SSL VPN (Secure Socket Layer Virtual Private Network) remote access method and system supporting post-quantum algorithm and related device

Abstract

The invention discloses an SSL VPN remote access method and system supporting a post-quantum algorithm and a related device, the remote access method is applied to a client to enable the client to remotely access a target server through a VPN server, and the method comprises the following steps: establishing a PQC secure channel with the VPN server to negotiate and determine a key and identity authentication; encrypting the original data by using the negotiated encryption key, and sending the encrypted data to the VPN server; and decrypting the encrypted data by the VPN server by using the negotiated decryption key, and sending the decrypted data to the target server. Compared with the prior art, the method has the advantages that the PQC security channel is established between the client and the VPN server, and the PQC security channel is used for negotiating and determining the key and authenticating the identity, so that the protection on the quantum computer attack can be provided, and the security of the key exchange process is ensured.

Description

Technical Field

[0001] The present invention relates to the field of quantum encryption communication technology, and in particular to an SSL VPN remote access method, system and related devices supporting a post-quantum algorithm. Background Art

[0002] VPN stands for Virtual Private Network, which is a communication method commonly used to connect private networks between medium and large enterprises or groups. For example, a company with offices in multiple locations can use VPN to connect different regions to the same intranet; or you can also access the company's intranet through VPN when working from home.

[0003] When a user wants to use VPN to exchange data with a target server in the internal network from an external network, the VPN client will establish an encrypted connection between the user and the VPN server. This connection is called a VPN tunnel. The tunnel encrypts the user's data packets using encryption protocols to ensure the security of the data during transmission. In the VPN tunnel, the user's data packets are encapsulated in new data packets and encrypted before being sent to the target server. Once the data reaches the VPN server, the VPN server decrypts the user's data packets and sends them to the target server. When returning the data, the VPN server encrypts the data packets again and transmits them to the user through the tunnel. In this way, the communication between the user and the target server can be protected on the public network, and third parties cannot eavesdrop or intercept the user's data.

[0004] Currently, communications between users and target servers are protected using classical algorithms, which will be difficult to resist attacks from quantum computers in the future. Summary of the invention

[0005] The purpose of the present invention is to provide an SSL VPN remote access method, system and related devices supporting post-quantum algorithms to solve the technical problems in the prior art, which can provide anti-quantum protection.

[0006] In a first aspect, the present invention provides an SSL VPN remote access method supporting a post-quantum algorithm, which is applied to a client so that the client remotely accesses a target server through a VPN server, the method comprising:

[0007] Establish a PQC secure channel with the VPN server to negotiate and determine the key and identity authentication;

[0008] Encrypt the original data using the negotiated encryption key, and send the encrypted data to the VPN server;

[0009] The encrypted data is decrypted by the VPN server using the negotiated decryption key and sent to the target server.

[0010] As described above, in the SSL VPN remote access method supporting post-quantum algorithm, preferably, the client establishes a PQC secure channel with the VPN server to negotiate and determine the key and identity authentication, including:

[0011] Sending a first random number, a session ID, supported protocol versions, and supported algorithm types to the VPN server;

[0012] Receiving a first post-quantum algorithm public key, a second random number, a session ID, a selected protocol version, and a selected algorithm sent by the VPN server to confirm that the client and the VPN server communicate based on the same parameters;

[0013] Obtaining a server signature sent from the VPN server, where the server signature is obtained by the VPN server signing VPN server information using a second post-quantum algorithm private key;

[0014] Use the built-in second post-quantum algorithm public key to verify the server signature and confirm the VPN server identity;

[0015] encapsulate the pre-master key and the ciphertext of the pre-master key using the first post-quantum algorithm public key, retain the pre-master key, generate a master key using the first random number, the second random number and the pre-master key, derive a session key based on the master key, and then send the ciphertext to the VPN server;

[0016] After the ciphertext is decrypted by the VPN server, the session key is also generated by the VPN server, and the client and the VPN server mutually verify the session key of both parties. After the session key is successfully verified, the client uses the session key to perform encrypted communication with the VPN server.

[0017] As described above, in the SSL VPN remote access method supporting post-quantum algorithm, preferably, the client establishes a PQC secure channel with the VPN server to negotiate and determine the key and identity authentication, including:

[0018] Sending a first random number, a session ID, supported protocol versions, and supported algorithm types to the VPN server;

[0019] receiving a second random number, a session ID, a selected protocol version, and a selected algorithm sent by the VPN server to confirm that the client and the VPN server communicate based on the same parameters;

[0020] encapsulate the pre-master key and the ciphertext of the pre-master key using the first post-quantum algorithm public key, retain the pre-master key, generate a master key using the first random number, the second random number and the pre-master key, derive a session key based on the master key, and then send the ciphertext to the VPN server;

[0021] After the ciphertext is decrypted by the VPN server, the session key is also generated by the VPN server, and the client and the VPN server mutually verify the session key of both parties. After the session key is successfully verified, the client uses the session key to perform encrypted communication with the VPN server.

[0022] The SSL VPN remote access method supporting post-quantum algorithm as described above, wherein preferably,

[0023] The session key is also generated by the VPN server;

[0024] The client and the VPN server each construct a Finished message, the Finished message including a session key, a fixed string, and a hash value of a handshake message, and the client and the VPN server encrypt the Finished message using the session key;

[0025] The encrypted Finished message is sent to the other party. The receiver uses the session key to decrypt the received Finished message. The receiver calculates the hash value theoretically contained in the Finished message and compares it with the hash value in the decrypted Finished message. If the hash values ​​match, it means that the sender uses the correct session key and the handshake message has not been tampered with.

[0026] If the Finished message verification succeeds, the client and the server perform encrypted communication using the session key.

[0027] In the SSL VPN remote access method supporting post-quantum algorithms as described above, preferably, the algorithm supported by the client adopts any one of the following:

[0028] Post-quantum algorithms;

[0029] National secret algorithm;

[0030] International classic algorithm;

[0031] A first hybrid algorithm based on the post-quantum algorithm and the national secret algorithm;

[0032] A second hybrid algorithm based on the post-quantum algorithm and the international classical algorithm;

[0033] A third hybrid algorithm based on the national secret algorithm and the international classical algorithm;

[0034] The fourth hybrid algorithm is based on the post-quantum algorithm, the national secret algorithm and the international classical algorithm.

[0035] As described above, a SSL VPN remote access method supporting a post-quantum algorithm, wherein preferably, the first post-quantum algorithm is a post-quantum cryptographic encapsulation algorithm, and the second post-quantum algorithm is a post-quantum cryptographic signature algorithm.

[0036] In a second aspect, the present invention provides an SSL VPN remote access system, including a client, a VPN server and a target server, wherein the client has an application program, a first VPN function module and a first network interface that are sequentially signal-connected, the VPN server has a second network interface, a second VPN function module and a forwarding module that are sequentially signal-connected, and the target server has a plurality of service modules, wherein:

[0037] The application sends the original data to the first VPN function module, and the first VPN function module establishes a PQC secure channel with the second VPN function module to negotiate and determine a key; the first VPN function module encrypts the original data using the negotiated encryption key, and the encrypted data is sent by the first VPN module to the first network interface;

[0038] After the second network interface receives the encrypted data sent by the first network interface, the encrypted data is passed to the second VPN function module. The second VPN function module decrypts the encrypted data using the negotiated decryption key and sends it to the forwarding module. The forwarding module forwards the decrypted data to the corresponding business module of the target server.

[0039] In the SSL VPN remote access system as described above, preferably, the first VPN function module and the second VPN function module establish a PQC secure channel, including:

[0040] The first VPN function module sends a first random number, a session ID, a supported protocol version, and a supported algorithm type to the second VPN function module;

[0041] The second VPN function module selects a protocol version and algorithm supported by itself from the protocol versions and algorithm types supported by the first VPN function module, and sends the selection result, the first post-quantum algorithm public key, the second random number and the session ID to the first VPN function module; the second VPN function module signs the VPN server information using the second post-quantum algorithm private key to obtain a server signature, and sends the server signature to the first VPN function module;

[0042] The first VPN function module verifies the server signature using the built-in second post-quantum algorithm public key, encapsulates the pre-master key and the ciphertext of the pre-master key using the first post-quantum algorithm public key, retains the pre-master key, generates a master key using the first random number, the second random number and the pre-master key, derives a session key based on the master key, and then sends the ciphertext to the VPN server;

[0043] The second VPN function module receives the ciphertext sent by the first VPN function module, decrypts it using the first post-quantum algorithm key to obtain a pre-master key, and generates a session key using the first random number, the second random number and the pre-master key;

[0044] The first VPN function module and the second VPN function module mutually authenticate the session key.

[0045] In a third aspect, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the aforementioned method when executing the computer program.

[0046] In a fourth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions for executing the aforementioned method.

[0047] Compared with the prior art, the present invention establishes a PQC secure channel between the client and the VPN server. The PQC secure channel is used to negotiate and determine the key and identity authentication. The encrypted data is sent to the VPN server through the established PQC secure channel. In this process, the data is encrypted by the post-quantum algorithm to protect the data from being read or tampered with by unauthorized third parties, thereby providing protection against quantum computer attacks and ensuring the security of the key exchange process. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is a flowchart of the SSL VPN remote access method provided by an embodiment of the present invention;

[0049] Figure 2 It is a flowchart of the first PQC secure channel establishment method provided by an embodiment of the present invention;

[0050] Figure 3 It is a flow chart of a second PQC secure channel establishment method provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, but should not be construed as limiting the present invention.

[0052] Reference Figure 1 As shown, an embodiment of the present invention provides an SSL VPN remote access method supporting a post-quantum algorithm, which is applied to a client so that the client can remotely access a target server through a VPN server. In a feasible implementation, the client has an application program, a first VPN function module, and a first network interface that are sequentially connected by signals, the VPN server has a second network interface, a second VPN function module, and a forwarding module that are sequentially connected by signals, and the target server has multiple service modules. The method includes the following steps:

[0053] Step S101: Establish a PQC secure channel with the VPN server to negotiate and determine the key and identity authentication. The secure channel is built based on the post-quantum cryptography algorithm (PQC). This channel will be used to negotiate and determine the key and identity authentication. The post-quantum cryptography algorithm can provide protection against quantum computer attacks and ensure the security of the key exchange process.

[0054] Specifically, the application sends original data to the first VPN function module, and a PQC secure channel is established between the first VPN function module and the second VPN function module. The establishment of this secure channel is to negotiate the encryption key used by both communicating parties and perform identity authentication.

[0055] After the PQC secure channel is established, the first VPN function module and the second VPN function module will conduct key negotiation. This process includes the use of post-quantum cryptographic algorithms to protect key exchange, ensuring that the security of key exchange can be guaranteed even in the era of quantum computing. While negotiating the key, the first VPN function module and the second VPN function module will also perform identity authentication to ensure that the identities of both parties in the communication are credible.

[0056] Step S102: Encrypt the original data using the negotiated encryption key, and send the encrypted data to the VPN server.

[0057] Specifically, the first VPN function module uses the negotiated encryption key to encrypt the original data, and the encrypted data is sent by the first VPN module to the first network interface. Once the secure channel is established, the client and the VPN server will use the negotiated encryption key to encrypt the original data.

[0058] The first network interface sends the encrypted data to the second network interface of the VPN server. After the second network interface receives the encrypted data sent by the first network interface, the encrypted data is transmitted to the second VPN function module.

[0059] Step S103: The encrypted data is decrypted by the VPN server using the negotiated decryption key and then sent to the target server.

[0060] Specifically, after receiving the encrypted data sent from the second network interface, the second VPN function module in the VPN server decrypts the data using the decryption key previously determined through the key negotiation process. This step ensures the security of the data during transmission and prevents unauthorized third parties from accessing or tampering with the data.

[0061] The decrypted data is sent to the forwarding module of the VPN server. The forwarding module is responsible for forwarding data from the VPN server to the target server on the internal network or the Internet. The forwarding module forwards the decrypted data to the corresponding business module of the target server. This business module is the part on the target server that is responsible for processing specific business logic, which receives and processes data from the VPN.

[0062] After receiving the data, the service module of the target server further processes the data according to the service requirements, such as storing, calculating or responding to the client's request. If the service module needs to return a response to the client, it will send the response data back to the forwarding module of the VPN server, and then the forwarding module will send the response data to the second VPN function module, which will encrypt the response data and send it back to the client via the second network interface. After receiving the encrypted response data, the first VPN function module of the client uses the corresponding decryption key to decrypt the data and display the decrypted data to the user or further process it.

[0063] In a first possible implementation, refer to Figure 2 As shown, a PQC secure channel is established with the VPN server to negotiate and determine the key and identity authentication, including the following steps:

[0064] Step S1011: Send a first random number, a session ID, a supported protocol version, and a supported algorithm type to a VPN server; receive a first post-quantum algorithm public key, a second random number, a session ID, a selected protocol version, and a selected algorithm sent by the VPN server to confirm that the client and the VPN server communicate based on the same parameters.

[0065] Specifically, the first random number is used in the subsequent key generation and verification process. Preferably, the first random number is a quantum random number, which is a random number generated based on the principle of quantum mechanics and is unpredictable and aperiodic to ensure security and reliability during the communication process.

[0066] The protocol version sent by the first VPN function module determines the specification and rule framework that the two parties follow in subsequent communications. The protocol version defines the rules and steps that must be followed during the communication process, including how to establish a connection, how to exchange information, and how to handle errors. The type of algorithm is related to subsequent security-related operations such as encryption and signing to establish the initial parameters of communication.

[0067] After receiving the information from the first VPN function module, the second VPN function module starts to screen from the protocol version and algorithm type set provided by the first VPN function module, and determines a suitable option based on its own system configuration, pre-set security policies, and support capabilities for various protocols and algorithms. After determining the selection, the second VPN function module will clearly inform the first VPN function module which protocol version and algorithm type is specifically selected, so that the first VPN function module knows that subsequent communications will be carried out accordingly.

[0068] In addition, the second VPN function module will also generate and transmit a second random number to the first VPN function module. The second random number is similar to the first random number sent by the first VPN function module and is also used for subsequent operations such as generating session keys. Preferably, the second random number is also a quantum random number. By providing random numbers by both parties, the randomness and confidentiality of key generation are further enhanced.

[0069] By exchanging random numbers and confirming the protocol version and algorithm, the first VPN function module and the server confirm that they use the same communication rules and security measures, thereby establishing a secure communication channel.

[0070] In the embodiment provided by the present invention, the first VPN function module has a built-in second post-quantum algorithm public key, and the second VPN function module has a built-in first post-quantum algorithm public and private key and a second post-quantum algorithm private key. In a feasible implementation, the first post-quantum algorithm is a post-quantum cryptographic encapsulation algorithm, and the first post-quantum cryptographic encapsulation algorithm is exemplarily a Kyber algorithm. The Kyber algorithm is a lattice-based public key encryption scheme used for key encapsulation and other operations. The second VPN function module sends the Kyber public key to the first VPN function module for subsequent key encapsulation and decryption operations to build a secure communication key system for both parties. The second post-quantum algorithm is a post-quantum cryptographic signature algorithm. The second post-quantum cryptographic signature algorithm is exemplarily a Dilithium algorithm. The Dilithium algorithm is a lattice-based digital signature scheme used for identity authentication and other operations.

[0071] Step S1012: Obtain the server signature sent from the VPN server, where the server signature is obtained by the VPN server using the second post-quantum algorithm private key to sign the VPN server information; use the built-in second post-quantum algorithm public key to verify the server signature and confirm the VPN server identity.

[0072] Specifically, the server-side signature is obtained by the second VPN function module using the built-in Dilithium private key to sign its own related information, while the first VPN function module has a built-in Dilithium public key. Through the signature method based on the private key, the second VPN function module proves the legitimacy of its identity to the first VPN function module. Only the party with the corresponding Dilithium private key can generate the correct signature, and the first VPN function module can be verified through the corresponding Dilithium public key. If the verification is successful, it means that the second VPN function module currently communicating with it is legal and has the corresponding private key, thereby confirming the identity of the second VPN function module and laying the foundation for subsequent secure and reliable communication; if the verification fails, it may mean that there is a security risk, such as encountering a man-in-the-middle attack, and the communication will be interrupted.

[0073] Through this step, the first VPN function module can ensure the authenticity of the identity of the second VPN function module and the security of communication. At the same time, this process utilizes the characteristics of post-quantum algorithms to resist the threat of quantum computing.

[0074] Step S1013: Use the first post-quantum algorithm public key to encapsulate the pre-master key and the ciphertext of the pre-master key, retain the pre-master key, use the first random number, the second random number and the pre-master key to generate a master key, derive a session key based on the master key, and then send the ciphertext to the VPN server.

[0075] After confirming the identity of the second VPN function module, the first VPN function module will use the Kyber public key sent by the second VPN function module to perform a key encapsulation operation. In this process, a specific key encapsulation algorithm is used in combination with relevant parameters to generate a pre-master key and the corresponding ciphertext form (i.e., Cipher).

[0076] The pre-master key is usually a randomly generated random number, preferably a quantum random number, which is used for subsequent session encryption. Encrypting it into a Cipher is to ensure that it is not leaked during transmission to the second VPN function module to ensure its confidentiality. Subsequently, the first VPN function module will send the Cipher to the second VPN function module to enter the next round of interaction.

[0077] Step S1014: After the ciphertext is decrypted by the server, a session key is also generated by the server. The client and the server verify each other's session key. After the session key is successfully verified, the client uses the session key to perform encrypted communication with the server.

[0078] Specifically, after the second VPN function module receives the Cipher sent by the first VPN function module, it uses its own Kyber private key to decrypt it. Since there is a specific mathematical correspondence between the Kyber public key and the private key, only the private key that matches it can correctly decrypt the ciphertext generated by the corresponding public key. Through this decryption process, the second VPN function module can successfully obtain the plaintext content of the pre-master key.

[0079] After the ciphertext is decrypted by the second VPN function module, the second VPN function module now has the necessary elements for generating a session key, namely, the first random number, the second random number, and the pre-master key. The second VPN function module uses the same algorithm to combine the first random number, the second random number, and the pre-master key to generate a master key, and derives a session key based on the master key.

[0080] In order to ensure that the session key calculated by both parties is completely consistent and has not been tampered with, the two parties will send each other a Finished message encrypted with the session key. The first VPN function module and the second VPN function module each construct a Finished message, which includes the session key, a fixed string (such as "server finished" or "client finished"), and the hash value of all messages exchanged from the beginning of the handshake to the present. This hash value includes the hash of all previous handshake messages to ensure the integrity of the message. The first VPN function module and the second VPN function module encrypt the Finished message using the session key, which is generated in the previous key exchange process, ensuring that only the two parties with the correct session key can decrypt the message.

[0081] The encrypted Finished message is sent to the other party. The receiver uses the session key to decrypt the received Finished message. The receiver calculates the hash value theoretically contained in the Finished message and compares it with the hash value in the decrypted Finished message. If the hash values ​​match, it means that the sender is using the correct session key and the handshake message has not been tampered with.

[0082] If the Finished message verification succeeds, the first VPN function module and the second VPN function module perform encrypted communication using the session key.

[0083] Taking the message sent by the first VPN function module as an example, the plaintext structure of the message has a strict design. First, all the messages sent by both parties before are hashed to obtain a hash value, and then the hash value is integrated with the session key and the fixed string "client finished" and hashed again. The first VPN function module uses the session key to encrypt the message and sends it to the second VPN function module. After receiving it, the second VPN function module decrypts it with the same session key and calculates the hash value according to the same rules. Then, the two hash values ​​are compared. If the two are consistent, it means that the session key used by both parties is correct, and the messages during the entire session have not been tampered with, ensuring the integrity and security of the communication. After that, the second VPN function module will also generate a message with a similar structure but with the fixed string replaced ("serverfinished") and encrypt it and send it to the first VPN function module for the same verification operation. This method not only verifies that both parties have calculated the correct session key, but also ensures that the session messages of both parties have not been tampered with.

[0084] After the key verification step, the first VPN function module and the second VPN function module have determined a consistent, secure and reliable session key. On this basis, the first VPN function module and the second VPN function module can use this session key to encrypt the communication content, ensuring that the communication data is confidential during network transmission. Only the two parties with the correct session key can decrypt and restore the encrypted content to achieve secure communication.

[0085] In a feasible implementation manner, the algorithm supported by the first VPN function module adopts any one of the following:

[0086] Post-quantum algorithms provide quantum-resistant data protection to ensure data security in the quantum computing era, including one or more algorithms in Kyber and Dilithum.

[0087] National secret algorithm refers to the cryptographic algorithm approved by the State Cryptography Administration, including one or more of SM1, SM2, SM3, SM4, SM7, SM9 and ZUC.

[0088] International classic algorithms refer to cryptographic algorithms that are widely used internationally, including one or more of AES, RSA, and ECDSA.

[0089] The first hybrid algorithm based on post-quantum algorithms and national secret algorithms combines post-quantum algorithms and national secret algorithms to provide a more flexible security solution. This hybrid approach can introduce post-quantum algorithms to meet future security challenges while maintaining the compatibility of traditional algorithms.

[0090] The second hybrid algorithm based on post-quantum algorithms and international classical algorithms combines post-quantum algorithms and international classical algorithms to provide a more flexible security solution. This hybrid approach can introduce post-quantum algorithms to meet future security challenges while maintaining the compatibility of traditional algorithms.

[0091] The third hybrid algorithm based on the national secret algorithm and the international classical algorithm combines the national secret algorithm and the international classical algorithm to provide stronger security and flexibility.

[0092] The fourth hybrid algorithm based on post-quantum algorithms, national secret algorithms and international classical algorithms combines post-quantum algorithms, national secret algorithms and international classical algorithms to provide a more flexible security solution. This hybrid approach can introduce post-quantum algorithms to meet future security challenges while maintaining the compatibility of traditional algorithms.

[0093] By designing a variety of preset algorithms, users can choose the appropriate algorithm according to their actual needs, ensuring that even if one party does not support the post-quantum algorithm, the classical algorithm can be used to complete the entire process, providing users with a comprehensive, flexible and forward-looking security solution to protect data from current and future potential threats.

[0094] In a second feasible implementation, if the first VPN function module and the second VPN function module have established a PQC secure channel, but want to change the master key used, the following process can be followed. Compared with re-establishing a secure channel, the following process saves the identity authentication process.

[0095] Specifically, refer to Figure 3 As shown, a PQC secure channel is established with the VPN server to negotiate and determine the key and identity authentication, including:

[0096] Step S1011: Send a first random number, a session ID, a supported protocol version, and a supported algorithm type to the VPN server, and receive a second random number, a session ID, a selected protocol version, and a selected algorithm sent by the VPN server to confirm that the first VPN function module communicates with the VPN server based on the same parameters.

[0097] Step S1013: Use the first post-quantum algorithm public key to encapsulate the pre-master key and the ciphertext of the pre-master key, retain the pre-master key, use the first random number, the second random number and the pre-master key to generate a master key, derive a session key based on the master key, and then send the ciphertext to the VPN server.

[0098] Step S1014: After the ciphertext is decrypted by the VPN server, a session key is also generated by the VPN server. The client and the VPN server mutually verify the session key. After the session key is successfully verified, the client uses the session key to perform encrypted communication with the VPN server.

[0099] In a second aspect, the present invention provides an SSL VPN remote access system, including a client, a VPN server and a target server, wherein the client has an application program, a first VPN function module and a first network interface which are sequentially connected by signals, the VPN server has a second network interface, a second VPN function module and a forwarding module which are sequentially connected by signals, and the target server has a plurality of service modules, wherein:

[0100] The application sends the original data to the first VPN function module, and the first VPN function module establishes a PQC secure channel with the second VPN function module to negotiate and determine the key; the first VPN function module encrypts the original data using the negotiated encryption key, and the encrypted data is sent by the first VPN module to the first network interface.

[0101] After the second network interface receives the encrypted data sent by the first network interface, the encrypted data is passed to the second VPN function module. The second VPN function module decrypts the encrypted data using the negotiated decryption key and sends it to the forwarding module. The forwarding module forwards the decrypted data to the corresponding service module of the target server.

[0102] In the embodiment provided by the present invention, the first VPN function module and the second VPN function module establish a PQC secure channel, including:

[0103] The first VPN function module sends the first random number, the session ID, the supported protocol version, and the supported algorithm type to the second VPN function module.

[0104] The second VPN function module selects the protocol version and algorithm it supports from the protocol versions and algorithm types supported by the first VPN function module, and sends the selection result, the first post-quantum algorithm public key, the second random number and the session ID to the first VPN function module; the second VPN function module uses the second post-quantum algorithm private key to sign the VPN server information to obtain a server signature, and sends the server signature to the first VPN function module.

[0105] The first VPN functional module uses the built-in second post-quantum algorithm public key to verify the server signature, uses the first post-quantum algorithm public key to encapsulate the pre-master key and the ciphertext of the pre-master key, retains the pre-master key, and then sends the ciphertext to the VPN server; uses the first random number, the second random number and the pre-master key to generate a master key, and derives a session key based on the master key.

[0106] The second VPN function module receives the ciphertext sent by the first VPN function module, decrypts it using the first post-quantum algorithm key to obtain the pre-master key, and generates a session key using the first random number, the second random number and the pre-master key.

[0107] The first VPN function module and the second VPN function module mutually authenticate the session key.

[0108] In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to implement the steps in any one of the above method embodiments.

[0109] Specifically, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0110] Specifically, in this embodiment, the processor may be configured to implement the following steps through a computer program:

[0111] Step S101: Establish a PQC secure channel with a VPN server to negotiate and determine keys and identity authentication.

[0112] Step S102: Encrypt the original data using the negotiated encryption key, and send the encrypted data to the VPN server.

[0113] Step S103: The encrypted data is decrypted by the VPN server using the negotiated decryption key and then sent to the target server.

[0114] In a fourth aspect, an embodiment of the present invention further provides a storage medium, in which a computer program is stored, wherein the computer program is configured to implement the steps of any of the above method embodiments when run.

[0115] Specifically, in this embodiment, the above storage medium may be configured to store a computer program for implementing the following steps:

[0116] Step S101: Establish a PQC secure channel with a VPN server to negotiate and determine keys and identity authentication.

[0117] Step S102: Encrypt the original data using the negotiated encryption key, and send the encrypted data to the VPN server.

[0118] Step S103: The encrypted data is decrypted by the VPN server using the negotiated decryption key and then sent to the target server.

[0119] The above describes in detail the structure, features and effects of the present invention based on the embodiments shown in the drawings. The above is only a preferred embodiment of the present invention, but the present invention is not limited to the scope of implementation shown in the drawings. Any changes made according to the concept of the present invention, or modifications to equivalent embodiments with equivalent changes, which still do not exceed the spirit covered by the description and drawings, should be within the protection scope of the present invention.

Claims

1. A SSL VPN remote access method supporting post-quantum algorithms, characterized in that: Applied to a client so that the client remotely accesses a target server through a VPN server, the method comprises: Establish a PQC secure channel with the VPN server to negotiate and determine the key and identity authentication; Encrypt the original data using the negotiated encryption key, and send the encrypted data to the VPN server; The encrypted data is decrypted by the VPN server using the negotiated decryption key and sent to the target server.

2. The method according to claim 1, characterized in that: The client establishes a PQC secure channel with the VPN server to negotiate and determine a key and identity authentication, including: Sending a first random number, a session ID, supported protocol versions, and supported algorithm types to the VPN server; Receiving a first post-quantum algorithm public key, a second random number, a session ID, a selected protocol version, and a selected algorithm sent by the VPN server to confirm that the client and the VPN server communicate based on the same parameters; Obtaining a server signature sent from the VPN server, where the server signature is obtained by the VPN server signing VPN server information using a second post-quantum algorithm private key; Use the built-in second post-quantum algorithm public key to verify the server signature and confirm the VPN server identity; encapsulate the pre-master key and the ciphertext of the pre-master key using the first post-quantum algorithm public key, retain the pre-master key, generate a master key using the first random number, the second random number and the pre-master key, derive a session key based on the master key, and then send the ciphertext to the VPN server; After the ciphertext is decrypted by the VPN server, the session key is also generated by the VPN server, and the client and the VPN server mutually verify the session key of both parties. After the session key is successfully verified, the client uses the session key to perform encrypted communication with the VPN server.

3. The method according to claim 2, characterized in that: The client establishes a PQC secure channel with the VPN server to negotiate and determine a key and identity authentication, including: Sending a first random number, a session ID, supported protocol versions, and supported algorithm types to the VPN server; receiving a second random number, a session ID, a selected protocol version, and a selected algorithm sent by the VPN server to confirm that the client and the VPN server communicate based on the same parameters; encapsulate the pre-master key and the ciphertext of the pre-master key using the first post-quantum algorithm public key, retain the pre-master key, generate a master key using the first random number, the second random number and the pre-master key, derive a session key based on the master key, and then send the ciphertext to the VPN server; After the ciphertext is decrypted by the VPN server, the session key is also generated by the VPN server, and the client and the VPN server mutually verify the session key of both parties. After the session key is successfully verified, the client uses the session key to perform encrypted communication with the VPN server.

4. The method according to claim 2 or 3, characterized in that: The client and the VPN server each construct a Finished message, the Finished message including a session key, a fixed string, and a hash value of a handshake message, and the client and the VPN server encrypt the Finished message using the session key; The encrypted Finished message is sent to the other party. The receiver uses the session key to decrypt the received Finished message. The receiver calculates the hash value theoretically contained in the Finished message and compares it with the hash value in the decrypted Finished message. If the hash values ​​match, it means that the sender uses the correct session key and the handshake message has not been tampered with. If the Finished message verification succeeds, the client and the server perform encrypted communication using the session key.

5. The method according to claim 2 or 3, characterized in that: The algorithm supported by the client is any of the following: Post-quantum algorithms; National secret algorithm; International classic algorithm; A first hybrid algorithm based on the post-quantum algorithm and the national secret algorithm; A second hybrid algorithm based on the post-quantum algorithm and the international classical algorithm; A third hybrid algorithm based on the national secret algorithm and the international classical algorithm; The fourth hybrid algorithm is based on the post-quantum algorithm, the national secret algorithm and the international classical algorithm.

6. The method according to claim 2, characterized in that: The first post-quantum algorithm is a post-quantum cryptographic encapsulation algorithm, and the second post-quantum algorithm is a post-quantum cryptographic signature algorithm.

7. An SSL VPN remote access system, characterized in that: The invention comprises a client, a VPN server and a target server, wherein the client has an application program, a first VPN function module and a first network interface which are sequentially connected by signals, the VPN server has a second network interface, a second VPN function module and a forwarding module which are sequentially connected by signals, and the target server has a plurality of service modules, wherein: The application sends the original data to the first VPN function module, and the first VPN function module establishes a PQC secure channel with the second VPN function module to negotiate and determine a key; the first VPN function module encrypts the original data using the negotiated encryption key, and the encrypted data is sent by the first VPN module to the first network interface; After the second network interface receives the encrypted data sent by the first network interface, the encrypted data is passed to the second VPN function module. The second VPN function module decrypts the encrypted data using the negotiated decryption key and sends it to the forwarding module. The forwarding module forwards the decrypted data to the corresponding business module of the target server.

8. An SSL VPN remote access system, characterized in that: The first VPN function module and the second VPN function module establish a PQC secure channel, including: The first VPN function module sends a first random number, a session ID, a supported protocol version, and a supported algorithm type to the second VPN function module; The second VPN function module selects a protocol version and algorithm supported by itself from the protocol versions and algorithm types supported by the first VPN function module, and sends the selection result, the first post-quantum algorithm public key, the second random number and the session ID to the first VPN function module; the second VPN function module signs the VPN server information using the second post-quantum algorithm private key to obtain a server signature, and sends the server signature to the first VPN function module; The first VPN function module verifies the server signature using the built-in second post-quantum algorithm public key, encapsulates the pre-master key and the ciphertext of the pre-master key using the first post-quantum algorithm public key, retains the pre-master key, generates a master key using the first random number, the second random number and the pre-master key, derives a session key based on the master key, and then sends the ciphertext to the VPN server; The second VPN function module receives the ciphertext sent by the first VPN function module, decrypts it using the first post-quantum algorithm key to obtain a pre-master key, and generates a session key using the first random number, the second random number and the pre-master key; The first VPN function module and the second VPN function module mutually authenticate the session key.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores the method for executing any one of claims 1 to 6.

Images