algorithm to send the generated temporary key to the SP; The SP uses the temporary key and the AES-256 encryption algorithm to generate a session key and sends it to the CP; The third authentication module is specifically used for: The SP uses the NTRU encryption algorithm to send the SP certificate to the MNO; The MNO authenticates the received SP certificate, uses the NTRU encryption algorithm, and sends the MNO certificate to the SP; The SP authenticates the received MNO certificate and uses the NTRU encryption algorithm to send the encrypted session key to the MNO. The MNO uses the NTRU encryption algorithm to decrypt the received encrypted session key to obtain the session key.

9. The device according to claim 8, characterized in that The temporary key generation unit is specifically used for: Use the CP private key generated based on the Advanced Encryption Standard encryption algorithm to sign the temporary key and CP certificate to obtain signature information; The signature information is encrypted using the SIM public key generated based on the Advanced Encryption Standard encryption algorithm.

10. The device according to claim 8, characterized in that The signature verification unit is specifically used for: The SIM uses the SIM private key to verify the signature of the secure access service request response, obtains the signature information, uses the CP public key to decrypt the signature information, obtains the temporary key and CP certificate, stores the temporary key, and verifies the CP certificate.

11. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the method according to any one of claims 1 to 7 when executed by the processor.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which implements the method according to any one of claims 1 to 7 when executed by a processor.

Images