Quantum network data encryption method, system and device based on cryptographic algorithm

Abstract

The embodiment of the invention provides a quantum network data encryption method, system and device based on a cryptographic algorithm, which are applied to a network management center, and the method comprises the following steps: carrying out session key negotiation with a proxy server to obtain a session key; the quantum network data comprises a data plaintext and a data ciphertext, and the data ciphertext is obtained by encrypting the data plaintext through the session key, so that the proxy server verifies the data plaintext through the data ciphertext, and after the data plaintext passes verification, the quantum network data is sent to the proxy server; and the quantum network equipment is controlled according to the control instruction indicated by the data plaintext, so that the security of data interaction among the network management center, the proxy server and the quantum network equipment can be protected through an encryption technology in the quantum network.

Description

Technical Field

[0001] The present invention relates to the technical field of quantum secure communication, and in particular to a quantum network data encryption method, system and device based on a cryptographic algorithm. Background Art

[0002] With the continuous development of quantum communication technology and the application of quantum key distribution technology, the construction scale and service scope of quantum networks are also expanding, and more and more quantum service-related equipment needs to be managed and maintained. In order to cope with the current attacks of quantum computers, it is necessary to ensure the security of data in quantum networks from multiple angles, such as key management, device control, data transmission, etc. With the continuous development of quantum computing technology, how to protect the security of the data interaction process between the network management center and devices of the quantum network in practical applications and provide the system with anti-quantum capabilities has become one of the key issues that need to be solved. Summary of the invention

[0003] In order to solve the above problems, the embodiments of the present invention disclose a quantum network data encryption method, device, electronic device and storage medium based on a cryptographic algorithm.

[0004] In a first aspect, an embodiment of the present invention provides a quantum network data encryption method based on a cryptographic algorithm, which is applied to a network management center, and the method includes:

[0005] Negotiate the session key with the proxy server to obtain the session key;

[0006] Send quantum network data to the proxy server, the quantum network data including plaintext data and ciphertext data, the ciphertext data being obtained by encrypting the plaintext data by the session key, so that the proxy server verifies the plaintext data by the ciphertext data, and controls the quantum network device according to the control instruction indicated by the plaintext data after the plaintext data is verified.

[0007] Optionally, the performing session key negotiation with the proxy server to obtain the session key includes:

[0008] Generate a first negotiation key by using the cryptographic algorithm and a second key corresponding to the proxy server, and generate a key negotiation request according to the first negotiation key;

[0009] Sending a key negotiation request to the proxy server, so that the proxy server returns a key negotiation request response according to the first key corresponding to the network management center and the first negotiated key;

[0010] Verifying the first negotiated key according to the key negotiation request response;

[0011] After the first negotiated key is verified, the first negotiated key is used as a session key.

[0012] Optionally, before performing session key negotiation with the proxy server, the method further includes:

[0013] Performing identity authentication with the proxy server;

[0014] The step of negotiating a session key with the proxy server includes:

[0015] After identity authentication is performed with the proxy server, session key negotiation is performed with the proxy server.

[0016] Optionally, the second key includes a second PQC encryption key (a second post-quantum cryptographic encryption key) and a second SM2 encryption key (a second elliptic curve cryptographic encryption key); the cryptographic algorithm includes an SM2 algorithm (elliptic curve cryptographic algorithm), a PQC algorithm (post-quantum cryptographic algorithm) and an SM3 algorithm (cryptographic hash algorithm); the generating a first negotiation key by using the cryptographic algorithm and the second key corresponding to the proxy server, and generating a key negotiation request according to the first negotiation key, includes:

[0017] Generate the first negotiated key by using the public key of the second PQC encryption key and the PQC algorithm;

[0018] Obtaining a first random number corresponding to the network management center;

[0019] Encrypt the first random number using the public key of the second SM2 encryption key and the SM2 algorithm to obtain a first encrypted random number;

[0020] Performing a hash operation on the first random number and the first negotiated key by using the SM3 algorithm to obtain a first hash value;

[0021] A key negotiation request is generated according to the first encrypted random number and the first hash value.

[0022] Optionally, the first key includes a first PQC encryption key (a first post-quantum cryptography encryption key) and a first SM2 encryption key (a first elliptic curve cryptography encryption key); the sending a key negotiation request to the proxy server so that the proxy server returns a key negotiation request response according to the first key corresponding to the network management center and the first negotiated key, including:

[0023] A key negotiation request is sent to the proxy server, so that the proxy server obtains the first random number and the first negotiation key according to the first encrypted random number and the first hash value, and returns the key negotiation request response to the network management center according to the first random number and the first negotiation key; the key negotiation request response carries a second encrypted random number and a second hash value; the second encrypted random number is obtained by encrypting the second random number corresponding to the proxy server by using the public key of the first SM2 encryption key and the SM2 algorithm; the second hash value is obtained by performing a hash operation on the second negotiation key by using the SM3 algorithm; the second negotiation key is obtained by using the first random number, the second random number and the first negotiation key.

[0024] Optionally, the verifying the first negotiated key according to the key negotiation request response includes:

[0025] Acquire the second encrypted random number and the second hash value according to the key agreement request response;

[0026] Decrypting the second encrypted random number by using the private key of the first SM2 encryption key to obtain the second random number;

[0027] Obtaining a third negotiated key by using the first random number, the second random number and the first negotiated key;

[0028] Performing a hash operation on the third negotiated key by using the SM3 algorithm to obtain a third hash value;

[0029] When the second hash value is equal to the third hash value, it is determined that the first negotiated key verification is successful.

[0030] Optionally, the cryptographic algorithm includes an SM3_HMAC algorithm (message authentication code generation algorithm); the sending of quantum network data to the proxy server, the quantum network data including data plaintext and data ciphertext, the data ciphertext being obtained by encrypting the data plaintext with the session key, so that the proxy server verifies the data plaintext with the data ciphertext, and after the data plaintext is verified, controls the quantum network device according to the control instruction indicated by the data plaintext, including:

[0031] Obtain a first digest value corresponding to the data plaintext and the data ciphertext; the first digest value is obtained by performing a hash operation on the data plaintext and the session key through the SM3_HMAC algorithm;

[0032] Generate the quantum network data according to the data plaintext and the first summary value;

[0033] The quantum network data is sent to the proxy server, so that the proxy server performs a hash operation on the data plaintext and the session key through the SM3_HMAC algorithm to obtain a second digest value, and when the first digest value is equal to the second digest value, it is determined that the data plaintext verification has passed, and after the data plaintext verification has passed, the quantum network device is controlled according to the control instruction indicated by the data plaintext.

[0034] Optionally, the performing identity authentication with the proxy server includes:

[0035] Sending a first identity authentication request to the proxy server, so that the proxy server returns a first identity authentication response through the second key;

[0036] According to the first identity authentication response and the first key, a second identity authentication request is sent to the proxy server, so that the proxy server performs identity authentication.

[0037] Optionally, the second key includes a second PQC signature key (a second post-quantum cryptographic signature key) and a second SM2 signature key (a second elliptic curve cryptographic signature key); the sending a first identity authentication request to the proxy server so that the proxy server returns a first identity authentication response through the second key includes:

[0038] A first identity authentication request is sent to the proxy server, where the first identity authentication request carries a third random number corresponding to the network management center, so that the proxy server signs the third random number through the private key of the second PQC signature key and the private key of the second SM2 signature key, obtains a first SM2 signature value and a first PQC signature value, and returns the first identity authentication response; the first identity authentication response carries a fourth random number corresponding to the proxy server, the second certificate corresponding to the proxy server, the first SM2 signature value and the first PQC signature value.

[0039] Optionally, the first key includes a first PQC signature key and a first SM2 signature key; and sending a second identity authentication request to the proxy server according to the first identity authentication response and the first key so that the proxy server performs identity authentication includes:

[0040] The fourth random number is signed by using the private key of the first PQC signature key and the private key of the first SM2 signature key to obtain a second SM2 signature value and a second PQC signature value;

[0041] Send a second identity authentication request to the proxy server; the second identity authentication request carries the first PQC certificate corresponding to the network management center, the second SM2 signature value and the second PQC signature value, so that the proxy server performs identity authentication.

[0042] In a second aspect, an embodiment of the present invention provides a quantum network data encryption method based on a cryptographic algorithm, which is applied to a proxy server, and the method includes:

[0043] Negotiate the session key with the network management center to obtain the session key;

[0044] Receiving quantum network data sent by the network management center, the quantum network data includes data plaintext and data ciphertext, the data ciphertext is obtained by encrypting the data plaintext by using the session key;

[0045] The data plaintext is verified by the data ciphertext, and after the data plaintext is verified, the quantum network device is controlled according to the control instructions indicated by the data plaintext.

[0046] Optionally, the performing session key negotiation with the network management center to obtain the session key includes:

[0047] Receiving a key negotiation request sent by the network management center; the key negotiation request is generated according to a first negotiation key, and the first negotiation key is generated by the cryptographic algorithm and a second key corresponding to the proxy server;

[0048] According to the first key corresponding to the network management center and the first negotiated key, a key negotiation request response is returned to the network management center, so that the network management center verifies the first negotiated key according to the key negotiation request response, and uses the first negotiated key as the session key after the first negotiated key verification is passed.

[0049] Optionally, before performing session key negotiation with the network management center, the method further includes:

[0050] Performing identity authentication with the network management center;

[0051] The session key negotiation with the network management center includes:

[0052] After identity authentication with the network management center, session key negotiation is performed with the network management center.

[0053] Optionally, the second key includes a second PQC encryption key and a second SM2 encryption key; the cryptographic algorithm includes an SM2 algorithm, a PQC algorithm and an SM3 algorithm;

[0054] The key negotiation request is generated based on the first encrypted random number and the first hash value; the first encrypted random number is obtained by encrypting the first random number corresponding to the network management center through the public key of the second SM2 encryption key and the SM2 algorithm; the first hash value is obtained by performing a hash operation on the first random number and the first negotiation key through the SM3 algorithm; the first negotiation key is generated by the public key of the second PQC encryption key and the PQC algorithm.

[0055] Optionally, the first key includes a first PQC encryption key and a first SM2 encryption key; the returning a key negotiation request response to the network management center according to the first key corresponding to the network management center and the first negotiated key, so that the network management center verifies the first negotiated key according to the key negotiation request response, and after the first negotiated key verification is passed, uses the first negotiated key as the session key, including:

[0056] Obtaining the first random number and the first negotiated key according to the first encrypted random number and the first Hash value;

[0057] Obtaining a second random number corresponding to the proxy server;

[0058] Encrypt the second random number using the public key of the first SM2 encryption key and the SM2 algorithm to obtain a second encrypted random number;

[0059] Obtaining a second negotiated key by using the first random number, the second random number and the first negotiated key;

[0060] Performing a hash operation on the second negotiated key by using the SM3 algorithm to obtain a second hash value;

[0061] Generate the key agreement request response according to the second encrypted random number and the second hash value;

[0062] The key negotiation request response is returned to the network management center, so that the network management center verifies the first negotiated key according to the key negotiation request response, and uses the first negotiated key as the session key after the first negotiated key verification passes.

[0063] Optionally, the network management center determines that the first negotiated key verification is successful when the second hash value is equal to the third hash value; the third hash value is obtained by performing a hash operation on the third negotiated key by the SM3 algorithm; the third negotiated key is obtained by the first random number, the second random number and the first negotiated key; the second random number is obtained by decrypting the second encrypted random number using the private key of the first SM2 encryption key; the second encrypted random number and the second hash value are obtained according to the key negotiation request response.

[0064] Optionally, the cryptographic algorithm includes an SM3_HMAC algorithm; the quantum network data is generated according to a first summary value corresponding to the data plaintext and the data ciphertext; the first summary value is obtained by performing a hash operation on the data plaintext and the session key through the SM3_HMAC algorithm; the data plaintext is verified by the data ciphertext, and after the data plaintext is verified, the quantum network device is controlled according to the control instruction indicated by the data plaintext, including:

[0065] Performing a hash operation on the data plaintext and the session key by using the SM3_HMAC algorithm to obtain a second digest value;

[0066] When the first digest value is equal to the second digest value, it is determined that the data plaintext verification has passed, and after the data plaintext verification has passed, the quantum network device is controlled according to the control instruction indicated by the data plaintext.

[0067] Optionally, the performing identity authentication with the network management center includes:

[0068] receiving a first identity authentication request sent by the network management center, and returning a first identity authentication response to the network management center through the second key;

[0069] Receive a second identity authentication request sent by the network management center according to the first identity authentication response and the first key, and perform identity authentication with the network management center through the second identity authentication request.

[0070] Optionally, the second key includes a second PQC signature key and a second SM2 signature key; the first identity authentication request carries a third random number corresponding to the network management center; the receiving the first identity authentication request sent by the network management center, and returning a first identity authentication response to the network management center through the second key, includes:

[0071] Receive the first identity authentication request sent by the network management center, sign the third random number by using the private key of the second PQC signature key and the private key of the second SM2 signature key, and obtain a first SM2 signature value and a first PQC signature value;

[0072] Return the first identity authentication response to the network management center; the first identity authentication response carries the fourth random number corresponding to the proxy server, the second certificate corresponding to the proxy server, the first SM2 signature value and the first PQC signature value.

[0073] Optionally, the first key includes a first PQC signature key and a first SM2 signature key; the second identity authentication request carries the first PQC certificate, the second SM2 signature value and the second PQC signature value corresponding to the network management center; the second SM2 signature value and the second PQC signature value are obtained by signing the fourth random number with the private key of the first PQC signature key and the private key of the first SM2 signature key.

[0074] In a third aspect, an embodiment of the present invention provides a quantum network data encryption system based on a cryptographic algorithm, the system comprising: a network management center and a proxy server;

[0075] The network management center is used to negotiate a session key with the proxy server to obtain a session key; send quantum network data to the proxy server, the quantum network data includes data plaintext and data ciphertext, and the data ciphertext is obtained by encrypting the data plaintext with the session key;

[0076] The proxy server is used to negotiate a session key with the network management center to obtain a session key; receive quantum network data sent by the network management center; verify the data plaintext through the data ciphertext, and after the data plaintext is verified, control the quantum network device according to the control instruction indicated by the data plaintext.

[0077] Optionally, the network management center is used to generate a first negotiation key by using the cryptographic algorithm and a second key corresponding to the proxy server, and generate a key negotiation request according to the first negotiation key; and send the key negotiation request to the proxy server;

[0078] The proxy server is configured to receive a key negotiation request sent by the network management center; and return a key negotiation request response to the network management center according to the first key corresponding to the network management center and the first negotiated key;

[0079] The network management center is used to verify the first negotiated key according to the key negotiation request response; after the first negotiated key is verified, use the first negotiated key as a session key.

[0080] Optionally, the network management center is further used to perform identity authentication with the proxy server; after performing identity authentication with the proxy server, perform session key negotiation with the proxy server;

[0081] The proxy server is also used to perform identity authentication with the network management center; after performing identity authentication with the network management center, the proxy server negotiates a session key with the network management center.

[0082] Optionally, the second key includes a second PQC encryption key and a second SM2 encryption key; the cryptographic algorithm includes an SM2 algorithm, a PQC algorithm and an SM3 algorithm;

[0083] The network management center is used to generate the first negotiation key through the public key of the second PQC encryption key and the PQC algorithm; obtain the first random number corresponding to the network management center; encrypt the first random number through the public key of the second SM2 encryption key and the SM2 algorithm to obtain a first encrypted random number; perform a hash operation on the first random number and the first negotiation key through the SM3 algorithm to obtain a first hash value; and generate a key negotiation request based on the first encrypted random number and the first hash value.

[0084] Optionally, the first key includes a first PQC encryption key and a first SM2 encryption key;

[0085] The proxy server is used to obtain the first random number and the first negotiation key according to the first encrypted random number and the first hash value; obtain the second random number corresponding to the proxy server; encrypt the second random number by using the public key of the first SM2 encryption key and the SM2 algorithm to obtain a second encrypted random number; obtain a second negotiation key by using the first random number, the second random number and the first negotiation key; perform a hash operation on the second negotiation key by using the SM3 algorithm to obtain a second hash value; generate the key negotiation request response according to the second encrypted random number and the second hash value; and return the key negotiation request response to the network management center.

[0086] Optionally, the network management center is used to obtain the second encrypted random number and the second hash value according to the key negotiation request response; decrypt the second encrypted random number by using the private key of the first SM2 encryption key to obtain the second random number; obtain a third negotiated key by using the first random number, the second random number and the first negotiation key; perform a hash operation on the third negotiated key by using the SM3 algorithm to obtain a third hash value; and when the second hash value is equal to the third hash value, determine that the first negotiated key verification has passed.

[0087] Optionally, the cryptographic algorithm includes an SM3_HMAC algorithm;

[0088] The network management center is used to obtain a first summary value corresponding to the data plaintext and the data ciphertext; the first summary value is obtained by performing a hash operation on the data plaintext and the session key through the SM3_HMAC algorithm; generate the quantum network data according to the data plaintext and the first summary value; and send the quantum network data to the proxy server;

[0089] The proxy server is used to perform a hash operation on the data plaintext and the session key through the SM3_HMAC algorithm to obtain a second digest value; when the first digest value is equal to the second digest value, determine that the data plaintext verification has passed, and after the data plaintext verification has passed, control the quantum network device according to the control instruction indicated by the data plaintext.

[0090] Optionally, it further includes: a certificate issuing center, a first cryptographic machine and a second cryptographic machine; the first cryptographic machine is associated with the network management center, and the second cryptographic machine is associated with the proxy server;

[0091] The first cryptographic machine is used to create the first key corresponding to the network management center; generate a first certificate request file according to the unique identifier of the network management center and the first key; and send the first certificate request file to the certificate issuing center;

[0092] The second cryptographic machine is used to create the second key corresponding to the proxy server; generate a second certificate request file according to the unique identifier of the proxy server and the second key; and send the second certificate request file to the certificate issuing center;

[0093] The certificate issuing center is used to receive the first certificate request file sent by the first cryptographic machine, generate a first certificate corresponding to the network management center, and return the first certificate to the first cryptographic machine; receive the second certificate request file sent by the second cryptographic machine, generate a second certificate corresponding to the proxy server, and return the second certificate to the second cryptographic machine;

[0094] The network management center is used to send a first identity authentication request to the proxy server, so that the proxy server returns a first identity authentication response through the second key; and send a second identity authentication request to the proxy server according to the first identity authentication response and the first key;

[0095] The proxy server is used to receive a second identity authentication request sent by the network management center according to the first identity authentication response and the first key, and perform identity authentication with the network management center through the second identity authentication request.

[0096] Optionally, the second key includes a second PQC signature key and a second SM2 signature key; the first identity authentication request carries a third random number corresponding to the network management center;

[0097] The proxy server is used to receive the first identity authentication request sent by the network management center, sign the third random number through the private key of the second PQC signature key and the private key of the second SM2 signature key, and obtain a first SM2 signature value and a first PQC signature value; return the first identity authentication response to the network management center; the first identity authentication response carries the fourth random number corresponding to the proxy server, the second certificate, the first SM2 signature value and the first PQC signature value.

[0098] Optionally, the first key includes a first PQC signature key and a first SM2 signature key;

[0099] The network management center is used to sign the fourth random number by using the private key of the first PQC signature key and the private key of the first SM2 signature key to obtain a second SM2 signature value and a second PQC signature value; and send a second identity authentication request to the proxy server; the second identity authentication request carries the first certificate, the second SM2 signature value and the second PQC signature value.

[0100] The proxy server is used to receive the second identity authentication request sent by the network management center, and perform identity authentication according to the second identity authentication request.

[0101] In a fourth aspect, an embodiment of the present invention provides a quantum network data encryption device based on a cryptographic algorithm, which is applied to a network management center, and the device includes:

[0102] A first session key negotiation module, used to negotiate a session key with a proxy server to obtain a session key;

[0103] The quantum network data sending module is used to send quantum network data to the proxy server, wherein the quantum network data includes data plaintext and data ciphertext, and the data ciphertext is obtained by encrypting the data plaintext with the session key, so that the proxy server verifies the data plaintext with the data ciphertext, and controls the quantum network device according to the control instruction indicated by the data plaintext after the data plaintext is verified.

[0104] Optionally, the first session key negotiation module includes:

[0105] a key negotiation request generation submodule, configured to generate a first negotiation key by using the cryptographic algorithm and a second key corresponding to the proxy server, and to generate a key negotiation request according to the first negotiation key;

[0106] A key negotiation request sending submodule, used to send a key negotiation request to the proxy server, so that the proxy server returns a key negotiation request response according to the first key corresponding to the network management center and the first negotiated key;

[0107] A first negotiated key verification submodule, configured to verify the first negotiated key according to the key negotiation request response;

[0108] The session key determination submodule is used to use the first negotiated key as the session key after the first negotiated key is verified.

[0109] Optionally, before the first session key negotiation module, the device further includes:

[0110] A first identity authentication module, used for performing identity authentication with the proxy server;

[0111] The first session key negotiation module includes:

[0112] The first session key negotiation submodule is used to negotiate a session key with the proxy server after identity authentication with the proxy server.

[0113] Optionally, the second key includes a second PQC encryption key and a second SM2 encryption key; the cryptographic algorithm includes an SM2 algorithm, a PQC algorithm, and an SM3 algorithm; and the key agreement request generation submodule includes:

[0114] A first negotiation key generating unit, configured to generate the first negotiation key by using a public key of the second PQC encryption key and the PQC algorithm;

[0115] A first random number acquisition unit, used to acquire a first random number corresponding to the network management center;

[0116] A first random number encryption unit, configured to encrypt the first random number by using the public key of the second SM2 encryption key and the SM2 algorithm to obtain a first encrypted random number;

[0117] A first hash value calculation unit, configured to perform a hash operation on the first random number and the first negotiated key by using the SM3 algorithm to obtain a first hash value;

[0118] A key negotiation request generating unit is used to generate a key negotiation request according to the first encrypted random number and the first Hash value.

[0119] Optionally, the first key includes a first PQC encryption key and a first SM2 encryption key; the key negotiation request sending submodule includes:

[0120] A key negotiation request sending unit is used to send a key negotiation request to the proxy server, so that the proxy server obtains the first random number and the first negotiation key according to the first encrypted random number and the first hash value, and returns the key negotiation request response to the network management center according to the first random number and the first negotiation key; the key negotiation request response carries a second encrypted random number and a second hash value; the second encrypted random number is obtained by encrypting the second random number corresponding to the proxy server through the public key of the first SM2 encryption key and the SM2 algorithm; the second hash value is obtained by performing a hash operation on the second negotiation key through the SM3 algorithm; the second negotiation key is obtained by the first random number, the second random number and the first negotiation key.

[0121] Optionally, the first negotiated key verification submodule includes:

[0122] A second encrypted random number acquisition unit, configured to acquire the second encrypted random number and the second hash value according to the key agreement request response;

[0123] A second random number decryption unit, configured to decrypt the second encrypted random number by using a private key of the first SM2 encryption key to obtain the second random number;

[0124] A third negotiated key generating unit, configured to obtain a third negotiated key through the first random number, the second random number and the first negotiated key;

[0125] A third hash value operation unit, configured to perform a hash operation on the third negotiated key by using the SM3 algorithm to obtain a third hash value;

[0126] The first negotiated key verification unit is configured to determine that the first negotiated key verification succeeds when the second Hash value is equal to the third Hash value.

[0127] Optionally, the cryptographic algorithm includes an SM3_HMAC algorithm; and the quantum network data sending module includes:

[0128] A first digest value acquisition submodule is used to obtain a first digest value corresponding to the data plaintext and the data ciphertext; the first digest value is obtained by performing a hash operation on the data plaintext and the session key by the SM3_HMAC algorithm;

[0129] A quantum network data generation submodule, used to generate the quantum network data according to the data plaintext and the first summary value;

[0130] The quantum network data sending submodule is used to send the quantum network data to the proxy server, so that the proxy server performs a hash operation on the data plaintext and the session key through the SM3_HMAC algorithm to obtain a second digest value, and when the first digest value is equal to the second digest value, it is determined that the data plaintext verification has passed, and after the data plaintext verification has passed, the quantum network device is controlled according to the control instruction indicated by the data plaintext.

[0131] Optionally, the first identity authentication module includes:

[0132] A first identity authentication request sending submodule, configured to send a first identity authentication request to the proxy server, so that the proxy server returns a first identity authentication response through the second key;

[0133] The second identity authentication request sending submodule is used to send a second identity authentication request to the proxy server according to the first identity authentication response and the first key, so that the proxy server performs identity authentication.

[0134] Optionally, the second key includes a second PQC signature key and a second SM2 signature key; the first identity authentication request sending submodule includes:

[0135] The first identity authentication request sending unit is used to send a first identity authentication request to the proxy server, wherein the first identity authentication request carries a third random number corresponding to the network management center, so that the proxy server signs the third random number through the private key of the second PQC signature key and the private key of the second SM2 signature key, obtains a first SM2 signature value and a first PQC signature value, and returns the first identity authentication response; the first identity authentication response carries a fourth random number corresponding to the proxy server, the second certificate corresponding to the proxy server, the first SM2 signature value and the first PQC signature value.

[0136] Optionally, the first key includes a first PQC signature key and a first SM2 signature key; the second identity authentication request sending submodule includes:

[0137] a fourth random number signing unit, configured to sign the fourth random number by using the private key of the first PQC signature key and the private key of the first SM2 signature key to obtain a second SM2 signature value and a second PQC signature value;

[0138] The second identity authentication request sending unit is used to send a second identity authentication request to the proxy server; the second identity authentication request carries the first PQC certificate corresponding to the network management center, the second SM2 signature value and the second PQC signature value, so that the proxy server performs identity authentication.

[0139] In a fifth aspect, an embodiment of the present invention provides a quantum network data encryption device based on a cryptographic algorithm, which is applied to a proxy server, and the device includes:

[0140] The second session key negotiation module is used to negotiate the session key with the network management center to obtain the session key;

[0141] A quantum network data receiving module, used to receive quantum network data sent by the network management center, wherein the quantum network data includes plaintext data and ciphertext data, and the ciphertext data is obtained by encrypting the plaintext data with the session key;

[0142] The quantum network device control module is used to verify the data plaintext through the data ciphertext, and after the data plaintext is verified, control the quantum network device according to the control instruction indicated by the data plaintext.

[0143] Optionally, the second session key negotiation module includes:

[0144] A key negotiation request receiving submodule, configured to receive a key negotiation request sent by the network management center; the key negotiation request is generated according to a first negotiation key, and the first negotiation key is generated by the cryptographic algorithm and a second key corresponding to the proxy server;

[0145] The second session key negotiation submodule is used to return a key negotiation request response to the network management center according to the first key corresponding to the network management center and the first negotiated key, so that the network management center verifies the first negotiated key according to the key negotiation request response, and uses the first negotiated key as the session key after the first negotiated key verification is passed.

[0146] Optionally, before the second session key negotiation module, the device further includes:

[0147] A second identity authentication module, used for performing identity authentication with the network management center;

[0148] The second session key negotiation module includes:

[0149] The second identity authentication submodule is used to negotiate a session key with the network management center after identity authentication with the network management center.

[0150] Optionally, the second key includes a second PQC encryption key and a second SM2 encryption key; the cryptographic algorithm includes an SM2 algorithm, a PQC algorithm and an SM3 algorithm; the key negotiation request is generated based on a first encrypted random number and a first hash value; the first encrypted random number is obtained by encrypting the first random number corresponding to the network management center using the public key of the second SM2 encryption key and the SM2 algorithm; the first hash value is obtained by performing a hash operation on the first random number and the first negotiation key using the SM3 algorithm; the first negotiation key is generated using the public key of the second PQC encryption key and the PQC algorithm.

[0151] Optionally, the first key includes a first PQC encryption key and a first SM2 encryption key; the second session key negotiation submodule includes:

[0152] A first negotiated key acquisition unit, configured to obtain the first random number and the first negotiated key according to the first encrypted random number and the first hash value;

[0153] A second random number obtaining unit, used to obtain a second random number corresponding to the proxy server;

[0154] A second random number encryption unit, used to encrypt the second random number by using the public key of the first SM2 encryption key and the SM2 algorithm to obtain a second encrypted random number;

[0155] A second negotiated key generating unit, configured to obtain a second negotiated key through the first random number, the second random number and the first negotiated key;

[0156] A second hash value operation unit, configured to perform a hash operation on the second negotiated key by using the SM3 algorithm to obtain a second hash value;

[0157] a key agreement request response generating unit, configured to generate the key agreement request response according to the second encrypted random number and the second hash value;

[0158] The second session key negotiation unit is used to return the key negotiation request response to the network management center, so that the network management center verifies the first negotiated key according to the key negotiation request response, and uses the first negotiated key as the session key after the first negotiated key verification is passed.

[0159] Optionally, the network management center determines that the first negotiated key verification is successful when the second hash value is equal to the third hash value; the third hash value is obtained by performing a hash operation on the third negotiated key by the SM3 algorithm; the third negotiated key is obtained by the first random number, the second random number and the first negotiated key; the second random number is obtained by decrypting the second encrypted random number using the private key of the first SM2 encryption key; the second encrypted random number and the second hash value are obtained according to the key negotiation request response.

[0160] Optionally, the cryptographic algorithm includes an SM3_HMAC algorithm; the quantum network data is generated according to a first summary value corresponding to the data plaintext and the data ciphertext; the first summary value is obtained by performing a hash operation on the data plaintext and the session key through the SM3_HMAC algorithm; the quantum network device control module includes:

[0161] A second digest value operation submodule, configured to perform a hash operation on the data plaintext and the session key by using the SM3_HMAC algorithm to obtain a second digest value;

[0162] The quantum network device control submodule is used to determine that the data plaintext verification has passed when the first summary value is equal to the second summary value, and after the data plaintext verification has passed, control the quantum network device according to the control instruction indicated by the data plaintext.

[0163] Optionally, the second identity authentication module includes:

[0164] A first identity authentication request receiving submodule, configured to receive a first identity authentication request sent by the network management center, and return a first identity authentication response to the network management center through the second key;

[0165] The second identity authentication request receiving submodule is used to receive a second identity authentication request sent by the network management center according to the first identity authentication response and the first key, and perform identity authentication with the network management center through the second identity authentication request.

[0166] Optionally, the second key includes a second PQC signature key and a second SM2 signature key; the first identity authentication request carries a third random number corresponding to the network management center; and the first identity authentication request receiving submodule includes:

[0167] A third random number signature unit is used to receive the first identity authentication request sent by the network management center, and sign the third random number by using the private key of the second PQC signature key and the private key of the second SM2 signature key to obtain a first SM2 signature value and a first PQC signature value;

[0168] The first identity authentication response returning unit is used to return the first identity authentication response to the network management center; the first identity authentication response carries the fourth random number corresponding to the proxy server, the second certificate corresponding to the proxy server, the first SM2 signature value and the first PQC signature value.

[0169] Optionally, the first key includes a first PQC signature key and a first SM2 signature key; the second identity authentication request carries the first PQC certificate, the second SM2 signature value and the second PQC signature value corresponding to the network management center; the second SM2 signature value and the second PQC signature value are obtained by signing the fourth random number with the private key of the first PQC signature key and the private key of the first SM2 signature key.

[0170] In a sixth aspect, the present invention shows an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned quantum network data encryption method based on a cryptographic algorithm when executing the computer program.

[0171] In the seventh aspect, the present invention shows a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned quantum network data encryption method based on a cryptographic algorithm are implemented.

[0172] The embodiments of the present invention include the following advantages:

[0173] The embodiment of the present invention provides a quantum network data encryption method, system and device based on a cryptographic algorithm, which is applied to a network management center. After the network management center performs identity authentication with a proxy server, it can negotiate a session key with the proxy server to obtain a session key. The session key is generated based on a cryptographic algorithm and a cryptographic machine. The network management center and the proxy server can each be associated with a cryptographic machine to perform cryptographic operations and key management, so that the business system and the cryptographic logic can be completely decoupled; and the cryptographic algorithm of the embodiment of the present invention has higher security and economic advantages than traditional encryption methods; in addition, the negotiated session key can be stored in the cryptographic machine, and the key negotiation mechanism of the embodiment of the present invention can improve the success rate of key negotiation and protect the security of the negotiated key. The network management center can send quantum network data to the proxy server. The quantum network data includes plaintext data and ciphertext data. The ciphertext data is obtained by encrypting the plaintext data with the session key, so that the proxy server can verify the plaintext data through the ciphertext data, and after the plaintext data is verified, the quantum network device is controlled according to the control instructions indicated by the plaintext data. The plaintext data is verified by the ciphertext data to prevent the plaintext data from being tampered with during the transmission process, thereby ensuring the security of data interaction between the network management center, the proxy server and the quantum network device. BRIEF DESCRIPTION OF THE DRAWINGS

[0174] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0175] Figure 1 It is a flowchart of a quantum network data encryption method based on a cryptographic algorithm according to an embodiment of the present invention;

[0176] Figure 2 is a flowchart of another method for quantum network data encryption based on a cryptographic algorithm according to an embodiment of the present invention;

[0177] Figure 3 It is a structural block diagram of a quantum network data encryption system based on a cryptographic algorithm according to an embodiment of the present invention;

[0178] Figure 4 It is a structural block diagram of a quantum network data encryption device based on a cryptographic algorithm according to an embodiment of the present invention;

[0179] Figure 5 It is a structural block diagram of another quantum network data encryption device based on a cryptographic algorithm according to an embodiment of the present invention.

[0180] Description of reference numerals:

[0181] Quantum network data encryption system 30, network management center 31, proxy server 32, quantum network equipment 33, certificate issuance center 34, first cipher machine 35, second cipher machine 36. DETAILED DESCRIPTION

[0182] The present invention proposes a quantum network data encryption method based on cryptographic algorithms, wherein the cryptographic algorithms include: PQC algorithm (Post-Quantum Cryptography), SM2 algorithm (Elliptic Curve PublicKey Cryptography Algorithm, asymmetric encryption algorithm based on elliptic curve cryptography), SM3 algorithm (SM3 Cryptographic Hash Algorithm, SM3 cryptographic hash algorithm), and SM3_HMAC algorithm (SM3 Hash-basedMessage Authentication Code, message authentication code generation algorithm based on SM3 cryptographic hash algorithm). The purpose is to provide the security of data interaction between the network management center, the proxy server and the device in two networks. In order to achieve this goal, the embodiment of the present invention negotiates the session key of the network management center and the proxy server through the cryptographic algorithm, generates data ciphertext through the session key and transmits it together with the data plaintext to verify whether the data plaintext has been tampered with, thereby ensuring the security of data interaction between the network management center, the proxy server and the quantum network device.

[0183] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0184] Reference Figure 1 , shows a flowchart of a quantum network data encryption method based on a cryptographic algorithm according to an embodiment of the present invention, wherein the method may specifically include the following steps:

[0185] Step 101, negotiate a session key with the proxy server to obtain a session key;

[0186] In one embodiment, before performing session key negotiation with the proxy server, the method further includes: performing identity authentication with the proxy server; the step of performing identity authentication with the proxy server may further include the following sub-steps:

[0187] Sub-step S11, sending a first identity authentication request to the proxy server, so that the proxy server returns a first identity authentication response through the second key;

[0188] Among them, the second key includes a second PQC signature key and a second SM2 signature key; sending a first identity authentication request to the proxy server so that the proxy server returns a first identity authentication response through the second key, including: sending a first identity authentication request to the proxy server, the first identity authentication request carries a third random number corresponding to the network management center, so that the proxy server signs the third random number through the private key of the second PQC signature key and the private key of the second SM2 signature key, obtains a first SM2 signature value and a first PQC signature value, and returns the first identity authentication response; the first identity authentication response carries a fourth random number corresponding to the proxy server, the second certificate corresponding to the proxy server, the first SM2 signature value and the first PQC signature value.

[0189] Sub-step S12: sending a second identity authentication request to the proxy server according to the first identity authentication response and the first key, so that the proxy server performs identity authentication.

[0190] Among them, the first key includes a first PQC signature key and a first SM2 signature key; according to the first authentication response and the first key, a second authentication request is sent to the proxy server to enable the proxy server to perform authentication, including: signing the fourth random number by the private key of the first PQC signature key and the private key of the first SM2 signature key to obtain a second SM2 signature value and a second PQC signature value; sending a second authentication request to the proxy server; the second authentication request carries the first PQC certificate corresponding to the network management center, the second SM2 signature value and the second PQC signature value, so that the proxy server performs authentication.

[0191] In the embodiment of the present invention, before the network management center and the proxy server perform session key negotiation, it is also necessary to obtain the first key and the first certificate corresponding to the network management center, and the second key and the second certificate corresponding to the proxy server. The specific certificate application process is as follows:

[0192] (1) The network management center sends a first digital certificate application request carrying the unique identifier of the network management center to its corresponding first cryptographic machine through the SDK (Software Development Kit) security interface;

[0193] (2) The first cryptographic machine creates a first key corresponding to the network management center, including a first PQC signature key, a first SM2 signature key, a first PQC encryption key and a first SM2 encryption key; generates a first certificate request file according to the unique identifier of the network management center, the public key of the first PQC signature key, the public key of the first PQC encryption key and the public key of the first SM2 signature key, and the first certificate request file may be a P10 certificate request file; and sends the first certificate request file to the certificate issuing center;

[0194] (3) The proxy server sends a second digital certificate application request carrying the unique identifier of the proxy server to its corresponding second cryptographic machine through the SDK security interface;

[0195] (4) The second cryptographic machine creates a second key corresponding to the proxy server, including a second PQC signature key, a second SM2 signature key, a second PQC encryption key and a second SM2 encryption key; generates a second certificate request file according to the unique identifier of the proxy server, the public key of the second PQC signature key, the public key of the second PQC encryption key and the public key of the second SM2 signature key, and the second certificate request file may also be a P10 certificate request file; and sends the second certificate request file to the certificate issuing center;

[0196] (5) The certificate issuing center verifies the domain name, identity code, and organization code of the applicant of the network management center according to the P10 certificate request file; after successful verification, a first certificate corresponding to the network management center is generated; the first certificate includes a first PQC certificate, a first SM2 encryption certificate, and a first SM2 signature certificate, the first SM2 encryption certificate includes the public key of the first PQC encryption key, and the first SM2 signature certificate includes the public key of the first PQC signature key; the first certificate is sent to the first cryptographic machine;

[0197] (6) The certificate issuing center verifies the domain name, identity code and organization code of the applicant of the proxy server according to the P10 certificate request file; after successful verification, a second certificate corresponding to the proxy server is generated; the second certificate includes a second PQC certificate, a second SM2 encryption certificate and a second SM2 signature certificate, the second SM2 encryption certificate includes the public key of the second PQC encryption key, and the second SM2 signature certificate includes the public key of the second PQC signature key; the second certificate is sent to the second cryptographic machine.

[0198] Since then, the certificate application and issuance of the network management center and the proxy server have been completed. After the certificate application is completed, the network management center and the proxy server still need to perform identity authentication. The specific identity authentication process is as follows:

[0199] (1) The network management center obtains the first certificate and the third random number corresponding to the network management center from the first cryptographic machine through the SDK security interface; and sends a first identity authentication request carrying the third random number to the proxy server;

[0200] (2) The proxy server receives the first identity authentication request sent by the network management center; obtains the second certificate corresponding to the proxy server from the second cryptographic machine through the SDK security interface; signs the third random number through the second cryptographic machine using the private key of the second PQC signature key and the private key of the second SM2 signature key to obtain the first SM2 signature value and the first PQC signature value; sends the first identity authentication response to the network management center; the first identity authentication response carries the fourth random number corresponding to the proxy server, the second certificate, the first SM2 signature value and the first PQC signature value;

[0201] Exemplarily, the message format of the first identity authentication response may be as follows:

[0202] SM2_singcert_B||SM2_cryptocert_B||PQC_crytocert_B||SignB_PQC(RA)||SignB_SM2(RA)||RB

[0203] Among them, || is a string connector, SM2_singcert_B is the second SM2 signature certificate, SM2_cryptocert_B is the second SM2 encryption certificate, PQC_crytocert_B is the second PQC encryption certificate, SignB_PQC(RA) is the first PQC signature value, SignB_SM2(RA) is the first SM2 signature value, and RB is the fourth random number.

[0204] (3) The network management center receives the first identity authentication response sent by the proxy server; uses the public key of the second PQC signature key stored locally by the proxy server and the PQC algorithm to decrypt and verify the first PQC signature value, and uses the public key of the second SM2 signature key stored locally by the proxy server and the SM2 algorithm to decrypt and verify the first SM2 signature value. If both are successfully verified, the network management center successfully authenticates the proxy server; if the verification is successful, the fourth random number is signed by the private key of the first PQC signature key and the private key of the first SM2 signature key to obtain the second SM2 signature value and the second PQC signature value; sends a second identity authentication request to the proxy server; the second identity authentication request carries the first certificate, the second SM2 signature value and the second PQC signature value;

[0205] Exemplarily, the message format of the second identity authentication request may be as follows:

[0206] SM2_singcert_A||SM2_cryptocert_A||PQC_crytocert_A||SignA_PQC(RB)||SignA_SM2(RB)

[0207] Among them, || is a string connector, SM2_singcert_A is the first SM2 signing certificate, SM2_cryptocert_A is the first SM2 encryption certificate, PQC_crytocert_A is the first PQC encryption certificate, SignA_PQC(RB) is the second PQC signature value, SignA_SM2(RB) is the second SM2 signature value, and RA is the third random number.

[0208] (4) The proxy server receives the second identity authentication request sent by the network management center; verifies the first certificate, the second SM2 signature value and the second PQC signature value according to the agreed method; if both are successfully verified, the proxy server successfully authenticates the identity of the network management center.

[0209] Since then, the identity authentication between the network management center and the proxy server is successful. After the identity authentication between the network management center and the proxy server is successful, the network management center can negotiate a session key with the proxy server to obtain the session key, so that communication can be encrypted using the session key.

[0210] In one embodiment, the step of negotiating a session key with the proxy server to obtain a session key may further include the following sub-steps:

[0211] Sub-step S21, after identity authentication with the proxy server, generating a first negotiation key by using the cryptographic algorithm and a second key corresponding to the proxy server, and generating a key negotiation request according to the first negotiation key;

[0212] Among them, the second key includes a second PQC encryption key and a second SM2 encryption key; the cryptographic algorithm includes an SM2 algorithm, a PQC algorithm and an SM3 algorithm; the first negotiation key is generated by the cryptographic algorithm and the second key corresponding to the proxy server, and a key negotiation request is generated according to the first negotiation key, including: generating the first negotiation key by the public key of the second PQC encryption key and the PQC algorithm; obtaining the first random number corresponding to the network management center; encrypting the first random number by the public key of the second SM2 encryption key and the SM2 algorithm to obtain a first encrypted random number; performing a hash operation on the first random number and the first negotiation key by the SM3 algorithm to obtain a first hash value; generating a key negotiation request according to the first encrypted random number and the first hash value.

[0213] Sub-step S22, sending a key negotiation request to the proxy server, so that the proxy server returns a key negotiation request response according to the first key corresponding to the network management center and the first negotiated key;

[0214] Among them, the first key includes a first PQC encryption key and a first SM2 encryption key; the sending of a key negotiation request to the proxy server so that the proxy server returns a key negotiation request response according to the first key corresponding to the network management center and the first negotiated key, includes: sending a key negotiation request to the proxy server so that the proxy server obtains the first random number and the first negotiated key according to the first encrypted random number and the first hash value, and returns the key negotiation request response to the network management center according to the first random number and the first negotiated key; the key negotiation request response carries a second encrypted random number and a second hash value; the second encrypted random number is obtained by encrypting the second random number corresponding to the proxy server through the public key of the first SM2 encryption key and the SM2 algorithm; the second hash value is obtained by performing a hash operation on the second negotiated key through the SM3 algorithm; the second negotiated key is obtained by the first random number, the second random number and the first negotiated key.

[0215] Sub-step S23, verifying the first negotiated key according to the key negotiation request response;

[0216] Among them, the verification of the first negotiated key according to the key negotiation request response includes: obtaining the second encrypted random number and the second hash value according to the key negotiation request response; decrypting the second encrypted random number by using the private key of the first SM2 encryption key to obtain the second random number; obtaining the third negotiated key by using the first random number, the second random number and the first negotiated key; performing a hash operation on the third negotiated key by using the SM3 algorithm to obtain a third hash value; and when the second hash value is equal to the third hash value, determining that the first negotiated key verification has passed.

[0217] Sub-step S24: after the first negotiated key is verified, use the first negotiated key as a session key.

[0218] In the embodiment of the present invention, the specific process of the network management center and the proxy server negotiating the session key is as follows:

[0219] (1) The network management center obtains a first random number from the first cryptographic machine through the SDK security interface; encrypts the first random number using the public key of the second SM2 encryption key and the SM2 algorithm to obtain a first encrypted random number; generates a first negotiation key and a ciphertext using the public key of the second PQC encryption key and the PQC algorithm; performs a hash operation on the first random number and the first negotiation key using the SM3 algorithm to obtain a first hash value; generates a key negotiation request based on the first encrypted random number and the first hash value; and sends the key negotiation request to the proxy server;

[0220] Exemplarily, the message format of the key agreement request may be as follows:

[0221] CT||Esm2(RA)||SM3_hash(RA||RAB)

[0222] Among them, || is a string connector, CT is the cipher text, Esm2(RA) is the first encrypted random number, RA is the first random number, RAB is the first negotiated key, and SM3_hash(RA||RAB) is the first hash value.

[0223] (2) The proxy server receives the key negotiation request sent by the network management center; parses the key negotiation request to obtain a first random number and a first negotiation key; obtains a second random number corresponding to the proxy server from the second cryptographic machine through the SDK security interface; encrypts the second random number using the public key of the first SM2 encryption key and the SM2 algorithm to obtain a second encrypted random number; obtains a second negotiation key using the first random number, the second random number and the first negotiation key; performs a hash operation on the second negotiation key using the SM3 algorithm to obtain a second hash value; generates a key negotiation request response based on the second encrypted random number and the second hash value; and returns the key negotiation request response to the network management center;

[0224] Exemplarily, the message format of the key agreement request response may be as follows:

[0225] Esm2(RB)||SM3_hash(Kab)

[0226] Among them, || is a string concatenation operator, Esm2(RB) is the second encrypted random number, RB is the second random number, SM3_hash(Kab) is the second hash value, and Kab is the second negotiated key. The specific calculation steps for generating the second negotiated key Kab are as follows:

[0227] 1) Xab=XOR(RA||RB,RAB);

[0228] 2)Kab=XOR(Slice_Left(Xab, 16), Slice_Right(Xab, 16));

[0229] The calculation functions used include: XOR function XOR(A, B), string left interception function Slice_Left(A, len), and string right interception function Slice_Right(A, len). In step 1), RA||RB is the string concatenation of the first random number and the second random number, XOR(RA||RB, RAB) is the XOR processing of RA||RB and RAB, and Xab is the string after the XOR processing. In step 2), Slice_Left(Xab, 16) is to intercept the first 16 bytes L_16bit of Xab, Slice_Right(Xab, 16) is to intercept the last 16 bytes R_16bit of Xab, and XOR(L_16bit, R_16bit) is to XOR L_16bit with R_16bit, and finally obtain the second negotiated key Kab.

[0230] (3) The network management center receives the key negotiation request response returned by the proxy server; obtains the second encrypted random number and the second hash value according to the key negotiation request response; decrypts the second encrypted random number using the private key of the first SM2 encryption key to obtain the second random number; obtains the third negotiation key using the first random number, the second random number and the first negotiation key; performs a hash operation on the third negotiation key using the SM3 algorithm to obtain a third hash value; and when the second hash value is equal to the third hash value, determines that the first negotiation key verification has passed.

[0231] Exemplarily, the specific generation process of the third negotiated key is: concatenate the strings of the first random number and the second random number to obtain RA||RB, perform XOR processing on RA||RB and RAB, then intercept the first 16 bytes L_16bit and the last 16 bytes R_16bit, perform XOR processing again, and finally obtain the third negotiated key. Perform a hash operation on the third negotiated key through the SM3 algorithm to obtain a third hash value; when the second hash value is equal to the third hash value, it is determined that the first negotiated key verification has passed.

[0232] In the embodiment of the present invention, after the first negotiated key is verified, the first negotiated key can be used as the session key. The session key is generated based on the cryptographic algorithm and the cryptographic machine. The network management center and the proxy server can each be associated with a cryptographic machine to perform cryptographic operations and key management, so that the business system and the cryptographic logic can be completely decoupled; and the cryptographic algorithm of the embodiment of the present invention has higher security and economic advantages compared to the traditional encryption method; in addition, the negotiated session key can be stored in the cryptographic machine. The key negotiation mechanism of the embodiment of the present invention can improve the success rate of key negotiation and protect the security of the negotiated key.

[0233] Step 102, sending quantum network data to the proxy server, the quantum network data including data plaintext and data ciphertext, the data ciphertext being obtained by encrypting the data plaintext by the session key, so that the proxy server verifies the data plaintext by the data ciphertext, and controls the quantum network device according to the control instruction indicated by the data plaintext after the data plaintext is verified.

[0234] In one embodiment, the cryptographic algorithm includes an SM3_HMAC algorithm; the step of sending quantum network data to the proxy server, the quantum network data including data plaintext and data ciphertext, the data ciphertext being obtained by encrypting the data plaintext with the session key, so that the proxy server verifies the data plaintext with the data ciphertext, and after the data plaintext is verified, controlling the quantum network device according to the control instruction indicated by the data plaintext, may also include the following sub-steps:

[0235] Sub-step S31, obtaining a first digest value corresponding to the data plaintext and the data ciphertext; the first digest value is obtained by performing a hash operation on the data plaintext and the session key through the SM3_HMAC algorithm;

[0236] Sub-step S32, generating the quantum network data according to the data plaintext and the first summary value;

[0237] Sub-step S33, sending the quantum network data to the proxy server, so that the proxy server performs a hash operation on the data plaintext and the session key through the SM3_HMAC algorithm to obtain a second digest value, and when the first digest value is equal to the second digest value, determining that the data plaintext verification has passed, and after the data plaintext verification has passed, controlling the quantum network device according to the control instruction indicated by the data plaintext.

[0238] In the embodiment of the present invention, the specific process of data transmission between the network management center and the proxy server is as follows:

[0239] (1) The network management center sends a data encryption request to the first cryptographic machine; the data encryption request carries a session key and a plain text message;

[0240] (2) The first cryptographic machine receives a data encryption request sent by the network management center; generates data plaintext according to the index of the session key, the message plaintext, the unique identifier of the network management center, and the unique identifier of the proxy server; performs a cryptographic hash operation on the session key and the data plaintext to obtain a first digest value corresponding to the network management center; and sends the first digest value, the data plaintext, and the index of the session key to the network management center;

[0241] Exemplarily, the specific calculation steps for generating the first digest value are as follows:

[0242] 1)data=Index||IDSender||IDreceiver||Msg

[0243] 2)ESM3_data_Sender=SM3_HMAC(Keyindex, data)

[0244] Among them, || is a string connector, data is plain text data, Index is the index of the session key, IDSender is the unique identifier of the network management center, IDreceiver is the unique identifier of the proxy server, Msg is the plain text message, ESM3_data_Sender is the first summary value, SM3_HMAC(Key, X) means using the cryptographic hashing algorithm SM3 with the key Key to perform a cryptographic hashing operation on X, and Keyindex represents the session key with index Index.

[0245] (3) The network management center generates quantum network data according to the first summary value, the data plaintext, and the index of the session key; and sends the quantum network data to the proxy server;

[0246] Exemplarily, the message format of quantum network data can be as follows:

[0247] Index||ESM3_data_Sender||data

[0248] Among them, || is a string concatenation operator, Index is the index of the session key, ESM3_data_Sender is the first summary value, and data is the plaintext data.

[0249] (4) The proxy server receives the quantum network data sent by the network management center; obtains the session key from the second cipher machine according to the index of the session key; performs a hash operation on the data plaintext and the session key through the SM3_HMAC algorithm to obtain a second summary value; verifies the second summary value through the first summary value, and compares whether the values ​​of IDSender and IDreceiver in the data are consistent with those stored in the local database; when the first summary value is equal to the second summary value, and the values ​​of IDSender and IDreceiver are consistent with those stored in the local database, it is determined that the data plaintext verification has passed; and controls the quantum network device according to the control instructions indicated by the data plaintext.

[0250] In an embodiment of the present invention, the network management center can send data plaintext and data ciphertext to the proxy server at the same time. After the proxy server receives the quantum network data, the data plaintext can be encrypted by the same method as the first digest value to obtain a second digest value, and the first digest value and the second digest value are compared. If the data plaintext is intercepted and modified during transmission, the second digest value generated by the modified data plaintext must be unequal to the first digest value, and the proxy server can discard the modified data plaintext, thereby ensuring the security of data interaction between the network management center, the proxy server and the quantum network device. If the first digest value is equal to the second digest value, it means that the data plaintext has not been tampered with during the transmission process, and the proxy server can control the quantum network device according to the control instruction indicated by the data plaintext.

[0251] The network management center of the embodiment of the present invention can negotiate the session key with the proxy server after identity authentication with the proxy server to obtain the session key. The session key is generated based on the cryptographic algorithm and the cryptographic machine. The network management center and the proxy server can each be associated with a cryptographic machine to perform cryptographic operations and key management, so that the business system and the cryptographic logic can be completely decoupled; and the cryptographic algorithm of the embodiment of the present invention has higher security and economic advantages compared with the traditional encryption method; in addition, the negotiated session key can be stored in the cryptographic machine, and the key negotiation mechanism of the embodiment of the present invention can improve the success rate of key negotiation and protect the security of the negotiated key. The network management center can send quantum network data to the proxy server, and the quantum network data includes data plaintext and data ciphertext. The data ciphertext is obtained by encrypting the data plaintext with the session key, so that the proxy server verifies the data plaintext with the data ciphertext, and after the data plaintext is verified, the quantum network device is controlled according to the control instruction indicated by the data plaintext, and the data plaintext is verified by the data ciphertext to prevent the data plaintext from being tampered with during the transmission process, thereby ensuring the security of data interaction between the network management center, the proxy server and the quantum network device.

[0252] Reference Figure 2 , shows a flowchart of another quantum network data encryption method based on a cryptographic algorithm according to an embodiment of the present invention, which is applied to a proxy server. The method may specifically include the following steps:

[0253] Step 201, negotiate a session key with the network management center to obtain a session key;

[0254] In one embodiment, before performing session key negotiation with the network management center, the method further includes: performing identity authentication with the network management center; the step of performing identity authentication with the network management center may further include the following sub-steps:

[0255] Sub-step S41, receiving a first identity authentication request sent by the network management center, and returning a first identity authentication response to the network management center through the second key;

[0256] Among them, the second key includes a second PQC signature key and a second SM2 signature key; the first identity authentication request carries a third random number corresponding to the network management center; the receiving the first identity authentication request sent by the network management center and returning a first identity authentication response to the network management center through the second key includes: receiving the first identity authentication request sent by the network management center, signing the third random number through the private key of the second PQC signature key and the private key of the second SM2 signature key to obtain a first SM2 signature value and a first PQC signature value; returning the first identity authentication response to the network management center; the first identity authentication response carries the fourth random number corresponding to the proxy server, the second certificate corresponding to the proxy server, the first SM2 signature value and the first PQC signature value.

[0257] Sub-step S42: receiving a second identity authentication request sent by the network management center according to the first identity authentication response and the first key, and performing identity authentication with the network management center through the second identity authentication request.

[0258] Among them, the first key includes a first PQC signature key and a first SM2 signature key; the second identity authentication request carries the first PQC certificate, the second SM2 signature value and the second PQC signature value corresponding to the network management center; the second SM2 signature value and the second PQC signature value are obtained by signing the fourth random number with the private key of the first PQC signature key and the private key of the first SM2 signature key.

[0259] In the embodiment of the present invention, before the proxy server and the network management center negotiate the session key, it is also necessary to obtain the first key and the first certificate corresponding to the network management center, and the second key and the second certificate corresponding to the proxy server. The specific certificate application process is as follows:

[0260] The network management center sends a first digital certificate application request carrying the unique identification of the network management center to its corresponding first cryptographic machine through the SDK (Software Development Kit) security interface;

[0261] The first cryptographic machine creates a first key corresponding to the network management center, including a first PQC signature key, a first SM2 signature key, a first PQC encryption key and a first SM2 encryption key; generates a first certificate request file according to the unique identifier of the network management center, the public key of the first PQC signature key, the public key of the first PQC encryption key and the public key of the first SM2 signature key, and the first certificate request file may be a P10 certificate request file; sends the first certificate request file to the certificate issuing center;

[0262] The proxy server sends a second digital certificate application request carrying the unique identifier of the proxy server to its corresponding second cryptographic machine through the SDK security interface;

[0263] The second cryptographic machine creates a second key corresponding to the proxy server, including a second PQC signature key, a second SM2 signature key, a second PQC encryption key and a second SM2 encryption key; generates a second certificate request file according to the unique identifier of the proxy server, the public key of the second PQC signature key, the public key of the second PQC encryption key and the public key of the second SM2 signature key, and the second certificate request file may also be a P10 certificate request file; and sends the second certificate request file to the certificate issuing center;

[0264] The certificate issuing center verifies the domain name, identity code and organization code of the applicant of the network management center according to the P10 certificate request file; after successful verification, the first certificate corresponding to the network management center is generated; the first certificate includes the first PQC certificate, the first SM2 encryption certificate and the first SM2 signature certificate, the first SM2 encryption certificate includes the public key of the first PQC encryption key, and the first SM2 signature certificate includes the public key of the first PQC signature key; the first certificate is sent to the first cryptographic machine;

[0265] The certificate issuing center verifies the domain name, identity code and organization code of the applicant of the proxy server according to the P10 certificate request file; after successful verification, it generates a second certificate corresponding to the proxy server; the second certificate includes a second PQC certificate, a second SM2 encryption certificate and a second SM2 signature certificate, the second SM2 encryption certificate includes the public key of the second PQC encryption key, and the second SM2 signature certificate includes the public key of the second PQC signature key; the second certificate is sent to the second cryptographic machine.

[0266] Since then, the certificate application and issuance of the network management center and the proxy server have been completed. After the certificate application is completed, the network management center and the proxy server still need to perform identity authentication. The specific identity authentication process is as follows:

[0267] The network management center obtains the first certificate and the third random number corresponding to the network management center from the first cryptographic machine through the SDK security interface; sends a first identity authentication request carrying the third random number to the proxy server;

[0268] The proxy server receives the first identity authentication request sent by the network management center; obtains the second certificate corresponding to the proxy server from the second cryptographic machine through the SDK security interface; signs the third random number through the second cryptographic machine using the private key of the second PQC signature key and the private key of the second SM2 signature key to obtain the first SM2 signature value and the first PQC signature value; sends the first identity authentication response to the network management center; the first identity authentication response carries the fourth random number corresponding to the proxy server, the second certificate, the first SM2 signature value and the first PQC signature value;

[0269] Exemplarily, the message format of the first identity authentication response may be as follows:

[0270] SM2_singcert_B||SM2_cryptocert_B||PQC_crytocert_B||SignB_PQC(RA)||SignB_SM2(RA)||RB

[0271] Among them, || is a string connector, SM2_singcert_B is the second SM2 signature certificate, SM2_cryptocert_B is the second SM2 encryption certificate, PQC_crytocert_B is the second PQC encryption certificate, SignB_PQC(RA) is the first PQC signature value, SignB_SM2(RA) is the first SM2 signature value, and RB is the fourth random number.

[0272] The network management center receives the first identity authentication response sent by the proxy server; uses the public key of the second PQC signature key stored locally by the proxy server and the PQC algorithm to decrypt and verify the first PQC signature value, and uses the public key of the second SM2 signature key stored locally by the proxy server and the SM2 algorithm to decrypt and verify the first SM2 signature value. If both are successfully verified, the network management center successfully authenticates the proxy server; if the verification is successful, the fourth random number is signed by the private key of the first PQC signature key and the private key of the first SM2 signature key to obtain the second SM2 signature value and the second PQC signature value; sends a second identity authentication request to the proxy server; the second identity authentication request carries the first certificate, the second SM2 signature value and the second PQC signature value;

[0273] Exemplarily, the message format of the second identity authentication request may be as follows:

[0274] SM2_singcert_A||SM2_cryptocert_A||PQC_crytocert_A||SignA_PQC(RB)||SignA_SM2(RB)

[0275] Among them, || is a string connector, SM2_singcert_A is the first SM2 signing certificate, SM2_cryptocert_A is the first SM2 encryption certificate, PQC_crytocert_A is the first PQC encryption certificate, SignA_PQC(RB) is the second PQC signature value, SignA_SM2(RB) is the second SM2 signature value, and RA is the third random number.

[0276] The proxy server receives the second identity authentication request sent by the network management center; verifies the first certificate, the second SM2 signature value and the second PQC signature value according to the agreed method; if both are successfully verified, the proxy server successfully authenticates the identity of the network management center.

[0277] Since then, the identity authentication between the proxy server and the network management center is successful. After the identity authentication between the proxy server and the network management center is successful, the proxy server can negotiate a session key with the network management center to obtain the session key, so that communication can be encrypted using the session key.

[0278] The step of negotiating a session key with the network management center to obtain a session key may also include the following sub-steps:

[0279] Sub-step S51, after identity authentication with the network management center, receiving a key negotiation request sent by the network management center; the key negotiation request is generated according to a first negotiation key, and the first negotiation key is generated by the cryptographic algorithm and a second key corresponding to the proxy server;

[0280] Among them, the second key includes a second PQC encryption key and a second SM2 encryption key; the cryptographic algorithm includes an SM2 algorithm, a PQC algorithm and an SM3 algorithm; the key negotiation request is generated based on a first encrypted random number and a first hash value; the first encrypted random number is obtained by encrypting the first random number corresponding to the network management center through the public key of the second SM2 encryption key and the SM2 algorithm; the first hash value is obtained by performing a hash operation on the first random number and the first negotiation key through the SM3 algorithm; the first negotiation key is generated by the public key of the second PQC encryption key and the PQC algorithm.

[0281] Sub-step S52, based on the first key corresponding to the network management center and the first negotiated key, returns a key negotiation request response to the network management center, so that the network management center verifies the first negotiated key based on the key negotiation request response, and uses the first negotiated key as the session key after the first negotiated key verification is passed.

[0282] Among them, the first key includes a first PQC encryption key and a first SM2 encryption key; the key negotiation request response is returned to the network management center according to the first key corresponding to the network management center and the first negotiation key, so that the network management center verifies the first negotiation key according to the key negotiation request response, and uses the first negotiation key as the session key after the first negotiation key verification is passed, including: obtaining the first random number and the first negotiation key according to the first encrypted random number and the first hash value; obtaining the second random number corresponding to the proxy server; encrypting the second random number by using the public key of the first SM2 encryption key and the SM2 algorithm to obtain a second encrypted random number; obtaining the second negotiation key by using the first random number, the second random number and the first negotiation key; performing a hash operation on the second negotiation key by using the SM3 algorithm to obtain a second hash value; generating the key negotiation request response according to the second encrypted random number and the second hash value; returning the key negotiation request response to the network management center, so that the network management center verifies the first negotiation key according to the key negotiation request response, and uses the first negotiation key as the session key after the first negotiation key verification is passed.

[0283] When the second hash value is equal to the third hash value, the network management center determines that the first negotiated key verification has passed; the third hash value is obtained by performing a hash operation on the third negotiated key by the SM3 algorithm; the third negotiated key is obtained by the first random number, the second random number and the first negotiated key; the second random number is obtained by decrypting the second encrypted random number by the private key of the first SM2 encryption key; the second encrypted random number and the second hash value are obtained according to the key negotiation request response.

[0284] In the embodiment of the present invention, the specific process of the proxy server and the network management center performing session key negotiation is as follows:

[0285] The network management center obtains the first random number from the first cipher machine through the SDK security interface; encrypts the first random number through the public key of the second SM2 encryption key and the SM2 algorithm to obtain a first encrypted random number; generates a first negotiation key and a ciphertext through the public key of the second PQC encryption key and the PQC algorithm; performs a hash operation on the first random number and the first negotiation key through the SM3 algorithm to obtain a first hash value; generates a key negotiation request based on the first encrypted random number and the first hash value; and sends the key negotiation request to the proxy server;

[0286] Exemplarily, the message format of the key agreement request may be as follows:

[0287] CT||Esm2(RA)||SM3_hash(RA||RAB)

[0288] Among them, || is a string connector, CT is the cipher text, Esm2(RA) is the first encrypted random number, RA is the first random number, RAB is the first negotiated key, and SM3_hash(RA||RAB) is the first hash value.

[0289] The proxy server receives a key negotiation request sent by the network management center; parses the key negotiation request to obtain a first random number and a first negotiation key; obtains a second random number corresponding to the proxy server from a second cryptographic machine through an SDK security interface; encrypts the second random number through a public key of the first SM2 encryption key and an SM2 algorithm to obtain a second encrypted random number; obtains a second negotiation key through the first random number, a second random number and the first negotiation key; performs a hash operation on the second negotiation key through an SM3 algorithm to obtain a second hash value; generates a key negotiation request response based on the second encrypted random number and the second hash value; and returns the key negotiation request response to the network management center;

[0290] Exemplarily, the message format of the key agreement request response may be as follows:

[0291] Esm2(RB)||SM3_hash(Kab)

[0292] Among them, || is a string concatenation operator, Esm2(RB) is the second encrypted random number, RB is the second random number, SM3_hash(Kab) is the second hash value, and Kab is the second negotiated key. The specific calculation steps for generating the second negotiated key Kab are as follows:

[0293] 1) Xab=XOR(RA||RB,RAB);

[0294] 2)Kab=XOR(Slice_Left(Xab, 16), Slice_Right(Xab, 16));

[0295] The calculation functions used include: XOR function XOR(A, B), string left interception function Slice_Left(A, len), and string right interception function Slice_Right(A, len). In step 1), RA||RB is the string concatenation of the first random number and the second random number, XOR(RA||RB, RAB) is the XOR processing of RA||RB and RAB, and Xab is the string after the XOR processing. In step 2), Slice_Left(Xab, 16) is to intercept the first 16 bytes L_16bit of Xab, Slice_Right(Xab, 16) is to intercept the last 16 bytes R_16bit of Xab, and XOR(L_16bit, R_16bit) is to XOR L_16bit with R_16bit, and finally obtain the second negotiated key Kab.

[0296] The network management center receives the key negotiation request response returned by the proxy server; obtains a second encrypted random number and a second hash value according to the key negotiation request response; decrypts the second encrypted random number by using the private key of the first SM2 encryption key to obtain a second random number; obtains a third negotiation key by using the first random number, the second random number and the first negotiation key; performs a hash operation on the third negotiation key by using the SM3 algorithm to obtain a third hash value; and when the second hash value is equal to the third hash value, determines that the first negotiation key verification has passed.

[0297] Exemplarily, the specific generation process of the third negotiated key is: concatenate the strings of the first random number and the second random number to obtain RA||RB, perform XOR processing on RA||RB and RAB, then intercept the first 16 bytes L_16bit and the last 16 bytes R_16bit, perform XOR processing again, and finally obtain the third negotiated key. Perform a hash operation on the third negotiated key through the SM3 algorithm to obtain a third hash value; when the second hash value is equal to the third hash value, it is determined that the first negotiated key verification has passed.

[0298] In the embodiment of the present invention, after the first negotiated key is verified, the first negotiated key can be used as the session key. The session key is generated based on the cryptographic algorithm and the cryptographic machine. The network management center and the proxy server can each be associated with a cryptographic machine to perform cryptographic operations and key management, so that the business system and the cryptographic logic can be completely decoupled; and the cryptographic algorithm of the embodiment of the present invention has higher security and economic advantages compared to the traditional encryption method; in addition, the negotiated session key can be stored in the cryptographic machine. The key negotiation mechanism of the embodiment of the present invention can improve the success rate of key negotiation and protect the security of the negotiated key.

[0299] Step 202, receiving quantum network data sent by the network management center, the quantum network data including data plaintext and data ciphertext, the data ciphertext being obtained by encrypting the data plaintext using the session key;

[0300] Step 203: verify the data plaintext through the data ciphertext, and after the data plaintext is verified, control the quantum network device according to the control instruction indicated by the data plaintext.

[0301] In one embodiment, the cryptographic algorithm includes an SM3_HMAC algorithm; the quantum network data is generated according to a first summary value corresponding to the data plaintext and the data ciphertext; the first summary value is obtained by performing a hash operation on the data plaintext and the session key by the SM3_HMAC algorithm; the step of verifying the data plaintext by the data ciphertext, and after the data plaintext is verified, controlling the quantum network device according to the control instruction indicated by the data plaintext, may also include the following sub-steps:

[0302] Sub-step S61, performing a hash operation on the data plaintext and the session key by using the SM3_HMAC algorithm to obtain a second digest value;

[0303] Sub-step S62, when the first digest value is equal to the second digest value, determining that the data plaintext verification has passed, and after the data plaintext verification has passed, controlling the quantum network device according to the control instruction indicated by the data plaintext.

[0304] In the embodiment of the present invention, the specific process of data transmission between the network management center and the proxy server is as follows:

[0305] The network management center sends a data encryption request to the first cipher machine; the data encryption request carries a session key and a plain text message;

[0306] The first cryptographic machine receives a data encryption request sent by the network management center; generates data plaintext according to the index of the session key, the message plaintext, the unique identifier of the network management center and the unique identifier of the proxy server; performs a cryptographic hash operation on the session key and the data plaintext to obtain a first digest value corresponding to the network management center; and sends the first digest value, the data plaintext and the index of the session key to the network management center;

[0307] Exemplarily, the specific calculation steps for generating the first digest value are as follows:

[0308] 1)data=Index||IDSender||IDreceiver||Msg

[0309] 2)ESM3_data_Sender=SM3_HMAC(Keyindex, data)

[0310] Among them, || is a string connector, data is plain text data, Index is the index of the session key, IDSender is the unique identifier of the network management center, IDreceiver is the unique identifier of the proxy server, Msg is the plain text message, ESM3_data_Sender is the first summary value, SM3_HMAC(Key, X) means using the cryptographic hashing algorithm SM3 with the key Key to perform a cryptographic hashing operation on X, and Keyindex represents the session key with index Index.

[0311] The network management center generates quantum network data according to the first summary value, the data plaintext, and the index of the session key; and sends the quantum network data to the proxy server;

[0312] Exemplarily, the message format of quantum network data can be as follows:

[0313] Index||ESM3_data_Sender||data

[0314] Among them, || is a string concatenation operator, Index is the index of the session key, ESM3_data_Sender is the first summary value, and data is the plaintext data.

[0315] The proxy server receives the quantum network data sent by the network management center; obtains the session key from the second cipher machine according to the index of the session key; performs a hash operation on the data plaintext and the session key through the SM3_HMAC algorithm to obtain a second summary value; verifies the second summary value through the first summary value, and compares whether the values ​​of IDSender and IDreceiver in the data are consistent with those stored in the local database; when the first summary value is equal to the second summary value, and the values ​​of IDSender and IDreceiver are consistent with those stored in the local database, it is determined that the data plaintext verification has passed; and controls the quantum network device according to the control instructions indicated by the data plaintext.

[0316] In an embodiment of the present invention, the proxy server can simultaneously receive the data plaintext and data ciphertext sent by the network management center, and then encrypt the data plaintext by the same method as the first digest value to obtain the second digest value, and compare the first digest value with the second digest value. If the data plaintext is intercepted and modified during transmission, the second digest value generated by the modified data plaintext must be unequal to the first digest value, and the proxy server can discard the modified data plaintext, thereby ensuring the security of data interaction between the network management center, the proxy server and the quantum network device. If the first digest value is equal to the second digest value, it means that the data plaintext has not been tampered with during the transmission process, and the proxy server can control the quantum network device according to the control instruction indicated by the data plaintext.

[0317] The proxy server of the embodiment of the present invention can perform session key negotiation with the network management center after identity authentication with the network management center to obtain the session key. The session key is generated based on the cryptographic algorithm and the cryptographic machine. The network management center and the proxy server can each be associated with a cryptographic machine to perform cryptographic operations and key management, so that the business system and the cryptographic logic can be completely decoupled; and the cryptographic algorithm of the embodiment of the present invention has higher security and economic advantages compared with the traditional encryption method; in addition, the negotiated session key can be stored in the cryptographic machine, and the key negotiation mechanism of the embodiment of the present invention can improve the success rate of key negotiation and protect the security of the negotiated key. The proxy server can receive quantum network data sent by the network management center, and the quantum network data includes data plaintext and data ciphertext. The data ciphertext is obtained by encrypting the data plaintext with the session key; the data plaintext is verified by the data ciphertext, and after the data plaintext verification is passed, the quantum network device is controlled according to the control instruction indicated by the data plaintext, and the data plaintext is verified by the data ciphertext to prevent the data plaintext from being tampered with during the transmission process, thereby ensuring the security of data interaction between the network management center, the proxy server and the quantum network device.

[0318] For the method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0319] Reference Figure 3 , shows a block diagram of a quantum network data encryption system based on a cryptographic algorithm provided in an embodiment of the present invention, wherein the quantum network data encryption system 30 comprises: a network management center 31, a proxy server 32 and a quantum network device 33;

[0320] The network management center 31 is used to negotiate a session key with the proxy server 32 to obtain a session key; send quantum network data to the proxy server 32, the quantum network data includes data plaintext and data ciphertext, and the data ciphertext is obtained by encrypting the data plaintext with the session key;

[0321] The proxy server 32 is used to negotiate a session key with the network management center 31 to obtain a session key; receive quantum network data sent by the network management center 31; verify the data plaintext through the data ciphertext, and after the data plaintext is verified, control the quantum network device 33 according to the control instructions indicated by the data plaintext.

[0322] In the embodiment of the present invention, the network management center 31 is used to generate a first negotiation key through the cryptographic algorithm and the second key corresponding to the proxy server, and generate a key negotiation request according to the first negotiation key; and send the key negotiation request to the proxy server 32;

[0323] The proxy server 32 is used to receive the key negotiation request sent by the network management center 31; according to the first key corresponding to the network management center 31 and the first negotiated key, return a key negotiation request response to the network management center 31;

[0324] The network management center 31 is used to verify the first negotiated key according to the key negotiation request response; after the first negotiated key is verified, use the first negotiated key as a session key.

[0325] In the embodiment of the present invention, the network management center 31 is also used to perform identity authentication with the proxy server 32; after performing identity authentication with the proxy server 32, perform session key negotiation with the proxy server 32;

[0326] The proxy server 32 is also used to perform identity authentication with the network management center 31 ; after performing identity authentication with the network management center 31 , the proxy server 32 performs session key negotiation with the network management center 31 .

[0327] In the embodiment of the present invention, the second key includes a second PQC encryption key and a second SM2 encryption key; the cryptographic algorithm includes an SM2 algorithm, a PQC algorithm, and an SM3 algorithm;

[0328] The network management center 31 is used to generate the first negotiation key through the public key of the second PQC encryption key and the PQC algorithm; obtain the first random number corresponding to the network management center 31; encrypt the first random number through the public key of the second SM2 encryption key and the SM2 algorithm to obtain a first encrypted random number; perform a hash operation on the first random number and the first negotiation key through the SM3 algorithm to obtain a first hash value; and generate a key negotiation request based on the first encrypted random number and the first hash value.

[0329] In an embodiment of the present invention, the first key includes a first PQC encryption key and a first SM2 encryption key;

[0330] The proxy server 32 is used to obtain the first random number and the first negotiation key according to the first encrypted random number and the first hash value; obtain the second random number corresponding to the proxy server 32; encrypt the second random number by using the public key of the first SM2 encryption key and the SM2 algorithm to obtain a second encrypted random number; obtain a second negotiation key by using the first random number, the second random number and the first negotiation key; perform a hash operation on the second negotiation key by using the SM3 algorithm to obtain a second hash value; generate the key negotiation request response according to the second encrypted random number and the second hash value; and return the key negotiation request response to the network management center 31.

[0331] In an embodiment of the present invention, the network management center 31 is used to obtain the second encrypted random number and the second hash value according to the key negotiation request response; decrypt the second encrypted random number by using the private key of the first SM2 encryption key to obtain the second random number; obtain the third negotiation key by using the first random number, the second random number and the first negotiation key; perform a hash operation on the third negotiation key by using the SM3 algorithm to obtain a third hash value; and when the second hash value is equal to the third hash value, determine that the first negotiation key verification is successful.

[0332] In an embodiment of the present invention, the cryptographic algorithm includes an SM3_HMAC algorithm;

[0333] The network management center 31 is used to obtain a first summary value corresponding to the data plaintext and the data ciphertext; the first summary value is obtained by performing a hash operation on the data plaintext and the session key through the SM3_HMAC algorithm; generate the quantum network data according to the data plaintext and the first summary value; and send the quantum network data to the proxy server 32;

[0334] The proxy server 32 is used to perform a hash operation on the data plaintext and the session key through the SM3_HMAC algorithm to obtain a second digest value; when the first digest value is equal to the second digest value, it is determined that the data plaintext verification has passed, and after the data plaintext verification has passed, the quantum network device 33 is controlled according to the control instruction indicated by the data plaintext.

[0335] In the embodiment of the present invention, it also includes: a certificate issuing center 34, a first cryptographic machine 35 and a second cryptographic machine 36; the first cryptographic machine 35 is associated with the network management center 31, and the second cryptographic machine 36 is associated with the proxy server 32;

[0336] The first cryptographic machine 35 is used to create the first key corresponding to the network management center 31; generate a first certificate request file according to the unique identifier of the network management center 31 and the first key; and send the first certificate request file to the certificate issuing center 34;

[0337] The second cryptographic machine 36 is used to create the second key corresponding to the proxy server 32; generate a second certificate request file according to the unique identifier of the proxy server and the second key; and send the second certificate request file to the certificate issuing center 34;

[0338] The certificate issuing center 34 is used to receive the first certificate request file sent by the first cryptographic machine 35, generate the first certificate corresponding to the network management center 31, and return the first certificate to the first cryptographic machine 35; receive the second certificate request file sent by the second cryptographic machine 36, generate the second certificate corresponding to the proxy server 32, and return the second certificate to the second cryptographic machine 36;

[0339] The network management center 31 is used to send a first identity authentication request to the proxy server 32, so that the proxy server 32 returns a first identity authentication response through the second key; send a second identity authentication request to the proxy server 32 according to the first identity authentication response and the first key;

[0340] The proxy server 32 is used to receive a second identity authentication request sent by the network management center 31 according to the first identity authentication response and the first key, and perform identity authentication with the network management center 31 through the second identity authentication request.

[0341] In the embodiment of the present invention, the second key includes a second PQC signature key and a second SM2 signature key; the first identity authentication request carries a third random number corresponding to the network management center 31;

[0342] The proxy server 32 is used to receive the first identity authentication request sent by the network management center 31, sign the third random number through the private key of the second PQC signature key and the private key of the second SM2 signature key, and obtain the first SM2 signature value and the first PQC signature value; return the first identity authentication response to the network management center 31; the first identity authentication response carries the fourth random number corresponding to the proxy server 32, the second certificate, the first SM2 signature value and the first PQC signature value.

[0343] In an embodiment of the present invention, the first key includes a first PQC signature key and a first SM2 signature key;

[0344] The network management center 31 is used to sign the fourth random number by using the private key of the first PQC signature key and the private key of the first SM2 signature key to obtain a second SM2 signature value and a second PQC signature value; and send a second identity authentication request to the proxy server 32; the second identity authentication request carries the first certificate, the second SM2 signature value and the second PQC signature value.

[0345] The proxy server 32 is used to receive the second identity authentication request sent by the network management center 31, and perform identity authentication according to the second identity authentication request.

[0346] The network management center of the embodiment of the present invention can negotiate the session key with the proxy server after identity authentication with the proxy server to obtain the session key. The session key is generated based on the cryptographic algorithm and the cryptographic machine. The network management center and the proxy server can each be associated with a cryptographic machine to perform cryptographic operations and key management, so that the business system and the cryptographic logic can be completely decoupled; and the cryptographic algorithm of the embodiment of the present invention has higher security and economic advantages compared with the traditional encryption method; in addition, the negotiated session key can be stored in the cryptographic machine, and the key negotiation mechanism of the embodiment of the present invention can improve the success rate of key negotiation and protect the security of the negotiated key. The network management center can send quantum network data to the proxy server, and the quantum network data includes data plaintext and data ciphertext. The data ciphertext is obtained by encrypting the data plaintext with the session key, so that the proxy server verifies the data plaintext with the data ciphertext, and after the data plaintext is verified, the quantum network device is controlled according to the control instruction indicated by the data plaintext, and the data plaintext is verified by the data ciphertext to prevent the data plaintext from being tampered with during the transmission process, thereby ensuring the security of data interaction between the network management center, the proxy server and the quantum network device.

[0347] Reference Figure 4, shows a block diagram of a quantum network data encryption device based on a cryptographic algorithm provided by an embodiment of the present invention, which is applied to a network management center and may specifically include the following modules:

[0348] A first session key negotiation module 401, configured to negotiate a session key with a proxy server to obtain a session key;

[0349] The quantum network data sending module 402 is used to send quantum network data to the proxy server, wherein the quantum network data includes plaintext data and ciphertext data, and the ciphertext data is obtained by encrypting the plaintext data with the session key, so that the proxy server verifies the plaintext data with the ciphertext data, and controls the quantum network device according to the control instruction indicated by the plaintext data after the plaintext data is verified.

[0350] In this embodiment of the present invention, the first session key negotiation module 401 includes:

[0351] a key negotiation request generation submodule, configured to generate a first negotiation key by using the cryptographic algorithm and a second key corresponding to the proxy server, and to generate a key negotiation request according to the first negotiation key;

[0352] A key negotiation request sending submodule, used to send a key negotiation request to the proxy server, so that the proxy server returns a key negotiation request response according to the first key corresponding to the network management center and the first negotiated key;

[0353] A first negotiated key verification submodule, configured to verify the first negotiated key according to the key negotiation request response;

[0354] The session key determination submodule is used to use the first negotiated key as the session key after the first negotiated key is verified.

[0355] In the embodiment of the present invention, before the first session key negotiation module 401, the device further includes:

[0356] A first identity authentication module, used for performing identity authentication with the proxy server;

[0357] The first session key negotiation module 401 includes:

[0358] The first session key negotiation submodule is used to negotiate a session key with the proxy server after identity authentication with the proxy server.

[0359] In the embodiment of the present invention, the second key includes a second PQC encryption key and a second SM2 encryption key; the cryptographic algorithm includes an SM2 algorithm, a PQC algorithm, and an SM3 algorithm; the key agreement request generation submodule includes:

[0360] A first negotiation key generating unit, configured to generate the first negotiation key by using a public key of the second PQC encryption key and the PQC algorithm;

[0361] A first random number acquisition unit, used to acquire a first random number corresponding to the network management center;

[0362] A first random number encryption unit, configured to encrypt the first random number by using the public key of the second SM2 encryption key and the SM2 algorithm to obtain a first encrypted random number;

[0363] A first hash value calculation unit, configured to perform a hash operation on the first random number and the first negotiated key by using the SM3 algorithm to obtain a first hash value;

[0364] A key negotiation request generating unit is used to generate a key negotiation request according to the first encrypted random number and the first Hash value.

[0365] In the embodiment of the present invention, the first key includes a first PQC encryption key and a first SM2 encryption key; the key negotiation request sending submodule includes:

[0366] A key negotiation request sending unit is used to send a key negotiation request to the proxy server, so that the proxy server obtains the first random number and the first negotiation key according to the first encrypted random number and the first hash value, and returns the key negotiation request response to the network management center according to the first random number and the first negotiation key; the key negotiation request response carries a second encrypted random number and a second hash value; the second encrypted random number is obtained by encrypting the second random number corresponding to the proxy server through the public key of the first SM2 encryption key and the SM2 algorithm; the second hash value is obtained by performing a hash operation on the second negotiation key through the SM3 algorithm; the second negotiation key is obtained by the first random number, the second random number and the first negotiation key.

[0367] In this embodiment of the present invention, the first negotiated key verification submodule includes:

[0368] A second encrypted random number acquisition unit, configured to acquire the second encrypted random number and the second hash value according to the key agreement request response;

[0369] A second random number decryption unit, configured to decrypt the second encrypted random number by using a private key of the first SM2 encryption key to obtain the second random number;

[0370] A third negotiated key generating unit, configured to obtain a third negotiated key through the first random number, the second random number and the first negotiated key;

[0371] A third hash value operation unit, configured to perform a hash operation on the third negotiated key by using the SM3 algorithm to obtain a third hash value;

[0372] The first negotiated key verification unit is configured to determine that the first negotiated key verification succeeds when the second Hash value is equal to the third Hash value.

[0373] In the embodiment of the present invention, the cryptographic algorithm includes the SM3_HMAC algorithm; the quantum network data sending module 402 includes:

[0374] A first digest value acquisition submodule is used to obtain a first digest value corresponding to the data plaintext and the data ciphertext; the first digest value is obtained by performing a hash operation on the data plaintext and the session key by the SM3 HMAC algorithm;

[0375] A quantum network data generation submodule, used to generate the quantum network data according to the data plaintext and the first summary value;

[0376] The quantum network data sending submodule is used to send the quantum network data to the proxy server, so that the proxy server performs a hash operation on the data plaintext and the session key through the SM3_HMAC algorithm to obtain a second digest value, and when the first digest value is equal to the second digest value, it is determined that the data plaintext verification has passed, and after the data plaintext verification has passed, the quantum network device is controlled according to the control instruction indicated by the data plaintext.

[0377] In an embodiment of the present invention, the first identity authentication module includes:

[0378] A first identity authentication request sending submodule, configured to send a first identity authentication request to the proxy server, so that the proxy server returns a first identity authentication response through the second key;

[0379] The second identity authentication request sending submodule is used to send a second identity authentication request to the proxy server according to the first identity authentication response and the first key, so that the proxy server performs identity authentication.

[0380] In this embodiment of the present invention, the second key includes a second PQC signature key and a second SM2 signature key; the first identity authentication request sending submodule includes:

[0381] The first identity authentication request sending unit is used to send a first identity authentication request to the proxy server, wherein the first identity authentication request carries a third random number corresponding to the network management center, so that the proxy server signs the third random number through the private key of the second PQC signature key and the private key of the second SM2 signature key, obtains a first SM2 signature value and a first PQC signature value, and returns the first identity authentication response; the first identity authentication response carries a fourth random number corresponding to the proxy server, the second certificate corresponding to the proxy server, the first SM2 signature value and the first PQC signature value.

[0382] In an embodiment of the present invention, the first key includes a first PQC signature key and a first SM2 signature key; the second identity authentication request sending submodule includes:

[0383] a fourth random number signing unit, configured to sign the fourth random number by using the private key of the first PQC signature key and the private key of the first SM2 signature key to obtain a second SM2 signature value and a second PQC signature value;

[0384] The second identity authentication request sending unit is used to send a second identity authentication request to the proxy server; the second identity authentication request carries the first PQC certificate corresponding to the network management center, the second SM2 signature value and the second PQC signature value, so that the proxy server performs identity authentication.

[0385] The network management center of the embodiment of the present invention can negotiate the session key with the proxy server after identity authentication with the proxy server to obtain the session key. The session key is generated based on the cryptographic algorithm and the cryptographic machine. The network management center and the proxy server can each be associated with a cryptographic machine to perform cryptographic operations and key management, so that the business system and the cryptographic logic can be completely decoupled; and the cryptographic algorithm of the embodiment of the present invention has higher security and economic advantages compared with the traditional encryption method; in addition, the negotiated session key can be stored in the cryptographic machine, and the key negotiation mechanism of the embodiment of the present invention can improve the success rate of key negotiation and protect the security of the negotiated key. The network management center can send quantum network data to the proxy server, and the quantum network data includes data plaintext and data ciphertext. The data ciphertext is obtained by encrypting the data plaintext with the session key, so that the proxy server verifies the data plaintext with the data ciphertext, and after the data plaintext is verified, the quantum network device is controlled according to the control instruction indicated by the data plaintext, and the data plaintext is verified by the data ciphertext to prevent the data plaintext from being tampered with during the transmission process, thereby ensuring the security of data interaction between the network management center, the proxy server and the quantum network device.

[0386] Reference Figure 5 , shows a structural block diagram of another quantum network data encryption device based on a cryptographic algorithm provided by an embodiment of the present invention, which is applied to a proxy server and may specifically include the following modules:

[0387] The second session key negotiation module 501 is used to negotiate the session key with the network management center to obtain the session key;

[0388] A quantum network data receiving module 502 is used to receive quantum network data sent by the network management center, wherein the quantum network data includes plaintext data and ciphertext data, and the ciphertext data is obtained by encrypting the plaintext data using the session key;

[0389] The quantum network device control module 503 is used to verify the data plaintext through the data ciphertext, and after the data plaintext is verified, control the quantum network device according to the control instruction indicated by the data plaintext.

[0390] In this embodiment of the present invention, the second session key negotiation module 501 includes:

[0391] A key negotiation request receiving submodule, configured to receive a key negotiation request sent by the network management center; the key negotiation request is generated according to a first negotiation key, and the first negotiation key is generated by the cryptographic algorithm and a second key corresponding to the proxy server;

[0392] The second session key negotiation submodule is used to return a key negotiation request response to the network management center according to the first key corresponding to the network management center and the first negotiated key, so that the network management center verifies the first negotiated key according to the key negotiation request response, and uses the first negotiated key as the session key after the first negotiated key verification is passed.

[0393] In the embodiment of the present invention, before the second session key negotiation module 501, the device further includes:

[0394] A second identity authentication module, used for performing identity authentication with the network management center;

[0395] The second session key negotiation module 501 includes:

[0396] The second identity authentication submodule is used to negotiate a session key with the network management center after identity authentication with the network management center.

[0397] In an embodiment of the present invention, the second key includes a second PQC encryption key and a second SM2 encryption key; the cryptographic algorithm includes an SM2 algorithm, a PQC algorithm and an SM3 algorithm; the key negotiation request is generated based on a first encrypted random number and a first hash value; the first encrypted random number is obtained by encrypting the first random number corresponding to the network management center using the public key of the second SM2 encryption key and the SM2 algorithm; the first hash value is obtained by performing a hash operation on the first random number and the first negotiation key using the SM3 algorithm; the first negotiation key is generated using the public key of the second PQC encryption key and the PQC algorithm.

[0398] In the embodiment of the present invention, the first key includes a first PQC encryption key and a first SM2 encryption key; the second session key negotiation submodule includes:

[0399] A first negotiated key acquisition unit, configured to obtain the first random number and the first negotiated key according to the first encrypted random number and the first hash value;

[0400] A second random number obtaining unit, used to obtain a second random number corresponding to the proxy server;

[0401] A second random number encryption unit, used to encrypt the second random number by using the public key of the first SM2 encryption key and the SM2 algorithm to obtain a second encrypted random number;

[0402] A second negotiated key generating unit, configured to obtain a second negotiated key through the first random number, the second random number and the first negotiated key;

[0403] A second hash value operation unit, configured to perform a hash operation on the second negotiated key by using the SM3 algorithm to obtain a second hash value;

[0404] a key agreement request response generating unit, configured to generate the key agreement request response according to the second encrypted random number and the second hash value;

[0405] The second session key negotiation unit is used to return the key negotiation request response to the network management center, so that the network management center verifies the first negotiated key according to the key negotiation request response, and uses the first negotiated key as the session key after the first negotiated key verification is passed.

[0406] In an embodiment of the present invention, the network management center determines that the first negotiated key verification is passed when the second hash value is equal to the third hash value; the third hash value is obtained by performing a hash operation on the third negotiated key by the SM3 algorithm; the third negotiated key is obtained by the first random number, the second random number and the first negotiated key; the second random number is obtained by decrypting the second encrypted random number by the private key of the first SM2 encryption key; the second encrypted random number and the second hash value are obtained according to the key negotiation request response.

[0407] In an embodiment of the present invention, the cryptographic algorithm includes an SM3_HMAC algorithm; the quantum network data is generated according to a first summary value corresponding to the data plaintext and the data ciphertext; the first summary value is obtained by performing a hash operation on the data plaintext and the session key by the SM3_HMAC algorithm; the quantum network device control module 503 includes:

[0408] A second digest value operation submodule, configured to perform a hash operation on the data plaintext and the session key by using the SM3_HMAC algorithm to obtain a second digest value;

[0409] The quantum network device control submodule is used to determine that the data plaintext verification has passed when the first summary value is equal to the second summary value, and after the data plaintext verification has passed, control the quantum network device according to the control instruction indicated by the data plaintext.

[0410] In an embodiment of the present invention, the second identity authentication module includes:

[0411] A first identity authentication request receiving submodule, configured to receive a first identity authentication request sent by the network management center, and return a first identity authentication response to the network management center through the second key;

[0412] The second identity authentication request receiving submodule is used to receive a second identity authentication request sent by the network management center according to the first identity authentication response and the first key, and perform identity authentication with the network management center through the second identity authentication request.

[0413] In an embodiment of the present invention, the second key includes a second PQC signature key and a second SM2 signature key; the first identity authentication request carries a third random number corresponding to the network management center; and the first identity authentication request receiving submodule includes:

[0414] A third random number signature unit is used to receive the first identity authentication request sent by the network management center, and sign the third random number by using the private key of the second PQC signature key and the private key of the second SM2 signature key to obtain a first SM2 signature value and a first PQC signature value;

[0415] The first identity authentication response returning unit is used to return the first identity authentication response to the network management center; the first identity authentication response carries the fourth random number corresponding to the proxy server, the second certificate corresponding to the proxy server, the first SM2 signature value and the first PQC signature value.

[0416] In an embodiment of the present invention, the first key includes a first PQC signature key and a first SM2 signature key; the second identity authentication request carries the first PQC certificate, the second SM2 signature value and the second PQC signature value corresponding to the network management center; the second SM2 signature value and the second PQC signature value are obtained by signing the fourth random number with the private key of the first PQC signature key and the private key of the first SM2 signature key.

[0417] The proxy server of the embodiment of the present invention can perform session key negotiation with the network management center after identity authentication with the network management center to obtain the session key. The session key is generated based on the cryptographic algorithm and the cryptographic machine. The network management center and the proxy server can each be associated with a cryptographic machine to perform cryptographic operations and key management, so that the business system and the cryptographic logic can be completely decoupled; and the cryptographic algorithm of the embodiment of the present invention has higher security and economic advantages compared with the traditional encryption method; in addition, the negotiated session key can be stored in the cryptographic machine, and the key negotiation mechanism of the embodiment of the present invention can improve the success rate of key negotiation and protect the security of the negotiated key. The proxy server can receive quantum network data sent by the network management center, and the quantum network data includes data plaintext and data ciphertext. The data ciphertext is obtained by encrypting the data plaintext with the session key; the data plaintext is verified by the data ciphertext, and after the data plaintext verification is passed, the quantum network device is controlled according to the control instruction indicated by the data plaintext, and the data plaintext is verified by the data ciphertext to prevent the data plaintext from being tampered with during the transmission process, thereby ensuring the security of data interaction between the network management center, the proxy server and the quantum network device.

[0418] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0419] An embodiment of the present invention also provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned quantum network data encryption method based on a cryptographic algorithm when executing the computer program.

[0420] An embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned quantum network data encryption method based on a cryptographic algorithm are implemented.

[0421] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0422] Those skilled in the art will appreciate that the embodiments of the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more machine-readable media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0423] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0424] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0425] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0426] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0427] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0428] The above is a detailed introduction to a quantum network data encryption method, system and device based on a cryptographic algorithm provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A quantum network data encryption method based on cryptographic algorithm, characterized in that: Applied to a network management center, the method includes: Negotiate the session key with the proxy server to obtain the session key; Send quantum network data to the proxy server, the quantum network data including plaintext data and ciphertext data, the ciphertext data being obtained by encrypting the plaintext data by the session key, so that the proxy server verifies the plaintext data by the ciphertext data, and controls the quantum network device according to the control instruction indicated by the plaintext data after the plaintext data is verified.

2. The method according to claim 1, characterized in that The step of negotiating a session key with the proxy server to obtain a session key includes: Generate a first negotiation key by using the cryptographic algorithm and a second key corresponding to the proxy server, and generate a key negotiation request according to the first negotiation key; Sending a key negotiation request to the proxy server, so that the proxy server returns a key negotiation request response according to the first key corresponding to the network management center and the first negotiated key; Verifying the first negotiated key according to the key negotiation request response; After the first negotiated key is verified, the first negotiated key is used as a session key.

3. The method according to claim 2, characterized in that Before performing session key negotiation with the proxy server, the method further includes: Performing identity authentication with the proxy server; The step of negotiating a session key with the proxy server includes: After identity authentication is performed with the proxy server, session key negotiation is performed with the proxy server.

4. The method according to claim 2, characterized in that: The second key includes a second post-quantum cryptographic encryption key and a second elliptic curve cryptographic encryption key; the cryptographic algorithm includes an elliptic curve cryptographic algorithm, a post-quantum cryptographic algorithm, and a cryptographic hash algorithm; the first negotiation key is generated by using the cryptographic algorithm and the second key corresponding to the proxy server, and a key negotiation request is generated according to the first negotiation key, including: Generate the first negotiated key by using the public key of the second post-quantum cryptographic encryption key and the post-quantum cryptographic algorithm; Obtaining a first random number corresponding to the network management center; Encrypt the first random number using the public key of the second elliptic curve cryptographic encryption key and the elliptic curve cryptographic algorithm to obtain a first encrypted random number; Performing a hash operation on the first random number and the first negotiated key by using the cryptographic hash algorithm to obtain a first hash value; A key negotiation request is generated according to the first encrypted random number and the first hash value.

5. The method according to claim 4, characterized in that The first key includes a first post-quantum cryptographic encryption key and a first elliptic curve cryptographic encryption key; the sending of a key negotiation request to the proxy server so that the proxy server returns a key negotiation request response according to the first key corresponding to the network management center and the first negotiated key, including: A key negotiation request is sent to the proxy server, so that the proxy server obtains the first random number and the first negotiation key according to the first encrypted random number and the first hash value, and returns the key negotiation request response to the network management center according to the first random number and the first negotiation key; the key negotiation request response carries a second encrypted random number and a second hash value; the second encrypted random number is obtained by encrypting the second random number corresponding to the proxy server by using the public key of the first elliptic curve cryptographic encryption key and the elliptic curve cryptographic algorithm; the second hash value is obtained by performing a hash operation on the second negotiation key by using the cryptographic hash algorithm; the second negotiation key is obtained by using the first random number, the second random number and the first negotiation key.

6. The method according to claim 5, characterized in that The verifying the first negotiated key according to the key negotiation request response includes: Acquire the second encrypted random number and the second hash value according to the key agreement request response; Decrypting the second encrypted random number using the private key of the first elliptic curve cryptographic encryption key to obtain the second random number; Obtaining a third negotiated key by using the first random number, the second random number and the first negotiated key; Performing a hash operation on the third negotiated key by using the cryptographic hash algorithm to obtain a third hash value; When the second hash value is equal to the third hash value, it is determined that the first negotiated key verification is successful.

7. The method according to claim 1, characterized in that The cryptographic algorithm includes a message authentication code generation algorithm; the sending of quantum network data to the proxy server, the quantum network data including data plaintext and data ciphertext, the data ciphertext being obtained by encrypting the data plaintext with the session key, so that the proxy server verifies the data plaintext with the data ciphertext, and after the data plaintext is verified, controls the quantum network device according to the control instruction indicated by the data plaintext, including: Obtain a first digest value corresponding to the data plaintext and the data ciphertext; the first digest value is obtained by performing a hash operation on the data plaintext and the session key through the message authentication code generation algorithm; Generate the quantum network data according to the data plaintext and the first summary value; The quantum network data is sent to the proxy server, so that the proxy server performs a hash operation on the data plaintext and the session key through the message authentication code generation algorithm to obtain a second digest value, and when the first digest value is equal to the second digest value, it is determined that the data plaintext verification has passed, and after the data plaintext verification has passed, the quantum network device is controlled according to the control instruction indicated by the data plaintext.

8. The method according to claim 3, characterized in that The performing identity authentication with the proxy server includes: Sending a first identity authentication request to the proxy server, so that the proxy server returns a first identity authentication response through the second key; According to the first identity authentication response and the first key, a second identity authentication request is sent to the proxy server, so that the proxy server performs identity authentication.

9. The method according to claim 8, characterized in that The second key includes a second post-quantum cryptographic signature key and a second elliptic curve cryptographic signature key; sending a first identity authentication request to the proxy server so that the proxy server returns a first identity authentication response through the second key, including: A first identity authentication request is sent to the proxy server, where the first identity authentication request carries a third random number corresponding to the network management center, so that the proxy server signs the third random number by using the private key of the second post-quantum cryptographic signature key and the private key of the second elliptic curve cryptographic signature key to obtain a first elliptic curve cryptographic signature value and a first post-quantum cryptographic signature value, and returns the first identity authentication response; the first identity authentication response carries a fourth random number corresponding to the proxy server, a second certificate corresponding to the proxy server, the first elliptic curve cryptographic signature value, and the first post-quantum cryptographic signature value.

10. The method according to claim 9, characterized in that The first key includes a first post-quantum cryptographic signature key and a first elliptic curve cryptographic signature key; and sending a second authentication request to the proxy server according to the first authentication response and the first key so that the proxy server performs identity authentication, including: Sign the fourth random number by using the private key of the first post-quantum cryptographic signature key and the private key of the first elliptic curve cryptographic signature key to obtain a second elliptic curve cryptographic signature value and a second post-quantum cryptographic signature value; Send a second identity authentication request to the proxy server; the second identity authentication request carries the first post-quantum cryptographic certificate, the second elliptic curve cryptographic signature value and the second post-quantum cryptographic signature value corresponding to the network management center, so that the proxy server performs identity authentication.

11. A quantum network data encryption method based on cryptographic algorithm, characterized in that: Applied to a proxy server, the method comprises: Negotiate the session key with the network management center to obtain the session key; Receiving quantum network data sent by the network management center, the quantum network data includes data plaintext and data ciphertext, the data ciphertext is obtained by encrypting the data plaintext by using the session key; The data plaintext is verified by the data ciphertext, and after the data plaintext is verified, the quantum network device is controlled according to the control instructions indicated by the data plaintext.

12. The method according to claim 11, characterized in that The step of negotiating a session key with the network management center to obtain a session key includes: Receiving a key negotiation request sent by the network management center; the key negotiation request is generated according to a first negotiation key, and the first negotiation key is generated by the cryptographic algorithm and a second key corresponding to the proxy server; According to the first key corresponding to the network management center and the first negotiated key, a key negotiation request response is returned to the network management center, so that the network management center verifies the first negotiated key according to the key negotiation request response, and uses the first negotiated key as the session key after the first negotiated key verification is passed.

13. The method according to claim 12, characterized in that Before performing session key negotiation with the network management center, the method further includes: Performing identity authentication with the network management center; The negotiating a session key with the network management center includes: After identity authentication with the network management center, session key negotiation is performed with the network management center.

14. The method according to claim 12, characterized in that The second key includes a second post-quantum cryptographic encryption key and a second elliptic curve cryptographic encryption key; the cryptographic algorithm includes an elliptic curve cryptographic algorithm, a post-quantum cryptographic algorithm and a cryptographic hash algorithm; The key agreement request is generated according to the first encrypted random number and the first hash value; the first encrypted random number is obtained by encrypting the first random number corresponding to the network management center using the public key of the second elliptic curve cryptographic encryption key and the elliptic curve cryptographic algorithm; The first hash value is obtained by performing a hash operation on the first random number and the first negotiated key by the cryptographic hash algorithm; The first negotiated key is generated by using the public key of the second post-quantum cryptographic encryption key and the post-quantum cryptographic algorithm.

15. The method according to claim 14, characterized in that The first key includes a first post-quantum cryptographic encryption key and a first elliptic curve cryptographic encryption key; the returning a key negotiation request response to the network management center according to the first key corresponding to the network management center and the first negotiated key, so that the network management center verifies the first negotiated key according to the key negotiation request response, and uses the first negotiated key as a session key after the first negotiated key verification passes, including: Obtaining the first random number and the first negotiated key according to the first encrypted random number and the first Hash value; Obtaining a second random number corresponding to the proxy server; Encrypt the second random number using the public key of the first elliptic curve cryptographic encryption key and the elliptic curve cryptographic algorithm to obtain a second encrypted random number; Obtaining a second negotiated key by using the first random number, the second random number and the first negotiated key; Performing a hash operation on the second negotiated key by using the cryptographic hash algorithm to obtain a second hash value; Generate the key agreement request response according to the second encrypted random number and the second hash value; The key negotiation request response is returned to the network management center, so that the network management center verifies the first negotiated key according to the key negotiation request response, and uses the first negotiated key as the session key after the first negotiated key verification passes.

16. The method according to claim 15, characterized in that The network management center determines that the first negotiated key verification is passed when the second hash value is equal to the third hash value; the third hash value is obtained by performing a hash operation on the third negotiated key by the cryptographic hash algorithm; The third negotiated key is obtained by using the first random number, the second random number and the first negotiated key; The second random number is obtained by decrypting the second encrypted random number using the private key of the first elliptic curve cryptographic encryption key; the second encrypted random number and the second hash value are obtained according to the key agreement request response.

17. The method according to claim 11, characterized in that The cryptographic algorithm includes a message authentication code generation algorithm; the quantum network data is generated according to a first summary value corresponding to the data plaintext and the data ciphertext; the first summary value is obtained by performing a hash operation on the data plaintext and the session key through the message authentication code generation algorithm; the data plaintext is verified by the data ciphertext, and after the data plaintext is verified, the quantum network device is controlled according to the control instruction indicated by the data plaintext, including: Performing a hash operation on the data plaintext and the session key by using the message authentication code generation algorithm to obtain a second digest value; When the first digest value is equal to the second digest value, it is determined that the data plaintext verification has passed, and after the data plaintext verification has passed, the quantum network device is controlled according to the control instruction indicated by the data plaintext.

18. The method according to claim 13, characterized in that The identity authentication with the network management center includes: receiving a first identity authentication request sent by the network management center, and returning a first identity authentication response to the network management center through the second key; Receive a second identity authentication request sent by the network management center according to the first identity authentication response and the first key, and perform identity authentication with the network management center through the second identity authentication request.

19. The method according to claim 18, characterized in that The second key includes a second post-quantum cryptographic signature key and a second elliptic curve cryptographic signature key; the first identity authentication request carries a third random number corresponding to the network management center; The receiving the first identity authentication request sent by the network management center, and returning a first identity authentication response to the network management center through the second key, includes: Receive a first identity authentication request sent by the network management center, sign the third random number by using the private key of the second post-quantum cryptographic signature key and the private key of the second elliptic curve cryptographic signature key, and obtain a first elliptic curve cryptographic signature value and a first post-quantum cryptographic signature value; Return the first identity authentication response to the network management center; the first identity authentication response carries a fourth random number corresponding to the proxy server, a second certificate corresponding to the proxy server, the first elliptic curve cryptographic signature value, and the first post-quantum cryptographic signature value.

20. The method according to claim 19, characterized in that The first key includes a first post-quantum cryptographic signature key and a first elliptic curve cryptographic signature key; the second identity authentication request carries the first post-quantum cryptographic certificate, the second elliptic curve cryptographic signature value and the second post-quantum cryptographic signature value corresponding to the network management center; the second elliptic curve cryptographic signature value and the second post-quantum cryptographic signature value are obtained by signing the fourth random number with the private key of the first post-quantum cryptographic signature key and the private key of the first elliptic curve cryptographic signature key.

21. A quantum network data encryption system based on cryptographic algorithm, characterized in that: include: Network management center and proxy server; The network management center is used to negotiate a session key with the proxy server to obtain a session key; Sending quantum network data to the proxy server, wherein the quantum network data includes plaintext data and ciphertext data, wherein the ciphertext data is obtained by encrypting the plaintext data using the session key; The proxy server is used to negotiate a session key with the network management center to obtain a session key; Receiving quantum network data sent by the network management center; The data plaintext is verified by the data ciphertext, and after the data plaintext is verified, the quantum network device is controlled according to the control instructions indicated by the data plaintext.

22. The system according to claim 21, characterized in that The network management center is used to generate a first negotiation key by using the cryptographic algorithm and a second key corresponding to the proxy server, and generate a key negotiation request according to the first negotiation key; Sending a key negotiation request to the proxy server; The proxy server is used to receive the key negotiation request sent by the network management center; Returning a key negotiation request response to the network management center according to the first key corresponding to the network management center and the first negotiated key; The network management center is used to verify the first negotiated key according to the key negotiation request response; after the first negotiated key is verified, use the first negotiated key as a session key.

23. The system according to claim 22, characterized in that The network management center is further used to perform identity authentication with the proxy server; after performing identity authentication with the proxy server, perform session key negotiation with the proxy server; The proxy server is also used to perform identity authentication with the network management center; after performing identity authentication with the network management center, the proxy server negotiates a session key with the network management center.

24. The system according to claim 22, characterized in that The second key includes a second post-quantum cryptographic encryption key and a second elliptic curve cryptographic encryption key; the cryptographic algorithm includes an elliptic curve cryptographic algorithm, a post-quantum cryptographic algorithm and a cryptographic hash algorithm; The network management center is used to generate the first negotiated key by using the public key of the second post-quantum cryptographic encryption key and the post-quantum cryptographic algorithm; obtain a first random number corresponding to the network management center; encrypt the first random number by using the public key of the second elliptic curve cryptographic encryption key and the elliptic curve cryptographic algorithm to obtain a first encrypted random number; perform a hash operation on the first random number and the first negotiated key by using the cryptographic hash algorithm to obtain a first hash value; A key negotiation request is generated according to the first encrypted random number and the first hash value.

25. The system according to claim 24, characterized in that The first key includes a first post-quantum cryptography encryption key and a first elliptic curve cryptography encryption key; The proxy server is configured to obtain the first random number and the first negotiated key according to the first encrypted random number and the first hash value; Obtain a second random number corresponding to the proxy server; encrypt the second random number using the public key of the first elliptic curve cryptographic encryption key and the elliptic curve cryptographic algorithm to obtain a second encrypted random number; obtain a second negotiated key using the first random number, the second random number and the first negotiated key; Performing a hash operation on the second negotiated key by using the cryptographic hash algorithm to obtain a second hash value; Generate the key negotiation request response according to the second encrypted random number and the second Hash value; and return the key negotiation request response to the network management center.

26. The system according to claim 25, characterized in that The network management center is used to obtain the second encrypted random number and the second Hash value according to the key negotiation request response; decrypt the second encrypted random number by using the private key of the first elliptic curve cryptographic encryption key to obtain the second random number; obtain a third negotiation key by using the first random number, the second random number and the first negotiation key; and perform a hash operation on the third negotiation key by using the cryptographic hash algorithm to obtain a third Hash value; When the second hash value is equal to the third hash value, it is determined that the first negotiated key verification is successful.

27. The system according to claim 21, characterized in that The cryptographic algorithm includes a message authentication code generation algorithm; The network management center is used to obtain a first summary value corresponding to the data plaintext and the data ciphertext; the first summary value is obtained by performing a hash operation on the data plaintext and the session key through the message authentication code generation algorithm; and generate the quantum network data according to the data plaintext and the first summary value; Sending the quantum network data to the proxy server; The proxy server is used to perform a hash operation on the data plaintext and the session key through the message authentication code generation algorithm to obtain a second digest value; when the first digest value is equal to the second digest value, determine that the data plaintext verification has passed, and after the data plaintext verification has passed, control the quantum network device according to the control instruction indicated by the data plaintext.

28. The system according to claim 23, characterized in that Also includes: A certificate issuing center, a first cryptographic machine and a second cryptographic machine; the first cryptographic machine is associated with the network management center, and the second cryptographic machine is associated with the proxy server; The first cryptographic machine is used to create the first key corresponding to the network management center; Generate a first certificate request file according to the unique identifier of the network management center and the first key; Sending the first certificate request file to the certificate issuing center; The second cryptographic machine is used to create the second key corresponding to the proxy server; generate a second certificate request file according to the unique identifier of the proxy server and the second key; Sending the second certificate request file to the certificate issuing center; The certificate issuing center is used to receive the first certificate request file sent by the first cryptographic machine, generate a first certificate corresponding to the network management center, and return the first certificate to the first cryptographic machine; receiving the second certificate request file sent by the second cryptographic machine, generating a second certificate corresponding to the proxy server, and returning the second certificate to the second cryptographic machine; The network management center is used to send a first identity authentication request to the proxy server, so that the proxy server returns a first identity authentication response through the second key; and send a second identity authentication request to the proxy server according to the first identity authentication response and the first key; The proxy server is used to receive a second identity authentication request sent by the network management center according to the first identity authentication response and the first key, and perform identity authentication with the network management center through the second identity authentication request.

29. The system according to claim 28, characterized in that The second key includes a second post-quantum cryptographic signature key and a second elliptic curve cryptographic signature key; the first identity authentication request carries a third random number corresponding to the network management center; The proxy server is used to receive the first identity authentication request sent by the network management center, sign the third random number by using the private key of the second post-quantum cryptographic signature key and the private key of the second elliptic curve cryptographic signature key to obtain a first elliptic curve cryptographic signature value and a first post-quantum cryptographic signature value; and return the first identity authentication response to the network management center; the first identity authentication response carries the fourth random number corresponding to the proxy server, the second certificate, the first elliptic curve cryptographic signature value, and the first post-quantum cryptographic signature value.

30. The system according to claim 29, characterized in that The first key includes a first post-quantum cryptographic signature key and a first elliptic curve cryptographic signature key; The network management center is used to sign the fourth random number by using the private key of the first post-quantum cryptographic signature key and the private key of the first elliptic curve cryptographic signature key to obtain a second elliptic curve cryptographic signature value and a second post-quantum cryptographic signature value; and send a second identity authentication request to the proxy server; the second identity authentication request carries the first certificate, the second elliptic curve cryptographic signature value and the second post-quantum cryptographic signature value. The proxy server is used to receive the second identity authentication request sent by the network management center, and perform identity authentication according to the second identity authentication request.

31. A quantum network data encryption device based on a cryptographic algorithm, characterized in that: Applied to a network management center, the device comprises: A first session key negotiation module, used to negotiate a session key with a proxy server to obtain a session key; The quantum network data sending module is used to send quantum network data to the proxy server, wherein the quantum network data includes data plaintext and data ciphertext, and the data ciphertext is obtained by encrypting the data plaintext with the session key, so that the proxy server verifies the data plaintext with the data ciphertext, and controls the quantum network device according to the control instruction indicated by the data plaintext after the data plaintext is verified.

32. A quantum network data encryption device based on a cryptographic algorithm, characterized in that: Applied to a proxy server, the device comprises: The second session key negotiation module is used to negotiate the session key with the network management center to obtain the session key; A quantum network data receiving module, used to receive quantum network data sent by the network management center, wherein the quantum network data includes plaintext data and ciphertext data, and the ciphertext data is obtained by encrypting the plaintext data with the session key; The quantum network device control module is used to verify the data plaintext through the data ciphertext, and after the data plaintext is verified, control the quantum network device according to the control instruction indicated by the data plaintext.

33. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of a quantum network data encryption method based on a cryptographic algorithm as described in any one of claims 1 to 10 or claims 11 to 20 are implemented.

34. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the steps of a quantum network data encryption method based on a cryptographic algorithm as described in any one of claims 1-10 or claims 11-20 are implemented.

Images