A zero-trust SPA identity authentication method, system, device and medium combined with quantum key

Abstract

The present invention proposes a zero-trust SPA identity authentication method, system, device and medium combined with quantum key, the method comprising: receiving a single data packet sent by a client, wherein the client pre-stores multiple quantum keys; the data packet contains ciphertext information obtained by encrypting the identity authentication information based on the quantum key; extracting the key ID carried in the data packet, obtaining the target quantum key corresponding to the key ID, decrypting the ciphertext information based on the target quantum key, and obtaining the plaintext information; performing identity authentication processing on the plaintext information based on a preset authentication strategy, and establishing a connection with the client after passing the identity authentication. The present invention presets a quantum key in a zero-trust SDP client, and performs identity authentication through a quantum key when the zero-trust SDP client and the zero-trust SDP controller are not connected, and utilizes the true randomness of the quantum key, one-time one-pad and other confidentiality mechanisms to enhance the security of zero-trust SPA identity authentication.

Description

Technical Field

[0001] The present invention relates to the field of network security communication technology, and in particular to a zero-trust SPA identity authentication method, system, device and medium combined with quantum key. Background Art

[0002] Security protection technology based on network boundaries usually prevents external threats from entering the network through security measures such as firewalls and intrusion detection systems. However, with the development of cloud computing, big data, the Internet of Things, and mobile Internet, traditional network security boundaries have become blurred, and attack methods have become more covert and complex.

[0003] At present, the security measures implemented at the network boundary generally use encryption algorithms to protect information security. However, the emergence of quantum computing poses a severe challenge to the existing classical cryptographic system. Since quantum computing uses quantum bits for calculations, it has the ability to process information in parallel, which means that quantum computers can solve problems that traditional computers cannot efficiently complete in a very short time. This makes the current mainstream encryption algorithms such as RSA and ECC vulnerable to quantum computing, which seriously threatens the cryptographic application foundation of information security. Therefore, how to improve network information security to resist external threats has become the current key research and development direction. Summary of the invention

[0004] The embodiment of the present invention provides a zero-trust SPA identity authentication method, system, device and medium combined with quantum key to solve the problems existing in related technologies. The technical solution is as follows:

[0005] In a first aspect, an embodiment of the present invention provides a zero-trust SPA identity authentication method combined with a quantum key, comprising:

[0006] Receiving a single data packet sent by a client, wherein the client pre-stores a plurality of quantum keys; the data packet includes ciphertext information obtained by encrypting identity authentication information based on the quantum key;

[0007] Extract the key ID carried in the data packet, obtain the target quantum key corresponding to the key ID, decrypt the ciphertext information based on the target quantum key, and obtain the plaintext information;

[0008] The plaintext information is authenticated based on the preset authentication strategy, and a connection is established with the client after the identity authentication is passed.

[0009] In one embodiment, the client pre-stores multiple quantum keys including:

[0010] A plurality of quantum keys are prefabricated in a secure medium in an offline manner, and the secure medium is pre-installed in a client; wherein the plurality of quantum keys are generated by a quantum cryptography platform according to client information of the client.

[0011] In one implementation, the secure medium is one of a SIM card, a super SIM card, a TF card, or a USB device.

[0012] In one implementation, the ciphertext information is obtained by the client selecting one of the quantum keys from the secure medium to encrypt the identity authentication information according to a preset usage policy, wherein the used quantum key becomes invalid and is destroyed.

[0013] In one embodiment, the usage strategy includes:

[0014] Randomly select one quantum key from multiple quantum keys for encryption; or,

[0015] Multiple quantum keys are sorted in ascending order according to the key ID, and one quantum key is selected in sequence to encrypt the identity authentication information.

[0016] In one embodiment, the identity authentication information is a combination of one or more of a verification password, biometric data, a hardware token, social account authentication information, mobile device authentication information, or behavioral biometric data.

[0017] In one embodiment, it further includes:

[0018] Extract the key ID and ciphertext information carried in the data packet, pass the key ID and ciphertext information to the quantum cryptography platform for decryption, and obtain the plaintext information.

[0019] In a second aspect, an embodiment of the present invention provides a zero-trust SPA identity authentication system combined with a quantum key, including:

[0020] Quantum cryptography platform for generating multiple quantum keys;

[0021] The zero-trust SDP client is pre-installed with multiple quantum keys, which are used to encrypt the identity authentication information using the quantum keys, obtain the data packet and send the data packet to the zero-trust SDP controller;

[0022] The zero-trust SDP controller is connected to the quantum cryptography platform and the zero-trust SDP client, and is used to execute the zero-trust SPA identity authentication method combined with the quantum key as described above.

[0023] In a third aspect, an embodiment of the present invention provides an electronic device, the device comprising: a memory and a processor. The memory and the processor communicate with each other through an internal connection path, the memory is used to store instructions, the processor is used to execute the instructions stored in the memory, and when the processor executes the instructions stored in the memory, the processor executes the method in any one of the above-mentioned embodiments.

[0024] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a computer, the method in any one of the above-mentioned embodiments is executed.

[0025] The advantages or beneficial effects of the above technical solution include at least:

[0026] The present invention presets a quantum key in a zero-trust SDP client. When the zero-trust SDP client is not connected to a zero-trust SDP controller, identity authentication is performed through the quantum key. Confidentiality mechanisms such as true randomness and one-time pad of the quantum key are utilized to enhance the security of zero-trust SPA identity authentication.

[0027] The above summary is for illustrative purposes only and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments and features described above, further aspects, embodiments and features of the present invention will be readily apparent by reference to the accompanying drawings and the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the multiple drawings represent the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings only depict some embodiments disclosed in the present invention and should not be regarded as limiting the scope of the present invention.

[0029] Figure 1 It is a flowchart of the zero-trust SPA identity authentication method of the present invention;

[0030] Figure 2 A schematic diagram of data transmission between the client and the controller of the present invention;

[0031] Figure 3 It is a module schematic diagram of the zero-trust SPA identity authentication system of the present invention;

[0032] Figure 4 The structure block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present invention. Therefore, the drawings and descriptions are considered to be exemplary and non-restrictive in nature.

[0034] An embodiment of the present invention provides a zero-trust SPA identity authentication method combined with a quantum key. This method can utilize confidentiality mechanisms such as true randomness of quantum keys and one-time pad to enhance the security of zero-trust SPA identity authentication while retaining technical features such as zero-trust SDP multi-dimensional identity authentication and exposure surface hiding, and has anti-quantum characteristics.

[0035] This embodiment combines the zero-trust SPA identity authentication method with quantum key, and its execution object is mainly the zero-trust SDP controller. In other embodiments, the execution object can also be other servers, which is not limited here.

[0036] like Figure 1 As shown, the zero-trust SPA identity authentication method in this embodiment combined with quantum key specifically includes:

[0037] Step S1: receiving a single data packet sent by a client, wherein the client has pre-stored multiple quantum keys; the data packet contains ciphertext information obtained by encrypting identity authentication information based on the quantum key.

[0038] It should be noted that the client in this embodiment refers to the zero-trust SDP client, which refers to a key component of the Software Defined Perimeter (SDP) in the zero-trust security architecture, namely the SDP client software, which is used to implement secure access control in the zero-trust model. Zero-trust SDP emphasizes the principle of "never trust, always verify", and ensures that only authorized and verified entities can access specific network resources by implementing strict identity authentication, access control, and network isolation.

[0039] like Figure 2 As shown, when the zero-trust SDP client is not connected to the zero-trust SDP controller, the zero-trust SDP client initiates an access request to the zero-trust SDP controller, and sends a single data packet to the zero-trust SDP controller through the zero-trust SPA single-packet authorization technology for authentication and authorization. Only when the authentication and authorization are passed, the zero-trust SDP controller connects to the zero-trust SDP client to achieve communication.

[0040] It should be noted that Zero Trust SPA refers to Single Packet Authorization, which is a key technology in the Zero Trust architecture. SPA implements a lightweight authentication process for access requests by carrying all necessary authentication and authorization information in a single data packet. This technology allows services to be hidden by firewalls, and access to the corresponding services is allowed only after the device and user identity are verified. The core advantage of SPA is that it can simplify the authentication process while enhancing the network's stealth capabilities, making it difficult for attackers to discover service addresses and ports, thereby improving overall security.

[0041] In this embodiment, a large number of different quantum keys are preset in the zero-trust SDP client, and the preset quantum keys contain at least key ID and key information. It should be explained that the quantum key corresponding to each client is also different, providing a one-time quantum cryptographic anti-capability for subsequent authentication.

[0042] The quantum key is generated by the quantum cryptography platform based on the client information, where the client information can be the client code, etc. A large number of quantum keys are prefabricated in a secure medium offline, and the secure medium is inserted into the zero-trust SDP client, so that a large number of quantum keys exist in the zero-trust SDP client. The secure medium can be one of the SIM card, super SIM card, TF card or USB device.

[0043] The client selects one quantum key from a large number of quantum keys in the secure medium to encrypt the identity authentication information and obtain ciphertext information; the quantum key becomes invalid and destroyed after use, and another quantum key is selected for the next encryption to achieve one-time one-key.

[0044] There is no limit to the way quantum keys can be used. One of the quantum keys can be randomly selected from multiple quantum keys for encryption. The quantum key will become invalid and destroyed after use. Alternatively, multiple quantum keys can be sorted in ascending / decremental order according to the key ID, and a quantum key can be selected in the order of arrangement to encrypt identity authentication information. The quantum key will become invalid and destroyed after use for encryption and will not be reused.

[0045] The zero-trust SDP client sends the SPA data packet carrying the key ID and ciphertext information to the zero-trust SDP controller for authentication.

[0046] Among them, zero-trust identity authentication methods include account password, AD, LDAP, SMS authentication, WebAuth, OAuth, biometric authentication (face scanning / fingerprint, etc.), code scanning authentication (WeChat / DingTalk, etc.), OTP, token, etc. According to business needs, the authentication strategy can use one or more MFA authentication factors, and the generated identity authentication information is one or more combinations of verification passwords, biometric data, hardware tokens, social account authentication information, mobile device authentication information or behavioral biometric data.

[0047] In addition, the zero-trust SDP client can also carry one-time code, random number, timestamp and other information in SPA, as well as private confidentiality algorithm; after being processed by the above authentication strategies and mechanisms, identity authentication information is generated.

[0048] Step S2: extract the key ID carried in the data packet, obtain the target quantum key corresponding to the key ID, decrypt the ciphertext information based on the target quantum key, and obtain the plaintext information.

[0049] The zero-trust SDP client initiates remote access to the zero-trust SDP controller and sends a data packet to the zero-trust SDP controller. When the zero-trust SDP controller receives a single data packet sent by the zero-trust SDP client, the zero-trust SDP controller parses the data packet, extracts the key ID and ciphertext information in the data packet, and decrypts it to obtain the plaintext information.

[0050] Among them, the decryption methods include:

[0051] First: The zero-trust SDP controller sends the first request carrying the key ID to the quantum key platform. The quantum key platform searches for the corresponding target quantum key based on the key ID and returns it to the zero-trust SDP controller. The zero-trust SDP controller decrypts the ciphertext information based on the target quantum key.

[0052] Second: The zero-trust SDP controller sends a second request carrying the key ID and ciphertext information to the quantum key platform. The quantum key platform searches for the target quantum key corresponding to the key ID, and uses the target quantum key to decrypt the ciphertext information. After the decryption is completed, the decrypted plaintext information is returned to the zero-trust SDP controller.

[0053] Step S3: Perform identity authentication on the plaintext information based on the preset authentication policy, and establish a connection with the zero-trust SDP client after passing the identity authentication.

[0054] Among them, during the identity authentication process of the plain text information, its authentication strategy corresponds to the authentication strategy adopted when the identity authentication information is generated in step S2. In step S2, the multi-dimensional identity authentication methods and technologies of the zero-trust SDP controller, as well as some security mechanisms, are described. The zero-trust SDP controller uses the corresponding technologies and mechanisms based on the authentication strategy to perform identity authentication. Identity authentication includes local authentication processing or authentication through docking with the identity authentication platform.

[0055] Assuming that the identity authentication process is successful, it means that the zero-trust SDP controller SPA single package authorization is successful. At this time, the response is replied to the zero-trust SDP client, and the security access process between the zero-trust SDP controller and the zero-trust SDP client continues.

[0056] The embodiment of the present invention pre-sets a quantum key in the security medium of the zero-trust SDP client. When the zero-trust SDP client and the zero-trust SDP controller are not connected, the quantum key is combined to enhance the security of SPA single-packet knocking, thereby improving the ability of zero-trust SDP to authenticate first and then connect, and hide the exposed surface.

[0057] Secondly, in the zero-trust SPA single-package identity authentication mechanism, the advantages of zero-trust multi-dimensional identity authentication (such as account password, AD, LDAP, SMS authentication, WebAuth, OAuth, face / fingerprint and other biometric authentication, WeChat / DingTalk and other code scanning authentication, OTP, token, etc.), flexible authentication strategies and existing security mechanisms are retained, combined with the physical true randomness of quantum keys, one-time pad and other confidentiality characteristics, to enhance the security of SPA identity authentication and have anti-quantum characteristics.

[0058] Another embodiment of the present invention provides a zero-trust SPA identity authentication system combined with quantum key, such as Figure 3 As shown, the system includes a quantum cryptography platform, a zero-trust SDP client, and a zero-trust SDP controller.

[0059] Among them, the quantum cryptography platform is used to generate multiple quantum keys; in addition to generating a large number of quantum keys, the quantum key platform can also decrypt ciphertext information through quantum keys in the quantum key platform.

[0060] The zero-trust SDP client is pre-installed with multiple quantum keys, which are used to encrypt identity authentication information using quantum keys, obtain data packets and send data packets to the zero-trust SDP controller.

[0061] The zero-trust SDP controller is connected to the quantum cryptography platform and the zero-trust SDP client signal to execute the zero-trust SPA identity authentication method combined with quantum keys as described above.

[0062] It should be noted that the functions of each module in the system of the embodiment of the present invention can refer to the corresponding description in the above method, which will not be repeated here.

[0063] Another embodiment of the present invention provides an electronic device, Figure 4 FIG. 2 shows a structural block diagram of an electronic device according to an embodiment of the present invention. Figure 4 As shown, the electronic device includes: a memory 100 and a processor 200, wherein the memory 100 stores a computer program that can be run on the processor 200. When the processor 200 executes the computer program, the zero-trust SPA identity authentication method combined with a quantum key in the above embodiment is implemented. The number of the memory 100 and the processor 200 can be one or more.

[0064] The electronic device also includes:

[0065] The communication interface 300 is used to communicate with external devices and perform data exchange transmission.

[0066] If the memory 100, the processor 200 and the communication interface 300 are implemented independently, the memory 100, the processor 200 and the communication interface 300 can be connected to each other through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0067] Optionally, in a specific implementation, if the memory 100, the processor 200 and the communication interface 300 are integrated on a chip, the memory 100, the processor 200 and the communication interface 300 can communicate with each other through an internal interface.

[0068] An embodiment of the present invention provides a computer-readable storage medium storing a computer program, which implements the method provided in the embodiment of the present invention when executed by a processor.

[0069] An embodiment of the present invention further provides a chip, which includes a processor for calling and executing instructions stored in the memory from the memory, so that a communication device equipped with the chip executes the method provided by the embodiment of the present invention.

[0070] An embodiment of the present invention also provides a chip, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the method provided by the embodiment of the invention.

[0071] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor supporting the advanced RISC machines (ARM) architecture.

[0072] Further, optionally, the above-mentioned memory may include a read-only memory and a random access memory, and may also include a non-volatile random access memory. The memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may include a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may include a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available. For example, static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct rambus RAM (DR RAM).

[0073] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.

[0074] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0075] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0076] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of various changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A zero-trust SPA identity authentication method combined with quantum key, characterized in that: include: Receiving a single data packet sent by a client, wherein the client pre-stores a plurality of quantum keys, and the data packet includes ciphertext information obtained by encrypting identity authentication information based on the quantum keys; Extracting the key ID carried in the data packet, obtaining the target quantum key corresponding to the key ID, and decrypting the ciphertext information based on the target quantum key to obtain plaintext information; The plain text information is authenticated based on a preset authentication strategy, and a connection is established with the client if the identity authentication is passed.

2. The zero-trust SPA identity authentication method combined with quantum key according to claim 1 is characterized in that: The client pre-stores a plurality of quantum keys including: The multiple quantum keys are prefabricated in a secure medium in an offline manner, and the secure medium is pre-installed in the client; wherein the multiple quantum keys are generated by a quantum cryptography platform according to the client information of the client.

3. The zero-trust SPA identity authentication method combined with quantum key according to claim 2 is characterized in that: The secure medium is one of a SIM card, a super SIM card, a TF card or a USB device.

4. The zero-trust SPA identity authentication method combined with quantum key according to claim 3 is characterized in that: The ciphertext information is obtained by the client selecting one of the quantum keys from the security medium according to a preset usage policy to encrypt the identity authentication information, wherein the used quantum key becomes invalid and is destroyed.

5. The zero-trust SPA identity authentication method combined with quantum key according to claim 4 is characterized in that: The usage strategies include: Randomly select one of the multiple quantum keys for encryption; or, The multiple quantum keys are sorted in ascending order according to the key ID, and one quantum key is selected in sequence to encrypt the identity authentication information.

6. The zero-trust SPA identity authentication method combined with quantum key according to claim 1 is characterized in that: The identity authentication information is one or more combinations of a verification password, biometric data, a hardware token, social account authentication information, mobile device authentication information, or behavioral biometric data.

7. The zero-trust SPA identity authentication method combined with quantum key according to claim 1 is characterized in that: Also includes: The key ID and the ciphertext information carried in the data packet are extracted, and the key ID and the ciphertext information are transmitted to the quantum cryptography platform for decryption to obtain the plaintext information.

8. A zero-trust SPA identity authentication system combined with quantum key, characterized in that: include: Quantum cryptography platform for generating multiple quantum keys; A zero-trust SDP client is pre-installed with the multiple quantum keys, and is used to encrypt the identity authentication information using the quantum keys, obtain a data packet, and send the data packet to the zero-trust SDP controller; A zero-trust SDP controller is connected to the quantum cryptography platform and the zero-trust SDP client, and is used to execute the zero-trust SPA identity authentication method combined with quantum keys as described in any one of claims 1 to 7.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores instructions, and the instructions are loaded and executed by the processor to implement the zero-trust SPA identity authentication method combined with quantum key as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the zero-trust SPA identity authentication method combined with quantum key as described in any one of claims 1 to 7 is implemented.

Images