Data processing method and device based on post quantum cryptography algorithm, equipment and medium

Abstract

The invention relates to the technical field of information security, in particular to a data processing method, device and equipment based on a post quantum cryptography algorithm and a medium, the method comprises the steps that a cryptographic operation request sent through a target external standard interface module is acquired, and the target external standard interface module can support multiple post quantum cryptography algorithms; determining a target post-quantum cryptographic algorithm identifier, a mechanism type and mechanism parameters according to the cryptographic operation request; according to the target post-quantum cryptographic algorithm identifier, the mechanism type and the mechanism parameters, calling a post-quantum cryptographic algorithm implementation module to perform cryptographic operation to obtain an operation result; and returning the operation result through the target external standard interface module. According to the application, the unified external standard interface module capable of supporting multiple post quantum cryptography algorithms is provided to be matched with different algorithms, so that not only is the post quantum cryptography migration process simplified, but also the post quantum cryptography calling process can be simplified.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a data processing method, device, equipment and medium based on a post-quantum cryptographic algorithm. Background Art

[0002] Cryptographic algorithms are the basis for ensuring network communication and data security. With the emergence of quantum computing, classical cryptographic systems will face huge challenges. Among them, public key cryptography based on large integer factorization and discrete logarithm problems will be cracked, and the security of symmetric cryptographic algorithms and hash algorithms will be halved. Post-quantum cryptographic algorithms are new cryptographic schemes that have been theoretically proven to ensure information security in quantum environments. The main technical routes of post-quantum cryptographic algorithms include those based on hashing, coding, multivariate, lattice and homology.

[0003] There are differences in the implementation of various post-quantum cryptographic algorithms, and there are large differences in the interfaces provided to application systems. The integration and transformation of application systems face difficulties such as large differences in post-quantum algorithm equipment, large differences in interfaces, and large workload in the later algorithm replacement, which may lead to complex calls to cryptographic algorithms.

[0004] Therefore, how to simplify the calling of post-quantum cryptographic algorithms has become a technical problem that needs to be urgently solved by technicians in this field. Summary of the invention

[0005] The purpose of this application is to provide a data processing method, device, equipment and medium based on a post-quantum cryptographic algorithm, which can simplify the calling of the post-quantum cryptographic algorithm.

[0006] In a first aspect, a data processing method based on a post-quantum cryptographic algorithm is provided, comprising:

[0007] Acquire a cryptographic operation request sent through a target external standard interface module, wherein the target external standard interface module can support multiple post-quantum cryptographic algorithms;

[0008] Determining a target post-quantum cryptographic algorithm identifier, a mechanism type, and mechanism parameters according to the cryptographic operation request;

[0009] According to the target post-quantum cryptographic algorithm identifier, mechanism type and mechanism parameters, calling the post-quantum cryptographic algorithm implementation module to perform cryptographic operations to obtain operation results;

[0010] The operation result is returned through the target external standard interface module.

[0011] In a preferred example, the present application can be further configured as follows: according to the target post-quantum cryptographic algorithm identifier, mechanism type and mechanism parameters, calling the post-quantum cryptographic algorithm implementation module to perform cryptographic operations to obtain operation results, including:

[0012] Generate algorithm parameters corresponding to the target post-quantum cryptographic algorithm identifier according to the target post-quantum cryptographic algorithm identifier, mechanism type, and mechanism parameters;

[0013] The post-quantum cryptographic algorithm adaptation module interface is called according to the algorithm parameters, so that the post-quantum cryptographic algorithm implementation module uses the target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier to perform cryptographic operations and obtain operation results.

[0014] In a preferred example, the present application can be further configured as follows: calling the post-quantum cryptographic algorithm adaptation module interface according to the algorithm parameters, so that the post-quantum cryptographic algorithm implementation module uses the target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier to perform cryptographic operations, and obtains operation results, including:

[0015] Generate a first call request for a post-quantum cryptography algorithm adaptation module interface according to the algorithm parameters;

[0016] According to the first call request, calling the post-quantum cryptographic algorithm adaptation module interface to perform post-quantum cryptographic algorithm matching to obtain a matching result, and generating a second call request of the post-quantum cryptographic algorithm implementation module according to the matching result;

[0017] According to the second calling request, a cryptographic operation is performed by using a target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier through a post-quantum cryptographic algorithm implementation module.

[0018] In a preferred example, the present application may be further configured as follows: calling the post-quantum cryptographic algorithm adaptation module interface according to the algorithm parameters, so that the post-quantum cryptographic algorithm implementation module performs cryptographic operations using the target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier, and before obtaining the operation result, further comprising:

[0019] Determining the validity of the cryptographic operation request;

[0020] If the cryptographic operation request is invalid, an invalid parameter error prompt message is returned;

[0021] If the cryptographic operation request is valid, the post-quantum cryptographic algorithm adaptation module interface is called according to the algorithm parameters, so that the post-quantum cryptographic algorithm implementation module uses the target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier to perform a cryptographic operation to obtain an operation result.

[0022] In a preferred example, the present application can be further configured as follows: the target external standard interface module is: a SKF external interface module or a PKCS11 external interface module.

[0023] In a preferred example, the present application can be further configured as follows:

[0024] Define multiple post-quantum cryptographic algorithms for the SKF external interface module, set multiple post-quantum cryptographic algorithm identifiers, data structures corresponding to multiple post-quantum cryptographic mechanism types, and adjust the parameters corresponding to the interface to the parameters corresponding to the multiple post-quantum cryptographic mechanism types;

[0025] A variety of post-quantum cryptographic algorithms are defined for the PKCS11 external interface module, and a variety of post-quantum cryptographic algorithm identifiers, a variety of post-quantum cryptographic mechanism types, and data structures corresponding to a variety of post-quantum cryptographic mechanism types are set. The interfaces corresponding to a variety of post-quantum cryptographic mechanism types are PKCS11 standard interfaces.

[0026] In a preferred example, the present application can be further configured as follows: the post-quantum cryptographic algorithm implementation module includes at least one of the following: a software cryptographic module, a cryptographic machine, an intelligent cryptographic key, and an encryption card.

[0027] In a second aspect, a data processing device based on a post-quantum cryptographic algorithm is provided, comprising:

[0028] an acquisition module, configured to acquire a cryptographic operation request sent through a target external standard interface module, wherein the target external standard interface module can support a plurality of post-quantum cryptographic algorithms,

[0029] A determination module, used to determine a target post-quantum cryptographic algorithm identifier, a mechanism type, and mechanism parameters according to the cryptographic operation request;

[0030] A cryptographic operation module, used to call a post-quantum cryptographic algorithm implementation module to perform cryptographic operation to obtain an operation result according to the target post-quantum cryptographic algorithm identifier, mechanism type and mechanism parameters;

[0031] The return module is used to return the operation result through the target external standard interface module.

[0032] In a third aspect, an electronic device is provided, including:

[0033] one or more processors;

[0034] Memory;

[0035] One or more applications, wherein one or more applications are stored in a memory and configured to be executed by one or more processors, and one or more programs are configured to: perform operations corresponding to the method shown in any possible implementation of the first aspect.

[0036] In a fourth aspect, a computer-readable storage medium is provided, wherein the storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, at least one program, a code set or an instruction set is loaded by a processor and executes the steps of the method shown in any possible implementation of the first aspect.

[0037] In a fifth aspect, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, operations corresponding to the method shown in any possible implementation manner in the first aspect are implemented.

[0038] In summary, the method provided by this application includes the following beneficial technical effects:

[0039] In this application, when a cryptographic operation request is received through a target external standard interface module, the target external standard interface module can support multiple post-quantum cryptographic algorithms; according to the cryptographic operation request, the target post-quantum cryptographic algorithm identifier, mechanism type and mechanism parameters are determined; according to the target post-quantum cryptographic algorithm identifier, mechanism type and mechanism parameters, the post-quantum cryptographic algorithm implementation module is called to perform cryptographic operations to obtain operation results; and the operation results are returned through the target external standard interface module. By providing a unified external standard interface module that can support multiple post-quantum cryptographic algorithms and adapt to different algorithms, not only the post-quantum cryptographic migration process is simplified, but also the post-quantum cryptographic calling process can be simplified.

[0040] In addition, the present application also provides a data processing device, equipment and medium based on a post-quantum cryptographic algorithm, all of which have the above-mentioned beneficial technical effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions of the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0042] Figure 1 It is a flowchart of a data processing method based on a post-quantum cryptographic algorithm provided in an embodiment of the present application;

[0043] Figure 2 A schematic diagram of the structure of a cryptographic suite based on a post-quantum cryptographic algorithm provided in an embodiment of the present application;

[0044] Figure 3 A schematic diagram of a data processing flow based on SKF provided in an embodiment of the present application;

[0045] Figure 4A schematic diagram of a data processing flow based on PKCS11 provided in an embodiment of the present application;

[0046] Figure 5 This is a structural block diagram of a data processing device based on a post-quantum cryptographic algorithm in one embodiment of the present application;

[0047] Figure 6 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] This specific embodiment is merely an explanation of the present application and is not a limitation of the present application. After reading this specification, those skilled in the art may make non-creative modifications to the present embodiment as needed, but as long as they are within the scope of the present application, they are protected by the patent law.

[0049] It should be noted that in the optional embodiments of the present application, the object information and other related data involved, when the embodiments in the present application are applied to specific products or technologies, need to obtain the permission or consent of the object, and the collection, use and processing of the relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions. In other words, if the embodiments of the present application involve data related to the object, it needs to be obtained with the authorization and consent of the object, the authorization and consent of the relevant departments, and in compliance with the relevant laws, regulations and standards of the country and region. If personal information is involved in the embodiments, the acquisition of all personal information needs to obtain the consent of the individual. If sensitive information is involved, the separate consent of the information subject needs to be obtained. The embodiments also need to be implemented with the authorization and consent of the object.

[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0051] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.

[0052] The classical cryptographic algorithms in the related art and the post-quantum cryptographic algorithm methods in the related art have the following disadvantages:

[0053] Conventionally, application systems use classical cryptography for network communication and data security protection. However, after the emergence of quantum computers, application systems will face the risk of data and signature information protected by public keys being hacked, and the risk that the security of symmetric cryptographic algorithms and hash algorithms will be halved.

[0054] A series of standard specifications for post-quantum cryptographic algorithms have been initially formed, but there are differences in the implementation of various algorithms, and there are large differences in the interfaces provided to application systems. The integration and transformation of application systems face difficulties such as large differences in post-quantum algorithm equipment, large differences in interfaces, and large workload for replacing algorithms in the later stage.

[0055] Based on this, this application forms a set of systematic post-quantum cryptographic algorithm implementations based on the post-quantum algorithm specifications proposed domestically (the winning algorithm of the National Cryptographic Algorithm Design Competition of the Chinese Cryptography Society) and abroad (NIST-Global Collection of Post-Quantum Cryptography Candidate Standard Algorithms, FIPS203, FIPS204, FPIS205, RFC8391 and BSITR-02102-1 specifications). Post-quantum cryptographic algorithms include but are not limited to the following post-quantum cryptographic algorithms: KYBER, DILITHIUM, FALCON, SPHINCSPLUS, MULAN, AIGIS, AKCN, etc., to provide anti-quantum attack capabilities for application systems. This application provides a unified post-quantum cryptographic algorithm interface for application systems through an external standard interface, reduces the difficulty of integrating and adapting different post-quantum algorithms in application systems, and simplifies the calling of post-quantum cryptographic algorithms.

[0056] Illustratively, the embodiments of the present application shield the differences in the implementation of the underlying post-quantum algorithms according to SKF (GM / T 0016-2023 "Smart Cryptographic Key Cryptographic Application Interface Specification") and PKCS#11 ("PKCS#11 Cryptographic Token Interface Standard" cryptographic token interface standard), provide a unified post-quantum cryptographic algorithm interface for the application system, and reduce the difficulty of integrating and adapting different post-quantum algorithms for the application system; provide an interface based on SKF and PKCS#11 specifications for the application system, which can support commercial cryptographic algorithms (ZUC, SM2, SM3, SM4, SM9) and international cryptographic algorithms (RSA, AES, DES, SHA, etc.). While keeping the cryptographic algorithm interface process unchanged, only some interfaces and parameters need to be modified, thereby reducing the difficulty of post-quantum cryptographic migration of the application system and improving the efficiency of post-quantum cryptographic transformation of the application system.

[0057] Among them, the embodiment of the present application provides a data processing method based on a post-quantum cryptographic algorithm, such as Figure 1 As shown, the method provided in the embodiment of the present application can be executed by an electronic device, and the method includes:

[0058] S101, obtaining a cryptographic operation request sent through a target external standard interface module, where the target external standard interface module can support multiple post-quantum cryptographic algorithms;

[0059] Among them, the target external standard interface module includes but is not limited to SKF interface module, PKCS#11 interface module, SDF interface module and other interface modules, and standard interface modules that meet user needs can also be customized. The embodiment of the present application does not make specific limitations on this.

[0060] In one implementable manner, the target external standard interface module is: an SKF external interface module or a PKCS11 external interface module.

[0061] Define multiple post-quantum cryptographic algorithms for the SKF external interface module, set multiple post-quantum cryptographic algorithm identifiers, data structures corresponding to multiple post-quantum cryptographic mechanism types, and adjust the parameters corresponding to the interface to the parameters corresponding to the multiple post-quantum cryptographic mechanism types;

[0062] A variety of post-quantum cryptographic algorithms are defined for the PKCS11 external interface module, and a variety of post-quantum cryptographic algorithm identifiers, a variety of post-quantum cryptographic mechanism types, and data structures corresponding to a variety of post-quantum cryptographic mechanism types are set. The interfaces corresponding to a variety of post-quantum cryptographic mechanism types are PKCS11 standard interfaces.

[0063] Among them, post-quantum cryptographic algorithms include but are not limited to the following post-quantum cryptographic algorithms: KYBER, DILITHIUM, FALCON, SPHINCSPLUS, MULAN, AIGIS, AKCN, etc.

[0064] For the SKF external interface module, the application system is provided with an SKF external interface module that complies with GM / T 0016-2023 "Intelligent Password Key Password Application Interface Specification", and new post-quantum cryptographic algorithm identifiers are added: SGDE_PQC_KYBER, SGDE_PQC_DILITHIUM, SGDE_PQC_FALCON, SGDE_PQC_SPHINCSPLUS, SGDE_PQC_MULAN, SGDE_PQC_AIGIS, SGDE_PQC_AKCN, etc.; new post-quantum public key data structure: PQCPUBLICKEYBLOB, new post-quantum signature data structure: PQCSIGNATUREBLOB, new post-quantum Sub-ciphertext data structure: PQCCIPHERBLOB, new post-quantum key encapsulation parameter data structure: PQCDERIVEKEYPARAMS; new post-quantum key pair generation interface: SKFE_GenPQCKeyPair, new post-quantum signature operation interface: SKFE_PQCSign, new post-quantum signature verification operation interface: SKFE_PQCVerify, new post-quantum encryption operation interface: SKFE_PQCEncrypt, new post-quantum decryption operation interface: SKFE_PQCDecrypt, new post-quantum key encapsulation operation interface: SKFE_PQCDeriveKey.

[0065] Based on the specifications, the SKF external interface module has added many new identifiers for post-quantum cryptographic algorithms. According to SKF, it generally only supports the original commercial cryptographic algorithms. When a post-quantum cryptographic algorithm needs to be added, the corresponding interface needs to be added. Therefore, a new post-quantum key pair generation interface, a new post-quantum signature operation interface, a new post-quantum signature verification operation interface, a new post-quantum encryption operation interface, a new post-quantum decryption operation interface, and a new post-quantum key encapsulation operation interface are added to distinguish between multiple post-quantum cryptographic algorithms through parameters.

[0066] For the PKCS11 external interface module, an interface that complies with the "PKCS#11 Cryptographic TokenInterface Standard" is provided for the application system. New post-quantum key types are added: CKK_PQC_KYBER, CKK_PQC_DILITHIUM, CKK_PQC_FALCON, CKK_PQC_SPHINCSPLUS, CKK_PQC_MULAN, CKK_PQC_AIGIS, CKK_PQC_AKCN, etc. New post-quantum cryptographic mechanism types are added: CKM_PQC_KYBER, CKM_PQC_DILITHIUM, CKM_PQC_FALCON, CKM_PQC_SPHINCSPLUS, CKM_PQC_MULAN, CKM_PQC_AIGIS, CKM_PQC_AKCN, and new mechanism data structures are added: CK_PQC_KYBER_PARAMS, CK_PQC_DIL ITHIUM_PARAMS, CK_PQC_FALCON_PARAMS, CK_PQC_SPHINCSPLUS_PARAMS, CK_PQC_MULAN_PARAMS, CK_PQC_AIGIS_PARAMS, CK_PQC_AKCN_PARAMS, there is no need to add new interfaces to generate post-quantum key pairs, signature operations, signature verification operations, encryption operations, decryption operations, key encapsulation, etc., use the PKCS11 standard interface: C_GenerateKeyPair, C_SignInit, C_Sign, C_VerifyInit, C_Verify, C_EncryptInit, C_Encrypt, C_DecryptInit, C_Decrypt, C_DeriveKey.

[0067] For PKCS11, the parameters are more flexible. You can keep the interface unchanged without adding or changing anything. You only need to add a new mechanism type and a data structure of the mechanism type and use the standard interface.

[0068] Compared with the related art, when the application system calls the cryptographic algorithm, due to the differences in the implementation of various algorithms and the large differences in the interfaces provided to the application system, the calling problem may be complicated, and a large number of adaptation processes are required during the calling. In the embodiment of the present application, by providing a unified interface module, not only the post-quantum cryptographic migration process is simplified, but also the post-quantum cryptographic calling process can be simplified.

[0069] S102. Determine the target post-quantum cryptographic algorithm identifier, mechanism type, and mechanism parameters according to the cryptographic operation request;

[0070] In the embodiment of the present application, the cryptographic operation request carries the target post-quantum cryptographic algorithm identifier, mechanism type and mechanism parameters. Among them, the target post-quantum cryptographic algorithm identifier is the identifier requested for uniquely identifying the selected post-quantum cryptographic algorithm. The mechanism type indicates the specific method of the requested cryptographic operation, such as encryption mechanism, signature mechanism, etc. Mechanism parameters refer to the parameters required when executing a specific mechanism.

[0071] Parse the algorithm field, mechanism type field, and mechanism parameter field in the cryptographic operation request. The algorithm field contains the unique identifier of the algorithm. The target post-quantum cryptographic algorithm identifier is determined by looking up the correspondence table between the algorithm identifier and the post-quantum cryptographic algorithm. The mechanism type field specifies the required cryptographic operation method. The mechanism parameter field may provide specific parameter settings in the form of key-value pairs.

[0072] S103, according to the target post-quantum cryptographic algorithm identifier, mechanism type and mechanism parameters, calling the post-quantum cryptographic algorithm implementation module to perform cryptographic operation to obtain an operation result;

[0073] In an embodiment of the present application, an implementation module of a corresponding target post-quantum cryptographic algorithm is determined by a target post-quantum cryptographic algorithm identifier, so as to implement cryptographic operations through a mechanism type and mechanism parameters.

[0074] The post-quantum cryptographic algorithm implementation module includes at least one of the following: a software cryptographic module, a cryptographic machine, an intelligent cryptographic key, and an encryption card.

[0075] S104. Return the operation result through the target external standard interface module.

[0076] It can be seen that in the embodiment of the present application, when a cryptographic operation request is received through the target external standard interface module, the target external standard interface module can support multiple post-quantum cryptographic algorithms; according to the cryptographic operation request, the target post-quantum cryptographic algorithm identifier, mechanism type and mechanism parameters are determined; according to the target post-quantum cryptographic algorithm identifier, mechanism type and mechanism parameters, the post-quantum cryptographic algorithm implementation module is called to perform cryptographic operations to obtain operation results; and the operation results are returned through the target external standard interface module. By providing a unified external standard interface module that can support multiple post-quantum cryptographic algorithms and adapt to different algorithms, not only the post-quantum cryptographic migration process is simplified, but also the post-quantum cryptographic calling process can be simplified.

[0077] In one possible embodiment, see Figure 2 , Figure 2 A structural diagram of a cryptographic suite based on a post-quantum cryptographic algorithm provided in an embodiment of the present application, wherein the cryptographic suite is divided into four modules: an external interface module, an interface implementation module, a post-quantum cryptographic algorithm adaptation module, and a post-quantum cryptographic algorithm implementation module.

[0078] As for the external interface module, it includes: SKF external interface module and PKCS11 external interface module. For details, please refer to the above embodiments, which will not be elaborated in this section.

[0079] The interface implementation module includes: SKF interface implementation module and PKCS11 interface implementation module.

[0080] Among them, the SKF interface implementation module, by combining the SKF data structure to parse the algorithm identifier and related parameters passed in by the SKF external interface module, converts them into parameters corresponding to the post-quantum cryptographic algorithm, and then calls the lower-level post-quantum cryptographic algorithm adaptation module to implement the corresponding post-quantum cryptographic algorithm interface, including: SKFE_GenPQCKeyPair, SKFE_PQCSign, SKFE_PQCVerify, SKFE_PQCEncrypt, SKFE_PQCDecrypt, SKFE_PQCDeriveKey. In the embodiment of the present application, the corresponding algorithm is called through the same post-quantum cryptographic algorithm interface through different parameters.

[0081] The PKCS11 interface implementation module, by combining the PKCS11 data structure, parses the key type, mechanism type, and mechanism parameters passed in by the PKCS11 external interface module, calls the lower-level post-quantum cryptographic algorithm adaptation module, and implements the corresponding post-quantum cryptographic algorithm interface, including: C_GenerateKeyPair, C_SignInit, C_Sign, C_VerifyInit, C_Verify, C_EncryptInit, C_Encrypt, C_DecryptInit, C_Decrypt, and C_DeriveKey.

[0082] For the post-quantum cryptographic algorithm adaptation module, the differences in the underlying post-quantum algorithm implementation modules are shielded, and a unified post-quantum algorithm resource management and cryptographic operation interface is provided for the SKF and PKCS11 interface implementation layers, including: resource initialization cm_pqc_init, resource release cm_pqc_final, generation of post-quantum key pairs cm_pqc_generate_key_pair, signature operation cm_pqc_sign, signature verification operation cm_pqc_verify, encryption operation cm_pqc_encrypt, decryption operation cm_pqc_decrypt, and key encapsulation operation cm_pqc_derive_key.

[0083] It is understandable that, on the top, only the external interface provided to the outside is displayed, and then the parameters are passed down according to the data structure of the interface; the parameters are parsed. On the bottom, multiple post-quantum cryptographic algorithms called by the bottom layer have added adapter modules, and only the adapter modules need to be called. Among them, the adapter module encapsulates the interfaces of various specifications and various manufacturers into a unified interface.

[0084] Modules for implementing post-quantum cryptographic algorithms. According to the post-quantum algorithm specifications proposed in China (the winning algorithm of the National Cryptographic Algorithm Design Competition of the Chinese Cryptography Society) and abroad (NIST-Global Collection of Post-Quantum Cryptography Candidate Standard Algorithms, FIPS203, FIPS204, FPIS205, RFC8391 and BSITR-02102-1 specifications), post-quantum cryptographic algorithms are implemented. The implemented modules include but are not limited to the following post-quantum cryptographic algorithm devices / modules: software cryptographic modules, cryptographic machines, smart cryptographic keys (USBKEY), encryption cards (PCIE), etc.

[0085] Based on the structure and function of this post-quantum cryptographic suite, in a possible implementation method of an embodiment of the present application, according to the target post-quantum cryptographic algorithm identifier, mechanism type and mechanism parameters, a post-quantum cryptographic algorithm implementation module is called to perform cryptographic operations to obtain operation results, including: generating algorithm parameters corresponding to the target post-quantum cryptographic algorithm identifier according to the target post-quantum cryptographic algorithm identifier, mechanism type and mechanism parameters; calling the post-quantum cryptographic algorithm adaptation module interface according to the algorithm parameters, so that the post-quantum cryptographic algorithm implementation module uses the target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier to perform cryptographic operations to obtain operation results.

[0086] Algorithm parameters refer to a set of specific parameter values ​​or configuration information generated based on the target post-quantum cryptographic algorithm identifier, mechanism type, and mechanism parameters, which are used for the execution of the algorithm.

[0087] In an achievable implementation, the post-quantum cryptographic algorithm adaptation module interface is called according to the algorithm parameters, so that the post-quantum cryptographic algorithm implementation module uses the target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier to perform cryptographic operations, and obtains operation results, including:

[0088] Generate a first call request for the post-quantum cryptography algorithm adaptation module interface according to the algorithm parameters;

[0089] According to the first call request, call the post-quantum cryptographic algorithm adaptation module interface to perform post-quantum cryptographic algorithm matching to obtain a matching result, and generate a second call request of the post-quantum cryptographic algorithm implementation module according to the matching result;

[0090] According to the second call request, a cryptographic operation is performed by using a target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier through a post-quantum cryptographic algorithm implementation module.

[0091] Among them, according to the algorithm parameters, the first call request of the post-quantum cryptographic algorithm adapter module interface is constructed. At this time, this first call request can call the adapter module for matching operations, and the external display is still processed through a unified interface. Through algorithm matching, the post-quantum cryptographic algorithm implementation module that matches the request parameters is found, and the algorithm parameters are given to generate a second call request corresponding to the algorithm. Then, according to the second call request, the post-quantum cryptographic algorithm implementation module uses the target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier to perform cryptographic operations.

[0092] In the embodiment of the present application, through the encapsulation of two requests, the post-quantum cryptographic algorithm adaptation module interface can receive a unified call request, and then, through the second encapsulation, the call of a specific algorithm is implemented, and only one unified interface can be exposed. Developers or users do not need to understand the underlying implementation details when using it, but only need to focus on how to use the interface, thereby improving ease of use; at the same time, when the underlying multi-type post-quantum cryptographic algorithm sends changes, it is only necessary to modify the relevant parameters of the underlying layer without changing the upper-layer application.

[0093] Furthermore, in order to avoid unnecessary processing of illegal or invalid requests, thereby saving computing resources and time, in an achievable manner, the post-quantum cryptographic algorithm adaptation module interface is called according to the algorithm parameters, so that the post-quantum cryptographic algorithm implementation module uses the target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier to perform cryptographic operations, and before obtaining the operation results, it also includes:

[0094] Determining the validity of a cryptographic operation request;

[0095] If the cryptographic operation request is invalid, an invalid parameter error message is returned;

[0096] If the cryptographic operation request is valid, the post-quantum cryptographic algorithm adaptation module interface is called according to the algorithm parameters, so that the post-quantum cryptographic algorithm implementation module uses the target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier to perform cryptographic operations and obtain operation results.

[0097] Determining the validity of the cryptographic operation request includes: determining at least one of whether the input parameter contains a null pointer, whether the input algorithm identifier is correct, whether the input data length is correct, and whether the length of the received output data is correct.

[0098] Based on any of the above embodiments, a data processing flow based on SKF and a data processing flow based on PKCS11 are provided.

[0099] For example, see Figure 3 , Figure 3 A schematic diagram of a data processing flow based on SKF provided in an embodiment of the present application includes (11)-(16), wherein:

[0100] (11) Initiate a post-quantum cryptographic operation request by calling the SKF post-quantum cryptographic operation interface provided by the post-quantum cryptographic suite. The post-quantum cryptographic operation request includes: the target post-quantum cryptographic algorithm identifier, the mechanism type, and the mechanism parameters. The mechanism type includes but is not limited to generating post-quantum key pairs SKFE_GenPQCKeyPair, post-quantum signature operation SKFE_PQCSign, post-quantum signature verification operation SKFE_PQCVerify, post-quantum encryption operation SKFE_PQCEncrypt, post-quantum decryption operation SKFE_PQCDecrypt, and post-quantum key encapsulation operation SKFE_PQCDeriveKey. The pseudo-function definitions corresponding to each mechanism type are as follows:

[0101] A1) The pseudo function for generating post-quantum key pairs is defined as:

[0102] SKFE_GenPQCKeyPair(

[0103] hContainer,

[0104] ulAlgId,

[0105] pBlob )

[0107] Input parameters:

[0108] hContainer: key container handle.

[0109] ulAlgId: algorithm identifier.

[0110] Output parameters:

[0111] pBlob: Returns the public key data structure.

[0112] A2) The post-quantum signature operation pseudo function is defined as:

[0113] SKFE_PQCSign(

[0114] hContainer,

[0115] pbData,

[0116] ulDataLen,

[0117] pSignature )

[0119] Input parameters:

[0120] hContainer: key container handle.

[0121] pbData: data to be signed.

[0122] ulDataLen: length of the data to be signed.

[0123] Output parameters:

[0124] pSignature: the returned signature value.

[0125] A3) The post-quantum signature operation pseudo function is defined as:

[0126] SKFE_PQCVerify(

[0127] hDev,

[0128] pPQCPubKeyBlob,

[0129] pbData,

[0130] ulDataLen,

[0131] pSignature,

[0132] pResult )

[0134] Input parameters:

[0135] hDev: key container handle.

[0136] pPQCPubKeyBlob: PQC public key data structure.

[0137] pbData: data whose signature is to be verified.

[0138] ulDataLen: The length of the data whose signature is to be verified.

[0139] pSignature: signature value to be verified.

[0140] Output parameters:

[0141] pResult: signature verification result.

[0142] A4) The post-quantum encryption pseudo function is defined as:

[0143] SKFE_PQCEncrypt(

[0144] hDev,

[0145] pPQCPubKeyBlob,

[0146] pbPlainText,

[0147] ulPlainTextLen,

[0148] pCipherText)

[0149] Input parameters:

[0150] hDev: key container handle.

[0151] pPQCPubKeyBlob: PQC public key data structure.

[0152] pbPlainText: data to be encrypted.

[0153] ulPlainTextLen: length of the data to be encrypted.

[0154] Output parameters:

[0155] pCipherText: the returned ciphertext data.

[0156] A5) The post-quantum decryption operation pseudo function is defined as:

[0157] SKFE_PQCDecrypt(

[0158] hContainer,

[0159] pCipherText,

[0160] pbPlainText,

[0161] ulPlainTextLen )

[0163] Input parameters:

[0164] hContainer: key container handle.

[0165] pCipherText: ciphertext data.

[0166] Output parameters:

[0167] pbPlainText: decrypted plaintext data.

[0168] ulPlainTextLen: The length of the decrypted plaintext data.

[0169] A6) The post-quantum key encapsulation operation pseudo function is defined as:

[0170] SKFE_PQCDeriveKey(

[0171] pPQCDeriveKeyParams,

[0172] phKey )

[0174] Input parameters:

[0175] pPQCDeriveKeyParams: key encapsulation parameter data structure.

[0176] Output parameters:

[0177] phKey: The key handle after decapsulation.

[0178] (12) Check the validity of the post-quantum cryptographic operation request parameters, including whether the input pointer is NULL and whether the input algorithm identifier ulAlgID is valid. If the parameters are valid, continue to call the post-quantum cryptographic algorithm adapter module interface corresponding to the ulAlgID parameter. If the parameters are illegal, return an invalid parameter error and end the post-quantum cryptographic operation request.

[0179] (13) Set the SKF data structure, including: device handle, container handle, key handle, etc. According to the relevant parameters of ulAlgID input by the process and the SKF data structure, initiate a post-quantum algorithm adaptation module interface call request. The mechanism types in the call request include: generating post-quantum key pairs, signature operation, signature verification operation, encryption operation, decryption operation, and key encapsulation;

[0180] (14) The post-quantum cryptographic algorithm adaptation module matches the post-quantum cryptographic algorithm according to the call request of (13) and initiates a post-quantum cryptographic algorithm implementation module interface request;

[0181] (15) The post-quantum cryptographic algorithm implementation module completes the corresponding post-quantum cryptographic operation according to the request of process (14);

[0182] (16) After the post-quantum cryptographic algorithm implementation module completes the post-quantum cryptographic operation, it returns the result of the post-quantum cryptographic operation.

[0183] For example, see Figure 4 , Figure 4 A schematic diagram of a data processing flow based on PKCS11 provided in an embodiment of the present application includes (21)-(27), wherein:

[0184] (21) Initiate a post-quantum cryptographic operation request by calling the PKCS11 post-quantum cryptographic operation interface provided by the post-quantum cryptographic suite. The request includes the mechanism type, which includes: generating post-quantum key pairs C_GenerateKeyPair, post-quantum signature operations C_SignInit and C_Sign, post-quantum signature verification operations C_VerifyInit and C_Verify, post-quantum encryption operations C_EncryptInit and C_Encrypt, post-quantum decryption operations C_DecryptInit and C_Decrypt, and post-quantum key encapsulation operations C_DeriveKey. All of them are PKCS11 standard interfaces and do not require extended definition.

[0185] (22) Check the validity of the post-quantum cryptographic operation request parameters, including whether the input pointer is NULL, the input key type CKA_KEY_TYPE, the mechanism type mechanism, and the mechanism parameter pParameter. If the parameters are valid, continue to call the post-quantum cryptographic algorithm adaptation module interface corresponding to the mechanism parameter. If the parameters are illegal, return an invalid parameter error and end the post-quantum cryptographic operation request.

[0186] (23) Set up PKCS11 data structures, including: device data structure, session data structure, object data structure, object attribute data structure, mechanism data structure, etc. According to the mechanism type parameter input in process (21), initiate a post-quantum algorithm adaptation module interface call request, including: generating a post-quantum key pair, signing operation, signature verification operation, encryption operation, decryption operation, and key encapsulation;

[0187] (24) According to the PKCS11 data structure set in process (23) and the mechanism type parameter input in process (21), perform cryptographic operation initialization and cryptographic operation, and initiate a post-quantum algorithm adaptation module interface call request;

[0188] (25) The post-quantum cryptographic algorithm adaptation module matches the post-quantum cryptographic algorithm according to the call request of process (24) and initiates a post-quantum cryptographic algorithm implementation module interface request;

[0189] (26) The post-quantum cryptographic algorithm implementation module completes the corresponding post-quantum cryptographic operation according to the interface request of process (25);

[0190] (27) After the post-quantum cryptographic algorithm implementation module completes the post-quantum cryptographic operation, it returns the result of the post-quantum cryptographic operation.

[0191] In summary, the method proposed in the embodiment of the present application, based on the post-quantum algorithm specifications proposed in China (the winning algorithm of the National Cryptographic Algorithm Design Competition of the Chinese Society of Cryptography) and abroad (NIST-Global Collection of Post-Quantum Cryptography Candidate Standard Algorithms, FIPS203, FIPS204, FPIS205, RFC8391 and BSITR-02102-1 specifications), constructs a systematic post-quantum cryptographic algorithm capability, including but not limited to the following post-quantum cryptographic algorithms: KYBER, DILITHIUM, FALCON, SPHINCSPLUS, MULAN, AIGIS, AKCN, etc., to provide anti-quantum attack capabilities for the application system;

[0192] Based on the SKF and PKCS#11 specification interface, it provides a unified post-quantum cryptographic algorithm interface for the application system, shielding the differences in the underlying post-quantum algorithm implementation, and reducing the difficulty of integrating and adapting different post-quantum algorithms in the application system;

[0193] By using the post-quantum cryptographic algorithm adaptation module, the problem of algorithm diversification and interface differentiation of the underlying post-quantum cryptographic module / device can be solved by adding post-quantum cryptographic algorithm parameters;

[0194] Supported post-quantum cryptographic modules include but are not limited to: software cryptographic modules, cryptographic machines, smart cryptographic keys (USBKEY), encryption cards (PCIE), etc.

[0195] To support commercial cryptographic algorithms (ZUC, SM2, SM3, SM4, SM9) and international cryptographic algorithms (RSA, AES, DES, SHA, etc.), only some interfaces and parameters need to be modified while keeping the cryptographic algorithm interface process unchanged, which reduces the difficulty of post-quantum cryptographic migration of application systems and improves the efficiency of post-quantum cryptographic transformation of application systems;

[0196] A device provided in an embodiment of the present application is introduced below. The device described below and the method described above can be referred to each other. The device 500 of this embodiment is set in an electronic device. Figure 5 , Figure 5 This is a structural block diagram of a data processing device based on a post-quantum cryptographic algorithm in one embodiment of the present application, including:

[0197] The acquisition module 510 is used to acquire the cryptographic operation request sent through the target external standard interface module, where the target external standard interface module can support multiple post-quantum cryptographic algorithms.

[0198] A determination module 520, configured to determine a target post-quantum cryptographic algorithm identifier, a mechanism type, and mechanism parameters according to a cryptographic operation request;

[0199] The cryptographic operation module 530 is used to call the post-quantum cryptographic algorithm implementation module to perform cryptographic operation to obtain an operation result according to the target post-quantum cryptographic algorithm identifier, mechanism type and mechanism parameters;

[0200] The return module 540 is used to return the operation result through the target external standard interface module.

[0201] In one achievable manner, the cryptographic operation module 530 includes:

[0202] A generating unit, configured to generate an algorithm parameter corresponding to a target post-quantum cryptographic algorithm identifier according to the target post-quantum cryptographic algorithm identifier, the mechanism type, and the mechanism parameters;

[0203] The operation unit is used to call the post-quantum cryptographic algorithm adaptation module interface according to the algorithm parameters, so that the post-quantum cryptographic algorithm implementation module uses the target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier to perform cryptographic operations and obtain operation results.

[0204] In one achievable manner, the computing unit is used to:

[0205] A first call request generating subunit, used to generate a first call request of the post-quantum cryptography algorithm adaptation module interface according to the algorithm parameters;

[0206] A second call request generating subunit is used to call the post-quantum cryptographic algorithm adaptation module interface to perform post-quantum cryptographic algorithm matching to obtain a matching result according to the first call request, and generate a second call request of the post-quantum cryptographic algorithm implementation module according to the matching result;

[0207] The operator unit is used to perform cryptographic operation using the target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier through the post-quantum cryptographic algorithm implementation module according to the second call request.

[0208] In one achievable manner, the present invention further includes:

[0209] A validity judgment module is used to determine the validity of the cryptographic operation request; if the cryptographic operation request is invalid, the prompt module is triggered, and if the cryptographic operation request is valid, the operation unit is triggered;

[0210] Prompt module, used to return invalid parameter error prompt information.

[0211] In one implementable manner, the target external standard interface module is: an SKF external interface module or a PKCS11 external interface module.

[0212] In one achievable manner, the present invention further includes:

[0213] The first setting module is used to define multiple post-quantum cryptographic algorithms for the SKF external interface module, set multiple post-quantum cryptographic algorithm identifiers, data structures corresponding to multiple post-quantum cryptographic mechanism types, and adjust the parameters corresponding to the interface to the parameters corresponding to the multiple post-quantum cryptographic mechanism types;

[0214] The second setting module is used to define multiple post-quantum cryptographic algorithms for the PKCS11 external interface module, set multiple post-quantum cryptographic algorithm identifiers, multiple post-quantum cryptographic mechanism types and multiple data structures corresponding to each post-quantum cryptographic mechanism type, and the interface corresponding to each of the multiple post-quantum cryptographic mechanism types is the PKCS11 standard interface.

[0215] In one achievable manner, the post-quantum cryptographic algorithm implementation module includes at least one of the following: a software cryptographic module, a cryptographic machine, an intelligent cryptographic key, and an encryption card.

[0216] An electronic device is provided in an embodiment of the present application, such as Figure 6 As shown, Figure 6 The electronic device 600 shown includes: a processor 601 and a memory 603. The processor 601 and the memory 603 are connected, such as through a bus 602. Optionally, the electronic device 600 may also include a transceiver 604. It should be noted that in actual applications, the transceiver 604 is not limited to one, and the structure of the electronic device 600 does not constitute a limitation on the embodiments of the present application.

[0217] Processor 601 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 601 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0218] The bus 602 may include a path to transmit information between the above components. The bus 602 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 602 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0219] The memory 603 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0220] The memory 603 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 601. The processor 601 is used to execute the application code stored in the memory 603 to implement the contents shown in the above method embodiment.

[0221] Figure 6 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0222] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding content in the aforementioned method embodiment.

[0223] An embodiment of the present application provides a computer program product, including a computer program, which implements the corresponding contents of the aforementioned method embodiment when the computer program is executed by a processor.

[0224] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0225] The above are only some implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data processing method based on a post-quantum cryptographic algorithm, characterized in that: include: Acquire a cryptographic operation request sent through a target external standard interface module, wherein the target external standard interface module can support multiple post-quantum cryptographic algorithms; Determining a target post-quantum cryptographic algorithm identifier, a mechanism type, and mechanism parameters according to the cryptographic operation request; According to the target post-quantum cryptographic algorithm identifier, mechanism type and mechanism parameters, calling the post-quantum cryptographic algorithm implementation module to perform cryptographic operations to obtain operation results; The operation result is returned through the target external standard interface module.

2. The data processing method based on the post-quantum cryptographic algorithm according to claim 1 is characterized in that: According to the target post-quantum cryptographic algorithm identifier, mechanism type and mechanism parameters, calling the post-quantum cryptographic algorithm implementation module to perform cryptographic operations to obtain operation results, including: Generate algorithm parameters corresponding to the target post-quantum cryptographic algorithm identifier according to the target post-quantum cryptographic algorithm identifier, mechanism type, and mechanism parameters; The post-quantum cryptographic algorithm adaptation module interface is called according to the algorithm parameters, so that the post-quantum cryptographic algorithm implementation module uses the target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier to perform cryptographic operations and obtain operation results.

3. The data processing method based on the post-quantum cryptographic algorithm according to claim 2 is characterized in that: The post-quantum cryptographic algorithm adaptation module interface is called according to the algorithm parameters, so that the post-quantum cryptographic algorithm implementation module uses the target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier to perform cryptographic operations, and obtains operation results, including: Generate a first call request for a post-quantum cryptography algorithm adaptation module interface according to the algorithm parameters; According to the first call request, calling the post-quantum cryptographic algorithm adaptation module interface to perform post-quantum cryptographic algorithm matching to obtain a matching result, and generating a second call request of the post-quantum cryptographic algorithm implementation module according to the matching result; According to the second calling request, a cryptographic operation is performed by using a target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier through a post-quantum cryptographic algorithm implementation module.

4. The data processing method based on the post-quantum cryptographic algorithm according to claim 2 is characterized in that: The post-quantum cryptographic algorithm adaptation module interface is called according to the algorithm parameters, so that the post-quantum cryptographic algorithm implementation module uses the target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier to perform cryptographic operations, and before obtaining the operation result, it also includes: Determining the validity of the cryptographic operation request; If the cryptographic operation request is invalid, an invalid parameter error prompt message is returned; If the cryptographic operation request is valid, the post-quantum cryptographic algorithm adaptation module interface is called according to the algorithm parameters, so that the post-quantum cryptographic algorithm implementation module uses the target post-quantum cryptographic algorithm corresponding to the target post-quantum cryptographic algorithm identifier to perform a cryptographic operation to obtain an operation result.

5. The data processing method based on the post-quantum cryptographic algorithm according to any one of claims 1 to 4, characterized in that: The target external standard interface module is: SKF external interface module or PKCS11 external interface module.

6. The data processing method based on the post-quantum cryptographic algorithm according to claim 5 is characterized in that: Also includes: Define multiple post-quantum cryptographic algorithms for the SKF external interface module, set multiple post-quantum cryptographic algorithm identifiers, data structures corresponding to multiple post-quantum cryptographic mechanism types, and adjust the parameters corresponding to the interface to the parameters corresponding to the multiple post-quantum cryptographic mechanism types; A variety of post-quantum cryptographic algorithms are defined for the PKCS11 external interface module, and a variety of post-quantum cryptographic algorithm identifiers, a variety of post-quantum cryptographic mechanism types, and data structures corresponding to a variety of post-quantum cryptographic mechanism types are set. The interfaces corresponding to a variety of post-quantum cryptographic mechanism types are PKCS11 standard interfaces.

7. The data processing method based on the post-quantum cryptographic algorithm according to claim 1 is characterized in that: The post-quantum cryptographic algorithm implementation module includes at least one of the following: a software cryptographic module, a cryptographic machine, an intelligent cryptographic key, and an encryption card.

8. A data processing device based on a post-quantum cryptographic algorithm, characterized in that: include: an acquisition module, configured to acquire a cryptographic operation request sent through a target external standard interface module, wherein the target external standard interface module can support a plurality of post-quantum cryptographic algorithms, A determination module, used to determine a target post-quantum cryptographic algorithm identifier, a mechanism type, and mechanism parameters according to the cryptographic operation request; A cryptographic operation module, used to call a post-quantum cryptographic algorithm implementation module to perform cryptographic operation to obtain an operation result according to the target post-quantum cryptographic algorithm identifier, mechanism type and mechanism parameters; The return module is used to return the operation result through the target external standard interface module.

9. An electronic device, characterized in that: include: one or more processors; Memory; One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more applications are configured to: execute the steps of the data processing method based on the post-quantum cryptographic algorithm according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, at least one program, a code set or an instruction set is loaded by a processor and executes the steps of the data processing method based on the post-quantum cryptographic algorithm according to any one of claims 1 to 7.

Images