Encrypted communication method, device and system supporting post-quantum algorithm

Abstract

The invention discloses an encrypted communication method, device and system supporting a post-quantum algorithm. The encrypted communication method comprises the following steps: acquiring a first post-quantum algorithm public key and a server signature sent by a server; verifying the signature of the server by using a built-in second post-quantum algorithm public key, and confirming the identity of the server; generating a pre-key and a session key, encrypting the pre-key by using the first post-quantum algorithm public key to obtain a ciphertext, and then sending the ciphertext to the server; after the ciphertext is decrypted by the server side, the session key is also generated by the server side, the client side and the server side mutually verify the session keys of the client side and the server side, and after verification succeeds, the client side and the server side use the session key to carry out encryption communication. Compared with the prior art, the encryption communication method supporting the post-quantum algorithm provided by the invention optimizes the steps of identity authentication and key agreement, so that the key agreement can be quickly completed on the basis of providing anti-quantum protection, thereby meeting the requirements of services.

Description

Technical Field

[0001] The present invention relates to the field of quantum encryption algorithm technology, and in particular to an encryption communication method, device and system supporting a post-quantum algorithm. Background Art

[0002] For security reasons, both parties in communication need to perform identity authentication and key negotiation before data transmission. Identity authentication is to confirm each other's identity, and key negotiation is to negotiate the key required for subsequent symmetric encryption. Currently, identity authentication and key negotiation are protected by classical algorithms, which will be difficult to resist attacks from quantum computers in the future.

[0003] Identity authentication and key negotiation not only need to consider security, but also performance, as these two processes generally occur during communication. Since the key pairs and signatures / ciphertexts of existing post-quantum algorithms are too large, transmission time may be affected. Summary of the invention

[0004] The purpose of the present invention is to provide an encryption communication method, device and system supporting post-quantum algorithms to solve the technical problems in the prior art. It can quickly complete the identity authentication and key negotiation process on the basis of providing anti-quantum protection.

[0005] In a first aspect, the present invention provides an encryption communication method supporting a post-quantum algorithm, which is applied to a client to implement communication between the client and a server, comprising the following steps:

[0006] Obtaining a first post-quantum algorithm public key and a server signature sent by the server, where the server signature is obtained by the server signing the server information using the second post-quantum algorithm private key;

[0007] Use the built-in second post-quantum algorithm public key to verify the server signature and confirm the server identity;

[0008] Generate a prekey and a session key, and use the first post-quantum algorithm public key to encrypt the prekey to obtain a ciphertext, and then send the ciphertext to the server;

[0009] After the ciphertext is decrypted by the server, the session key is also generated by the server, and the client and the server mutually verify the session key. After the session key is successfully verified, the client uses the session key to perform encrypted communication with the server.

[0010] In the above-mentioned encryption communication method supporting post-quantum algorithm, preferably, before obtaining the first post-quantum algorithm public key sent by the server and the server signature, the following steps are also included:

[0011] Sending a first random number, supported protocol versions, and supported algorithm types to the server;

[0012] A second random number, a selected protocol version, and a selected algorithm sent by the server are received to confirm that the client and the server communicate based on the same parameters.

[0013] As described above, in the encryption communication method supporting post-quantum algorithm, preferably, the session key is generated by the first random number, the second random number and the prekey.

[0014] As described above, an encryption communication method supporting a post-quantum algorithm, wherein preferably,

[0015] The client and the server each construct a Finished message, the Finished message including a session key, a fixed string, and a hash value of handshake information, and the client and the server encrypt the Finished message using the session key;

[0016] The encrypted Finished message is sent to the other party. The receiver uses the session key to decrypt the received Finished message. The receiver calculates the hash value theoretically contained in the Finished message and compares it with the hash value in the decrypted Finished message. If the hash values ​​match, it means that the sender uses the correct session key and the handshake message has not been tampered with.

[0017] If the Finished message verification succeeds, the client and the server perform encrypted communication using the session key.

[0018] In the above-mentioned encryption communication method supporting post-quantum algorithms, preferably, the algorithm supported by the client adopts any one of the following:

[0019] Post-quantum algorithms;

[0020] National secret algorithm;

[0021] International classic algorithm;

[0022] A first hybrid algorithm based on the post-quantum algorithm and the national secret algorithm;

[0023] A second hybrid algorithm based on the post-quantum algorithm and the international classical algorithm;

[0024] A third hybrid algorithm based on the national secret algorithm and the international classical algorithm;

[0025] The fourth hybrid algorithm is based on the post-quantum algorithm, the national secret algorithm and the international classical algorithm.

[0026] As described above, an encryption communication method supporting a post-quantum algorithm, wherein preferably, the first post-quantum algorithm is a post-quantum cryptographic encapsulation algorithm, and the second post-quantum algorithm is a post-quantum cryptographic signature algorithm.

[0027] In a second aspect, the present invention provides an encryption communication method supporting a post-quantum algorithm, which is applied to a server to implement communication between a client and a server, comprising the following steps:

[0028] Obtaining a first random number, a supported protocol version, and a supported algorithm type sent by the client, determining a protocol version and an algorithm supported by itself from the supported protocol versions and the supported algorithm types, and sending the selection result and the second random number to the client;

[0029] Sending the first post-quantum algorithm public key and the server signature to the client;

[0030] The ciphertext sent by the client is received, and a session key is generated after decryption. After the session key is successfully verified, the client uses the session key to perform encrypted communication with the server.

[0031] In a third aspect, the present invention provides an encryption communication device, applied to a client, the device comprising:

[0032] An initialization module, used to send a first random number, a supported protocol version, and a supported algorithm type to the server, and receive a second random number, a selected protocol version, and a selected algorithm sent by the server;

[0033] An identity authentication module, used to obtain a first post-quantum algorithm public key and a server signature sent by the server, and use a built-in second post-quantum algorithm public key to verify the server signature and confirm the server identity;

[0034] A pre-key generation module, used to generate a pre-key, encrypt the pre-key using the first post-quantum algorithm public key to obtain a ciphertext, and then send the ciphertext to the server;

[0035] The session key generation and authentication module is used for generating a pre-key, and then the client generates a session key. After the session key is successfully verified, the client uses the session key to perform encrypted communication with the server.

[0036] In a fourth aspect, the present invention provides an encrypted communication system, including a client and a server, wherein:

[0037] The client has a built-in second post-quantum algorithm public key, and the server has a built-in first post-quantum algorithm public and private key and a second post-quantum algorithm private key;

[0038] The client sends a first random number, a supported protocol version, and a supported algorithm type to the server, and receives a second random number, a selected protocol version, and a selected algorithm sent by the server; obtains a first post-quantum algorithm public key and a server signature sent by the server, and verifies the server signature using a built-in second post-quantum algorithm public key; generates a pre-key, and uses the first post-quantum algorithm public key to encrypt the pre-key to obtain a ciphertext, and then sends the ciphertext to the server; generates a session key using the first random number, the second random number, and the pre-key, and the client and the server mutually verify the session key;

[0039] The server selects a protocol version and algorithm supported by itself from the protocol versions and algorithm types supported by the client, and sends the selection result and the second random number to the client; sends the first post-quantum algorithm public key and the server signature to the client, the server receives the ciphertext sent by the client, and decrypts it using the first post-quantum algorithm key to obtain the plaintext of the pre-key, uses the first random number, the second random number and the pre-key to generate a session key, and the server and the client jointly verify the session key.

[0040] In a fifth aspect, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the aforementioned method when executing the computer program.

[0041] In a sixth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a program for executing the aforementioned method.

[0042] Compared with the prior art, the encryption communication method supporting post-quantum algorithms provided by the present invention optimizes the steps of identity authentication and key negotiation, so that key negotiation can be quickly completed on the basis of providing anti-quantum protection, thereby meeting business needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a flowchart of the encryption communication method provided by an embodiment of the present invention;

[0044] Figure 2 It is a schematic diagram of the structure of the encryption communication device provided by an embodiment of the present invention;

[0045] Figure 3 It is a flowchart of the encryption communication system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, but should not be construed as limiting the present invention.

[0047] Reference Figure 1 As shown, in the first aspect, the present invention provides an encryption communication method supporting a post-quantum algorithm, which is applied to a client to implement communication between a client and a server, and includes the following steps:

[0048] Step S101: Send a first random number, supported protocol versions, and supported algorithm types to the server; receive a second random number, a selected protocol version, and a selected algorithm sent by the server to confirm that the client and the server communicate based on the same parameters.

[0049] The first random number is used in the subsequent key generation and verification process. Preferably, the first random number is a quantum random number, which is a random number generated based on the principle of quantum mechanics and is unpredictable and aperiodic to ensure security and reliability during the communication process.

[0050] The protocol version sent by the client determines the specification and rule framework that the two parties follow in subsequent communications. The protocol version defines the rules and steps that must be followed during the communication process, including how to establish a connection, how to exchange information, and how to handle errors. The type of algorithm is related to subsequent security-related operations such as encryption and signing to establish the initial parameters of communication.

[0051] After receiving the information from the client, the server starts to filter the protocol versions and algorithm types provided by the client, and determines a suitable option based on its own system configuration, pre-set security policies, and support capabilities for various protocols and algorithms. After determining the choice, the server will clearly inform the client which protocol version and algorithm type has been selected, so that the client knows that subsequent communications will proceed accordingly.

[0052] In addition, the server will also generate and transmit a second random number to the client. The second random number is similar to the first random number sent by the client and is also used for subsequent operations such as generating session keys. Preferably, the second random number is also a quantum random number. By providing random numbers by both parties, the randomness and confidentiality of key generation are further enhanced.

[0053] By exchanging random numbers and confirming the protocol version and algorithm, the client and server confirm that they use the same communication rules and security measures, thereby establishing a secure communication channel.

[0054] Step S102: Obtain the first post-quantum algorithm public key and server signature sent by the server, where the server signature is obtained by signing the server information using the second post-quantum algorithm private key; the client uses the built-in second post-quantum algorithm public key to verify the server signature and confirm the server identity.

[0055] In the embodiment provided by the present invention, the client has a built-in second post-quantum algorithm public key, and the server has a built-in first post-quantum algorithm public and private key and a second post-quantum algorithm private key. In a feasible implementation, the first post-quantum algorithm is a post-quantum cryptographic encapsulation algorithm, and the first post-quantum cryptographic encapsulation algorithm is exemplarily a Kyber algorithm. The Kyber algorithm is a lattice-based public key encryption scheme used for key encapsulation and other operations. The second post-quantum algorithm is a post-quantum cryptographic signature algorithm, and the second post-quantum cryptographic signature algorithm is exemplarily a Dilithium algorithm. The Dilithium algorithm is a lattice-based digital signature scheme used for identity authentication and other operations.

[0056] In this step, the server then sends two important elements to the client. One is the Kyber public key, which is used in subsequent key encapsulation and decryption operations to build a secure communication key system for both parties. The other is the server signature. This signature is obtained by the server using the built-in Dilithium private key to sign its own related information. The client has a built-in Dilithium public key. Through the private key-based signature method, the server proves the legitimacy of its identity to the client. Only the party with the corresponding Dilithium private key can generate the correct signature, and the client can verify it through the corresponding Dilithium public key. If the verification is successful, it means that the server currently communicating with it is legal and has the corresponding private key, thereby confirming the identity of the server and laying the foundation for subsequent secure and reliable communication. If the verification fails, it may mean that there is a security risk, such as encountering a man-in-the-middle attack, and the communication will be interrupted.

[0057] Through this step, the client can securely obtain the first post-quantum algorithm public key of the server and verify the server's signature to ensure the authenticity of the server's identity and the security of communication. At the same time, this process utilizes the characteristics of the post-quantum algorithm to resist the threat of quantum computing.

[0058] Step S103: Generate a prekey and a session key, and use the first post-quantum algorithm public key to encrypt the prekey to obtain a ciphertext, and then send the ciphertext to the server.

[0059] After confirming the identity of the server, the client will use the Kyber public key sent by the server to perform key encapsulation. In this process, a specific key encapsulation algorithm is used to combine relevant parameters to generate a pre-key and the corresponding ciphertext form (i.e. Cipher).

[0060] The pre-key is usually a randomly generated random number, preferably a quantum random number, which is used for subsequent session encryption. Encrypting it into a Cipher is to ensure that it is not leaked during transmission to the server and to ensure its confidentiality. Subsequently, the client will generate a session key and send the Cipher to the server to enter the next round of interaction.

[0061] Step S104: After the ciphertext Cipher is decrypted by the server, the session key is also generated by the server, and the client and the server mutually verify the session key. After the session key is successfully verified, the client uses the session key to perform encrypted communication with the server.

[0062] After receiving the Cipher sent by the client, the server uses its own Kyber private key to decrypt it. Since there is a specific mathematical correspondence between the Kyber public key and the private key, only the matching private key can correctly decrypt the ciphertext generated by the corresponding public key. Through this decryption process, the server can successfully obtain the plaintext content of the pre-key.

[0063] After the ciphertext is decrypted by the server, the server has the necessary elements to generate the session key, namely the first random number, the second random number and the prekey. The server uses the same algorithm to combine the first random number, the second random number and the prekey to generate the session key.

[0064] In order to ensure that the session key calculated by both parties is completely consistent and has not been tampered with, the two parties will send each other a Finished message encrypted with the session key. The client and the server each construct a Finished message, which includes the session key, a fixed string (such as "server finished" or "client finished"), and the hash value of all messages exchanged since the handshake began. This hash value includes the hash of all previous handshake messages to ensure the integrity of the message. The client and the server encrypt the Finished message using the session key, which was generated during the previous key exchange process, ensuring that only the two parties with the correct session key can decrypt the message.

[0065] The encrypted Finished message is sent to the other party. The receiver uses the session key to decrypt the received Finished message. The receiver calculates the hash value theoretically contained in the Finished message and compares it with the hash value in the decrypted Finished message. If the hash values ​​match, it means that the sender is using the correct session key and the handshake message has not been tampered with.

[0066] If the Finished message is successfully verified, the client and server use the session key for encrypted communication.

[0067] Taking the message sent by the client as an example, the plaintext structure of the message has a strict design. First, all the messages sent by both parties before are hashed to obtain a hash value, and then the hash value is integrated with the session key and the fixed string "client finished" and hashed again. The client uses the session key to encrypt the message and sends it to the server. After receiving it, the server decrypts it with the same session key and calculates the hash value according to the same rules. Then the two hash values ​​are compared. If the two are consistent, it means that the session key used by both parties is correct and the messages during the entire session have not been tampered with, ensuring the integrity and security of the communication. After that, the server will generate a message with a similar structure but with the fixed string replaced ("server finished") and encrypt it and send it to the client for the same verification operation. This method not only verifies that both parties have calculated the correct session key, but also ensures that the session messages of both parties have not been tampered with.

[0068] After the key verification step, the client and the server have determined a consistent, secure and reliable session key. On this basis, the client and the server can use this session key to encrypt the communication content to ensure that the communication data is confidential during network transmission. Only the two parties with the correct session key can decrypt and restore the encrypted content to achieve secure communication.

[0069] In a feasible implementation, the algorithm supported by the client is any of the following:

[0070] Post-quantum algorithms provide quantum-resistant data protection to ensure data security in the quantum computing era, including one or more algorithms in Kyber and Dilithum.

[0071] National secret algorithm refers to the cryptographic algorithm approved by the State Cryptography Administration, including one or more of SM1, SM2, SM3, SM4, SM7, SM9 and ZUC.

[0072] International classic algorithms refer to cryptographic algorithms that are widely used internationally, including one or more of AES, RSA, and ECDSA.

[0073] The first hybrid algorithm based on post-quantum algorithms and national secret algorithms combines post-quantum algorithms and national secret algorithms to provide a more flexible security solution. This hybrid approach can introduce post-quantum algorithms to meet future security challenges while maintaining the compatibility of traditional algorithms.

[0074] The second hybrid algorithm based on post-quantum algorithms and international classical algorithms combines post-quantum algorithms and international classical algorithms to provide a more flexible security solution. This hybrid approach can introduce post-quantum algorithms to meet future security challenges while maintaining the compatibility of traditional algorithms.

[0075] The third hybrid algorithm based on the national secret algorithm and the international classical algorithm combines the national secret algorithm and the international classical algorithm to provide stronger security and flexibility.

[0076] The fourth hybrid algorithm based on post-quantum algorithms, national secret algorithms and international classical algorithms combines post-quantum algorithms, national secret algorithms and international classical algorithms to provide a more flexible security solution. This hybrid approach can introduce post-quantum algorithms to meet future security challenges while maintaining the compatibility of traditional algorithms.

[0077] By designing a variety of preset algorithms, users can choose the appropriate algorithm according to their actual needs, ensuring that even if one party does not support the post-quantum algorithm, the classical algorithm can be used to complete the entire process, providing users with a comprehensive, flexible and forward-looking security solution to protect data from current and future potential threats.

[0078] In a second aspect, the present invention further provides an encryption communication method supporting a post-quantum algorithm, which is applied to a server to implement communication between a client and a server, comprising the following steps:

[0079] Obtain a first random number, supported protocol version, and supported algorithm type sent by the client, determine the protocol version and algorithm supported by itself from the supported protocol version and supported algorithm type, and send the selection result and the second random number to the client.

[0080] Sending the first post-quantum algorithm public key and the server signature to the client.

[0081] Receive the ciphertext sent by the client, decrypt it and generate a session key. After the session key is successfully verified, the client uses the session key to encrypt communication with the server.

[0082] Reference Figure 2 As shown, in a third aspect, the present invention further provides an encryption communication device, applied to a client, the device comprising:

[0083] The initialization module is used to send the first random number, the supported protocol version and the supported algorithm type to the server, and receive the second random number, the selected protocol version and the selected algorithm sent by the server. By exchanging random numbers and confirming the protocol version and algorithm, the client and server confirm that they use the same communication rules and security measures, thereby establishing a secure communication channel.

[0084] The authentication module is used to obtain the first post-quantum algorithm public key and server signature sent by the server, and use the built-in second post-quantum algorithm public key to verify the server signature and confirm the server identity. The client can safely obtain the first post-quantum algorithm public key of the server and verify the server signature to ensure the authenticity of the server identity and the security of communication. At the same time, this process utilizes the characteristics of the post-quantum algorithm to resist the threat of quantum computing.

[0085] The pre-key generation module is used to generate a pre-key, encrypt the pre-key with the first post-quantum algorithm public key to obtain a ciphertext, and then send the ciphertext to the server. After confirming the identity of the server, the client will use the Kyber public key sent by the server to perform a key encapsulation operation. In this process, a specific key encapsulation algorithm is used to combine relevant parameters to generate a pre-key and the corresponding ciphertext form (i.e. Cipher).

[0086] The session key generation and authentication module is used to generate a session key on the client side after generating a pre-key, and to mutually verify the session key of both parties with the server side. After the session key is successfully verified, the client side uses the session key to perform encrypted communication with the server side.

[0087] In order to ensure that the session key calculated by both parties is completely consistent and has not been tampered with, the two parties will send each other a Finished message encrypted with the session key. The client and the server each construct a Finished message, which includes the session key, a fixed string (such as "server finished" or "client finished"), and the hash value of all messages exchanged since the handshake began. This hash value usually includes the hash of all previous handshake messages, ensuring the integrity of the message. The client and the server encrypt the Finished message using the session key, which was generated during the previous key exchange process, ensuring that only the two parties with the correct session key can decrypt the message.

[0088] If the Finished message is successfully verified, the client and server use the session key for encrypted communication.

[0089] In a fourth aspect, an embodiment of the present invention provides an encrypted communication system, including a client and a server, wherein:

[0090] The client has a built-in second post-quantum algorithm public key, and the server has a built-in first post-quantum algorithm public and private key and a second post-quantum algorithm private key.

[0091] The client sends a first random number, supported protocol version, and supported algorithm type to the server, and receives a second random number, selected protocol version, and selected algorithm sent by the server; obtains the first post-quantum algorithm public key and server signature sent by the server, and verifies the server signature using the built-in second post-quantum algorithm public key; generates a pre-key, and uses the first post-quantum algorithm public key to encrypt the pre-key to obtain a ciphertext, and then sends the ciphertext to the server; uses the first random number, the second random number, and the pre-key to generate a session key, and the client and the server verify the session key with each other.

[0092] The server selects the protocol version and algorithm it supports from the protocol versions and algorithm types supported by the client, and sends the selection result and the second random number to the client; sends the first post-quantum algorithm public key and the server signature to the client, the server receives the ciphertext sent by the client, and decrypts it using the first post-quantum algorithm key to obtain the plaintext of the pre-key, uses the first random number, the second random number and the pre-key to generate a session key, and the server and the client jointly verify the session key.

[0093] The encrypted communication system provided by the embodiment of the present invention embodies multiple security measures:

[0094] Authentication: Through the signature and verification mechanism based on Dilithium public and private keys, illegal server access is effectively prevented, and identity disguise attacks such as man-in-the-middle attacks are resisted.

[0095] In terms of key generation: the random numbers and pre-keys provided by both parties are used in combination with a specific algorithm to generate session keys, which increases the randomness and confidentiality of the keys and reduces the risk of being cracked.

[0096] Message integrity: Finished messages are processed by hash operations and comparative verification to ensure the integrity of messages during the conversation between the two parties. It can detect whether the message has been tampered with in a timely manner, ensuring the reliability and security of communication.

[0097] In general, the encryption communication system provided by the embodiment of the present invention is a relatively rigorous and highly secure client-server encryption communication negotiation system.

[0098] In a fifth aspect, an embodiment of the present invention further provides an electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to implement the steps in any one of the above method embodiments.

[0099] Specifically, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0100] Specifically, in this embodiment, the processor may be configured to implement the following steps through a computer program:

[0101] Step S101: Send a first random number, supported protocol versions, and supported algorithm types to the server; receive a second random number, a selected protocol version, and a selected algorithm sent by the server to confirm that the client and the server communicate based on the same parameters.

[0102] Step S102: Obtain the first post-quantum algorithm public key and server signature sent by the server, where the server signature is obtained by signing the server information using the second post-quantum algorithm private key; the client uses the built-in second post-quantum algorithm public key to verify the server signature and confirm the server identity.

[0103] Step S103: Generate a prekey and a session key, and use the first post-quantum algorithm public key to encrypt the prekey to obtain a ciphertext, and then send the ciphertext to the server.

[0104] Step S104: After the ciphertext is decrypted by the server, the session key is also generated by the server, and the client and the server mutually verify the session key. After the session key is successfully verified, the client uses the session key to perform encrypted communication with the server.

[0105] In a sixth aspect, an embodiment of the present invention further provides a storage medium, in which a computer program is stored, wherein the computer program is configured to implement the steps of any of the above method embodiments when run.

[0106] Specifically, in this embodiment, the above storage medium may be configured to store a computer program for implementing the following steps:

[0107] Step S101: Send a first random number, supported protocol versions, and supported algorithm types to the server; receive a second random number, a selected protocol version, and a selected algorithm sent by the server to confirm that the client and the server communicate based on the same parameters.

[0108] Step S102: Obtain the first post-quantum algorithm public key and server signature sent by the server, where the server signature is obtained by signing the server information using the second post-quantum algorithm private key; the client uses the built-in second post-quantum algorithm public key to verify the server signature and confirm the server identity.

[0109] Step S103: Generate a prekey and a session key, and use the first post-quantum algorithm public key to encrypt the prekey to obtain a ciphertext, and then send the ciphertext to the server.

[0110] Step S104: After the ciphertext is decrypted by the server, the session key is also generated by the server, and the client and the server mutually verify the session key. After the session key is successfully verified, the client uses the session key to perform encrypted communication with the server.

[0111] The above describes in detail the structure, features and effects of the present invention based on the embodiments shown in the drawings. The above is only a preferred embodiment of the present invention, but the present invention is not limited to the scope of implementation shown in the drawings. Any changes made according to the concept of the present invention, or modifications to equivalent embodiments with equivalent changes, which still do not exceed the spirit covered by the description and drawings, should be within the protection scope of the present invention.

Claims

1. An encryption communication method supporting post-quantum algorithm, applied to a client, for realizing communication between the client and the server, characterized in that: The following steps are involved: Obtaining a first post-quantum algorithm public key and a server signature sent by the server, where the server signature is obtained by the server signing the server information using the second post-quantum algorithm private key; Use the built-in second post-quantum algorithm public key to verify the server signature and confirm the server identity; Generate a prekey and a session key, and use the first post-quantum algorithm public key to encrypt the prekey to obtain a ciphertext, and then send the ciphertext to the server; After the ciphertext is decrypted by the server, the session key is also generated by the server, and the client and the server mutually verify the session key. After the session key is successfully verified, the client uses the session key to perform encrypted communication with the server.

2. The method according to claim 1, characterized in that: Before obtaining the first post-quantum algorithm public key and the server signature sent by the server, the following steps are also included: Sending a first random number, supported protocol versions, and supported algorithm types to the server; A second random number, a selected protocol version, and a selected algorithm sent by the server are received to confirm that the client and the server communicate based on the same parameters.

3. The method according to claim 2, characterized in that: The session key is generated by the first random number, the second random number and the pre-key.

4. The method according to claim 3, characterized in that: The client and the server each construct a Finished message, the Finished message including a session key, a fixed string, and a hash value of handshake information, and the client and the server encrypt the Finished message using the session key; The encrypted Finished message is sent to the other party. The receiver uses the session key to decrypt the received Finished message. The receiver calculates the hash value theoretically contained in the Finished message and compares it with the hash value in the decrypted Finished message. If the hash values ​​match, it means that the sender uses the correct session key and the handshake message has not been tampered with. If the Finished message verification succeeds, the client and the server perform encrypted communication using the session key.

5. The method according to claim 2, characterized in that: The algorithm supported by the client is any of the following: Post-quantum algorithms; National secret algorithm; International classic algorithm; A first hybrid algorithm based on the post-quantum algorithm and the national secret algorithm; A second hybrid algorithm based on the post-quantum algorithm and the international classical algorithm; A third hybrid algorithm based on the national secret algorithm and the international classical algorithm; The fourth hybrid algorithm is based on the post-quantum algorithm, the national secret algorithm and the international classical algorithm.

6. The method according to claim 1, characterized in that: The first post-quantum algorithm is a post-quantum cryptographic encapsulation algorithm, and the second post-quantum algorithm is a post-quantum cryptographic signature algorithm.

7. An encryption communication method supporting post-quantum algorithm, applied to a server, for realizing communication between a client and a server, characterized in that: The following steps are involved: Obtaining a first random number, a supported protocol version, and a supported algorithm type sent by the client, determining a protocol version and an algorithm supported by itself from the supported protocol versions and the supported algorithm types, and sending the selection result and the second random number to the client; Sending the first post-quantum algorithm public key and the server signature to the client; The ciphertext sent by the client is received, and a session key is generated after decryption. After the session key is successfully verified, the client uses the session key to perform encrypted communication with the server.

8. An encrypted communication device, characterized in that: Applied to a client, the device comprises: An initialization module, used to send a first random number, a supported protocol version, and a supported algorithm type to the server, and receive a second random number, a selected protocol version, and a selected algorithm sent by the server; An identity authentication module, used to obtain a first post-quantum algorithm public key and a server signature sent by the server, and use a built-in second post-quantum algorithm public key to verify the server signature and confirm the server identity; A pre-key generation module, used to generate a pre-key, encrypt the pre-key using the first post-quantum algorithm public key to obtain a ciphertext, and then send the ciphertext to the server; The session key generation and authentication module is used for the client to generate a session key after generating a pre-key, and after the session key is successfully verified, the client uses the session key to perform encrypted communication with the server.

9. An encrypted communication system, characterized in that: It includes the client and the server, where: The client has a built-in second post-quantum algorithm public key, and the server has a built-in first post-quantum algorithm public and private key and a second post-quantum algorithm private key; The client sends a first random number, a supported protocol version, and a supported algorithm type to the server, and receives a second random number, a selected protocol version, and a selected algorithm sent by the server; obtains a first post-quantum algorithm public key and a server signature sent by the server, and verifies the server signature using a built-in second post-quantum algorithm public key; generates a pre-key, and uses the first post-quantum algorithm public key to encrypt the pre-key to obtain a ciphertext, and then sends the ciphertext to the server; generates a session key using the first random number, the second random number, and the pre-key, and the client and the server mutually verify the session key; The server selects a protocol version and algorithm supported by itself from the protocol versions and algorithm types supported by the client, and sends the selection result and the second random number to the client; sends the first post-quantum algorithm public key and the server signature to the client, the server receives the ciphertext sent by the client, and decrypts it using the first post-quantum algorithm key to obtain the plaintext of the pre-key, uses the first random number, the second random number and the pre-key to generate a session key, and the server and the client jointly verify the session key.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores the method for executing any one of claims 1 to 7.

Images