IPSEC VPN (Internet Protocol Security Virtual Private Network) remote access method and system supporting post-quantum algorithm and computer equipment

Abstract

The invention discloses an IPSEC (Internet Protocol Security) VPN (Virtual Private Network) remote access method and system supporting a post-quantum algorithm and computer equipment, the method comprises the following steps: establishing a first secure channel and a second secure channel with a VPN server, the first secure channel outputting a first session key by using the post-quantum algorithm, the second secure channel outputting a second session key by using a classical algorithm, and the second session key outputting a second session key by using a classical algorithm; information transmission in the second secure channel establishment process is encrypted through the first session key; encrypting the original data by using the second session key, and sending the encrypted data to the VPN server; and decrypting the encrypted data by the VPN server by using the negotiated second session key, and sending the decrypted data to the target server. Compared with the prior art, the method has the advantages that the data is protected from being read or tampered by an unauthorized third party, so that the quantum computer attack can be protected, and the security of the key exchange process is ensured.

Description

Technical Field

[0001] The present invention relates to the field of quantum encryption communication technology, in particular to an IPSEC VPN remote access method, system and computer equipment supporting a post-quantum algorithm. Background Art

[0002] VPN stands for Virtual Private Network, which is a communication method commonly used to connect private networks between medium and large enterprises or groups. For example, a company with offices in multiple locations can use VPN to connect different regions to the same intranet; or you can also access the company's intranet through VPN when working from home.

[0003] When a user wants to use VPN to exchange data with a target server in the internal network from an external network, the VPN client will establish an encrypted connection between the user and the VPN server. This connection is called a VPN tunnel. The tunnel encrypts the user's data packets using encryption protocols to ensure the security of the data during transmission. In the VPN tunnel, the user's data packets are encapsulated in new data packets and encrypted before being sent to the target server. Once the data reaches the VPN server, the VPN server decrypts the user's data packets and sends them to the target server. When returning the data, the VPN server encrypts the data packets again and transmits them to the user through the tunnel. In this way, the communication between the user and the target server can be protected on the public network, and third parties cannot eavesdrop or intercept the user's data.

[0004] Currently, communications between users and target servers are protected using classical algorithms, which will be difficult to resist attacks from quantum computers in the future. Summary of the invention

[0005] The purpose of the present invention is to provide an IPSEC VPN remote access method, system and computer device supporting post-quantum algorithms to solve the technical problems in the prior art, which can provide anti-quantum protection.

[0006] In a first aspect, the present invention provides an IPSEC VPN remote access method supporting a post-quantum algorithm, which is applied to a client so that the client remotely accesses a target server through a VPN server, the method comprising:

[0007] Establishing a first secure channel and a second secure channel with a VPN server, wherein the first secure channel outputs a first session key using a post-quantum algorithm, and the second secure channel outputs a second session key using a classical algorithm, and information transmission during the establishment of the second secure channel is encrypted by the first session key;

[0008] Encrypting the original data using the second session key, and sending the encrypted data to the VPN server;

[0009] The encrypted data is decrypted by the VPN server using the second session key and then sent to the target server.

[0010] As described above, in the IPSEC VPN remote access method supporting post-quantum algorithm, preferably, the client and the VPN server establish a first secure channel, including:

[0011] Sending the first random number, the validity period of establishing the first secure channel, the supported protocol version, and the supported post-quantum algorithm type to the VPN server;

[0012] Receiving a second random number, a first server-side post-quantum algorithm public key, a determined effective time for establishing the first secure channel, a selected protocol version, and a selected post-quantum algorithm sent by the VPN server;

[0013] Encapsulate the pre-master key and the ciphertext of the pre-master key using the first server post-quantum algorithm public key, retain the pre-master key, generate a master key using the first random number, the second random number and the pre-master key, derive a first session key based on the master key, and then send the ciphertext to the VPN server;

[0014] The information sent by both parties and the client identity information are signed using the built-in second client post-quantum algorithm private key to obtain the client signature, which is then sent to the VPN server.

[0015] Obtaining a server signature sent from the VPN server, wherein the server signature is obtained by signing the information sent between the client and the VPN server and the client identity information using the built-in second server post-quantum algorithm private key after the VPN server verifies the client signature;

[0016] The server signature is verified using the built-in second server post-quantum algorithm public key to confirm the identity of the VPN server.

[0017] As described above, in the IPSEC VPN remote access method supporting post-quantum algorithm, preferably, the client and the VPN server establish a second secure channel, including:

[0018] Sending the VPN server the validity period of establishing the second secure channel, the supported protocol version, and the supported classic algorithm types;

[0019] Receiving the determined effective time, the selected protocol version, and the selected classical algorithm for establishing the second secure channel sent by the VPN server;

[0020] Sending a built-in first client classic algorithm public key to the VPN server, and receiving a first server classic algorithm public key sent by the VPN server;

[0021] A second session key is calculated based on the first client classic algorithm private key and the first server classic algorithm public key, where the second session key is also generated by the VPN server;

[0022] The information sent by both parties and the second session key are signed using the built-in first client classic algorithm private key to obtain the client signature, and then sent to the VPN server;

[0023] Obtaining a server-side signature sent from the VPN server, where the VPN server signs the information sent by both parties and the second session key using the built-in first server-side classic algorithm private key;

[0024] The client and the VPN server mutually verify each other's signatures. After both signatures are successfully verified, the client uses the second session key to perform encrypted communication with the VPN server.

[0025] As described above, an IPSEC VPN remote access method supporting a post-quantum algorithm, wherein preferably, the post-quantum algorithm includes a post-quantum cryptographic encapsulation algorithm or a post-quantum cryptographic signature algorithm.

[0026] As described above, an IPSEC VPN remote access method supporting post-quantum algorithms, wherein preferably, the classical algorithms include SM1, SM2, SM3, SM4, SM7, SM9 or ZUC algorithms.

[0027] In a second aspect, the present invention provides an IPSEC VPN remote access system, comprising a client, a VPN server and a target server, wherein the client has an application program, a first VPN function module and a first network interface which are sequentially signal-connected, the VPN server has a second network interface, a second VPN function module and a forwarding module which are sequentially signal-connected, and the target server has a plurality of service modules, wherein:

[0028] The application sends original data to the first VPN function module, and the first VPN function module establishes a first secure channel and a second secure channel with the second VPN function module to negotiate and determine a second session key; the first VPN function module encrypts the original data using the negotiated second session key, and the encrypted data is sent by the first VPN module to the first network interface;

[0029] After the second network interface receives the encrypted data sent by the first network interface, the encrypted data is passed to the second VPN function module. The second VPN function module decrypts the encrypted data using the negotiated second session key and sends it to the forwarding module. The forwarding module forwards the decrypted data to the corresponding business module of the target server.

[0030] In the IPSEC VPN remote access system as described above, preferably, the first VPN function module and the second VPN function module establish a first secure channel, including:

[0031] The first VPN function module sends a first random number, a valid time for establishing the first secure channel, a supported protocol version, and a supported post-quantum algorithm type to the second VPN function module;

[0032] The second VPN function module selects a protocol version and an algorithm supported by itself from the protocol versions and algorithm types supported by the first VPN function module, and sends the selection result, the first server post-quantum algorithm public key, the second random number, and the determined effective time for establishing the first secure channel this time to the first VPN function module;

[0033] The first VPN function module uses the first server post-quantum algorithm public key to encapsulate the pre-master key and the ciphertext of the pre-master key, retains the pre-master key, generates a master key using the first random number, the second random number and the pre-master key, derives a first session key based on the master key, and then sends the ciphertext to the second VPN function module;

[0034] The second VPN function module receives the ciphertext sent by the first VPN function module, decrypts it using the first server post-quantum algorithm private key to obtain a pre-master key, and generates a first session key using the first random number, the second random number and the pre-master key;

[0035] The first VPN function module uses the built-in second client post-quantum algorithm private key to sign the information sent between the first VPN function module and the second VPN function module and the client identity information to obtain a client signature, and sends it to the second VPN function module;

[0036] The second VPN function module verifies the client signature using the built-in second client post-quantum algorithm public key, thereby confirming the identity of the first VPN function module;

[0037] The second VPN function module uses the built-in second server post-quantum algorithm private key to sign the information sent between the first VPN function module and the second VPN function module and the server identity information to obtain a server signature, and sends it to the first VPN function module;

[0038] The first VPN function module verifies the server signature using the built-in second server post-quantum algorithm public key, thereby confirming the identity of the second VPN function module.

[0039] In the IPSEC VPN remote access system as described above, preferably, the first VPN function module and the second VPN function module establish a second secure channel, including:

[0040] The first VPN function module sends the validity period, supported protocol version, and supported classic algorithm types of the second secure channel to the second VPN function module;

[0041] The second VPN function module selects a protocol version and a classic algorithm supported by itself from the protocol versions and classic algorithm types supported by the first VPN function module, and sends the selection result and the determined effective time of establishing the second secure channel this time to the first VPN function module;

[0042] The first VPN function module sends a built-in first client classic algorithm public key to the second VPN function module;

[0043] The second VPN function module sends the built-in first server classic algorithm public key to the first VPN function module;

[0044] The first VPN function module calculates a second session key based on the first client classic algorithm private key and the first server classic algorithm public key, and the second VPN function module calculates a second session key based on the first client classic algorithm public key and the first server classic algorithm private key;

[0045] The first VPN function module uses the built-in first client classic algorithm private key to sign the information sent between the first VPN function module and the second VPN function module and the second session key calculated by the first VPN function module and send them to the second VPN function module;

[0046] The second VPN function module uses the built-in first server classic algorithm private key to sign the information sent between the first VPN function module and the second VPN function module and the second session key calculated by the second VPN function module and send them to the first VPN function module;

[0047] The first VPN function module and the second VPN function module mutually verify each other's signatures. After both signatures are successfully verified, the first VPN function module uses the second session key to perform encrypted communication with the second VPN function module.

[0048] In a third aspect, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the aforementioned method.

[0049] In a fourth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions for executing the aforementioned method.

[0050] Compared with the prior art, the present invention establishes a first secure channel and a second secure channel between the client and the VPN server. The first secure channel outputs a first session key using a post-quantum algorithm, and the second secure channel outputs a second session key using a classical algorithm. Information transmission during the establishment of the second secure channel is encrypted by the first session key. In this process, data is encrypted by the post-quantum algorithm to protect the data from being read or tampered with by an unauthorized third party, thereby providing protection against quantum computer attacks and ensuring the security of the key exchange process. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a flow chart of the IPSEC VPN remote access method provided by an embodiment of the present invention;

[0052] Figure 2 It is a schematic diagram of the construction process of the first security channel and the second security channel provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, but should not be construed as limiting the present invention.

[0054] Reference Figure 1As shown, an embodiment of the present invention provides an IPSEC VPN remote access method supporting a post-quantum algorithm, which is applied to a client so that the client can remotely access a target server through a VPN server. In a feasible implementation, the client has an application program, a first VPN function module, and a first network interface that are sequentially connected by signals, the VPN server has a second network interface, a second VPN function module, and a forwarding module that are sequentially connected by signals, and the target server has multiple service modules. The method includes the following steps:

[0055] Step S101: Establish a first secure channel and a second secure channel with a VPN server. The first secure channel uses a post-quantum algorithm to output a first session key, and the second secure channel uses a classical algorithm to output a second session key. Information transmitted during the establishment of the second secure channel is encrypted using the first session key.

[0056] The first secure channel is built based on the post-quantum algorithm (PQC) and is used to provide identity authentication and data protection for the second secure channel. The first secure channel generates a first session key, which will be used to encrypt all data during the establishment of the second secure channel. The post-quantum cryptographic algorithm can provide protection against quantum computer attacks and ensure the security of the information exchange process.

[0057] The first security channel is valid for a long time, and multiple second security channel negotiations can be performed within its validity period. The advantage of such two-stage negotiation is that the identity authentication and key negotiation process of both parties can be divided into two parts, in which the complex work is completed by the first security channel with a long validity period, and the simple work is completed by the second security channel. In this way, even if the two parties need to communicate multiple times, they only need to complete the first security channel once, which can save time for both parties.

[0058] Specifically, the application sends original data to the first VPN function module, and a first secure channel and a second secure channel are established between the first VPN function module and the second VPN function module.

[0059] After the first secure channel is established, the first VPN function module and the second VPN function module will establish a second secure channel. This process includes using the first session key negotiated through the first secure channel to protect data exchange, ensuring that the security of data exchange can be guaranteed even in the era of quantum computing. While the first secure channel is established, the first VPN function module and the second VPN function module will also perform identity authentication to ensure that the identities of both parties in the communication are credible.

[0060] Step S102: Encrypt the original data using the negotiated second session key, and send the encrypted data to the VPN server.

[0061] Specifically, the first VPN function module uses the negotiated second session key to encrypt the original data, and the encrypted data is sent by the first VPN module to the first network interface. Once the second secure channel is established, the client and the VPN server will use the negotiated second session key to encrypt the original data.

[0062] The first network interface sends the encrypted data to the second network interface of the VPN server. After the second network interface receives the encrypted data sent by the first network interface, the encrypted data is transmitted to the second VPN function module.

[0063] Step S103: The encrypted data is decrypted by the VPN server using the negotiated second session key and then sent to the target server.

[0064] Specifically, after the second VPN function module in the VPN server receives the encrypted data sent from the second network interface, it uses the second session key previously determined through the key negotiation process to decrypt the data. This step ensures the security of the data during transmission and prevents unauthorized third parties from accessing or tampering with the data.

[0065] The decrypted data is sent to the forwarding module of the VPN server. The forwarding module is responsible for forwarding data from the VPN server to the target server on the internal network or the Internet. The forwarding module forwards the decrypted data to the corresponding business module of the target server. This business module is the part on the target server that is responsible for processing specific business logic, which receives and processes data from the VPN.

[0066] After receiving the data, the service module of the target server further processes the data according to the service requirements, such as storing, calculating or responding to the client's request. If the service module needs to return a response to the client, it will send the response data back to the forwarding module of the VPN server, and then the forwarding module will send the response data to the second VPN function module, which will encrypt the response data and send it back to the client via the second network interface. After receiving the encrypted response data, the first VPN function module of the client uses the corresponding decryption key to decrypt the data and display the decrypted data to the user or further process it.

[0067] Through the above process, a protection chain is realized in which the PQC algorithm protects the classic algorithm, and the classic algorithm protects data transmission. The PQC algorithm with slower operation speed and larger data volume is placed in the first stage, and the classic algorithm with faster operation speed and smaller data volume is placed in the second stage. The secure channel established in the first stage is effective for a long time and only needs to be executed once in a long period of time, so the PQC algorithm has less impact.

[0068] In a feasible implementation mode, referring to Figure 2As shown, the client and the VPN server establish a first secure channel, including the following steps:

[0069] Step S1011: Sending a first random number, the effective time for establishing the first secure channel this time, the supported protocol version, and the supported post-quantum algorithm type to the VPN server; receiving a second random number, the first server-side post-quantum algorithm public key, the determined effective time for establishing the first secure channel this time, the selected protocol version, and the selected post-quantum algorithm sent by the VPN server.

[0070] Specifically, the first random number is used in the subsequent key generation and verification process. Preferably, the first random number is a quantum random number, which is a random number generated based on the principle of quantum mechanics and is unpredictable and aperiodic to ensure security and reliability during the communication process.

[0071] The protocol version sent by the first VPN function module determines the specification and rule framework that the two parties follow in subsequent communications. The protocol version defines the rules and steps that must be followed during the communication process, including how to establish a connection, how to exchange information, and how to handle errors. The type of algorithm is related to subsequent security-related operations such as encryption and signature to establish the initial parameters of communication. The validity period specifies the duration of the secure channel. After the validity period, the secure channel will be invalidated. If the two parties need to continue to communicate, they need to re-establish the secure channel.

[0072] After receiving the information from the first VPN function module, the second VPN function module starts to screen from the protocol version and algorithm type set provided by the first VPN function module, and determines a suitable option based on the configuration of its own system, the pre-set security policy, and the support capabilities for various protocols and algorithms. After determining the selection, the second VPN function module will clearly inform the first VPN function module which protocol version and algorithm type are specifically selected, as well as the determined value of the validity period, so that the first VPN function module knows that subsequent communications will be carried out accordingly.

[0073] In addition, the second VPN function module will also generate and transmit a second random number to the first VPN function module. The second random number is similar to the first random number sent by the first VPN function module and is also used for subsequent operations such as generating the first session key. Preferably, the second random number is also a quantum random number. By providing random numbers by both parties, the randomness and confidentiality of key generation are further enhanced.

[0074] By exchanging random numbers and confirming the protocol version and algorithm, the first VPN function module and the second VPN function module confirm that they use the same communication rules and security measures, thereby establishing a secure communication channel.

[0075] In the embodiment provided by the present invention, the post-quantum algorithm includes a first server-side post-quantum algorithm and a second post-quantum algorithm. In a feasible implementation, the first server-side post-quantum algorithm is a post-quantum cryptographic encapsulation algorithm. The first post-quantum cryptographic encapsulation algorithm is exemplarily a Kyber algorithm. The Kyber algorithm is a lattice-based public key encryption scheme used for key encapsulation and other operations. The second VPN function module sends the Kyber public key to the first VPN function module for subsequent key encapsulation and decryption operations to build a secure communication key system for both parties. The second post-quantum algorithm is a post-quantum cryptographic signature algorithm. The second post-quantum cryptographic signature algorithm is exemplarily a Dilithium algorithm. The Dilithium algorithm is a lattice-based digital signature scheme used for identity authentication and other operations.

[0076] Step S1012: Use the first server-side post-quantum algorithm public key to encapsulate the pre-master key and the ciphertext of the pre-master key, retain the pre-master key, use the first random number, the second random number and the pre-master key to generate a master key, derive the first session key based on the master key, and then send the ciphertext to the VPN server.

[0077] The first VPN function module uses the Kyber public key sent by the second VPN function module to perform a key encapsulation operation. In this process, a pre-master key and the corresponding ciphertext form (i.e., Cipher) are generated through a specific key encapsulation algorithm combined with relevant parameters.

[0078] The pre-master key is usually a randomly generated random number, preferably a quantum random number, which is used for subsequent session encryption, and encrypting it into a Cipher is to ensure that it is not leaked during transmission to the second VPN function module to ensure its confidentiality. Subsequently, the first VPN function module will send the Cipher to the second VPN function module.

[0079] After receiving the Cipher, the second VPN function module uses its own Kyber private key to decrypt it. Since there is a specific mathematical correspondence between the Kyber public key and the private key, only the matching private key can correctly decrypt the ciphertext generated by the corresponding public key. Through this decryption process, the second VPN function module can successfully obtain the plaintext content of the pre-master key.

[0080] After the ciphertext is decrypted by the second VPN function module, the second VPN function module now has the necessary elements to generate the first session key, namely, the first random number, the second random number and the pre-master key. The second VPN function module uses the same algorithm to combine the first random number, the second random number and the pre-master key to generate the master key, and derives the first session key based on the master key.

[0081] Step S1013: Use the built-in second client post-quantum algorithm private key to sign the information sent by both parties and the client identity information to obtain the client signature, and send it to the VPN server.

[0082] Specifically, the client signature is obtained by the first VPN function module using the built-in Dilithium private key to sign the information sent by both parties and the client identity information. After receiving the client signature, the second VPN function module verifies the signature with the built-in Dilithium public key to determine the identity of the other party. Through the signature method based on the private key, the first VPN function module proves the legitimacy of its identity to the second VPN function module. Only the party with the corresponding Dilithium private key can generate the correct signature. The second VPN function module can be verified by the corresponding Dilithium public key. If the verification is successful, it means that the first VPN function module currently communicating with it is legal and has the corresponding private key, thereby confirming the identity of the first VPN function module and laying the foundation for subsequent secure and reliable communication; if the verification fails, it may mean that there is a security risk, such as encountering a man-in-the-middle attack, and the communication will be interrupted.

[0083] Step S1014: Obtain the server signature sent from the VPN server. The server signature is obtained by the VPN server using the built-in second server post-quantum algorithm private key to sign the information sent by both parties and the client identity information after verifying the client signature; the client uses the built-in second server post-quantum algorithm public key to verify the server signature, thereby confirming the identity of the other party.

[0084] Specifically, the server signature is obtained by the second VPN function module using the built-in Dilithium private key to sign the information sent by both parties and the server identity information. After the first VPN function module receives the client signature, it verifies the signature with the built-in Dilithium public key to determine the identity of the other party. Through the private key-based signature method, the second VPN function module proves the legitimacy of its identity to the first VPN function module. Only the party with the corresponding Dilithium private key can generate a correct signature. The first VPN function module can be verified through the corresponding Dilithium public key. If the verification is successful, it means that the second VPN function module currently communicating with it is legal and has the corresponding private key, thereby confirming the identity of the second VPN function module and laying the foundation for subsequent secure and reliable communication; if the verification fails, it may mean that there is a security risk, such as encountering a man-in-the-middle attack, and the communication will be interrupted.

[0085] After the key verification step, the first VPN function module and the second VPN function module have determined a consistent, secure and reliable first session key. On this basis, the first VPN function module and the second VPN function module can use this first session key to establish a second secure channel.

[0086] In a feasible implementation mode, referring to Figure 2 As shown, the client and the VPN server establish a second secure channel, including the following steps:

[0087] Step S1015: Sending the effective time, supported protocol version, and supported classic algorithm types for establishing the second secure channel to the VPN server; receiving the determined effective time, selected protocol version, and selected classic algorithm for establishing the second secure channel sent by the VPN server.

[0088] The protocol version sent by the first VPN function module determines the specification and rule framework that the two parties follow in subsequent communications. The protocol version defines the rules and steps that must be followed during the communication process, including how to establish a connection, how to exchange information, and how to handle errors. The type of algorithm is related to subsequent security-related operations such as encryption and signature to establish the initial parameters of communication. The validity period specifies the duration of the secure channel. After the validity period, the secure channel will be invalidated. If the two parties need to continue to communicate, they need to re-establish the secure channel.

[0089] After receiving the information from the first VPN function module, the second VPN function module starts to screen from the protocol version and algorithm type set provided by the first VPN function module, and determines a suitable option based on the configuration of its own system, the pre-set security policy, and the support capabilities for various protocols and algorithms. After determining the selection, the second VPN function module will clearly inform the first VPN function module which protocol version and algorithm type are specifically selected, as well as the determined value of the validity period, so that the first VPN function module knows that subsequent communications will be carried out accordingly.

[0090] By confirming the protocol version and algorithm, the first VPN function module and the second VPN function module confirm that they use the same communication rules and security measures, thereby establishing a secure communication channel.

[0091] Classical algorithms include SM1, SM2, SM3, SM4, SM7, SM9 or ZUC algorithms. In the embodiment provided by the present invention, the classic algorithm is SM2 algorithm.

[0092] Step S1016: Send the built-in first client classic algorithm public key to the VPN server, and receive the first server classic algorithm public key sent by the VPN server; calculate the second session key based on the first client classic algorithm public key and the first server classic algorithm public key, and the second session key is also generated by the VPN server.

[0093] Specifically, the first VPN function module sends the built-in first client classic algorithm public key (such as SM2 public key) to the second VPN function module; the second VPN function module also sends the built-in first server classic algorithm public key (such as SM2 public key) to the first VPN function module.

[0094] The first VPN function module calculates a second session key based on the first client classic algorithm private key and the first server classic algorithm public key, and the second VPN function module calculates a second session key based on the first client classic algorithm public key and the first server classic algorithm private key.

[0095] Step S1017: Use the built-in first client classic algorithm private key to sign the information sent by both parties and the second session key to obtain a client signature, and send it to the VPN server; obtain the server signature sent from the VPN server, and the server signature is obtained by the VPN server using the built-in first server classic algorithm private key to sign the information sent by both parties and the second session key.

[0096] Specifically, the first VPN function module uses the built-in first client classic algorithm private key (such as SM2 private key) to sign the information sent by both parties and the second session key to obtain a client signature, and sends it to the second VPN function module.

[0097] The second VPN function module uses the built-in second client classic algorithm private key (such as SM2 private key) to sign the information sent by both parties and the second session key to obtain the client signature, and sends it to the first VPN function module.

[0098] Step S1018: The client and the VPN server verify each other's signatures. After the signatures are successfully verified, the client uses the second session key to perform encrypted communication with the VPN server.

[0099] In a second aspect, the present invention provides an IPSEC VPN remote access system, including a client, a VPN server and a target server, wherein the client has an application program, a first VPN function module and a first network interface which are sequentially connected by signals, the VPN server has a second network interface, a second VPN function module and a forwarding module which are sequentially connected by signals, and the target server has a plurality of service modules, wherein:

[0100] The application sends original data to the first VPN function module, and the first VPN function module establishes a first secure channel and a second secure channel with the second VPN function module to negotiate and determine a second session key; the first VPN function module encrypts the original data using the negotiated second session key, and the encrypted data is sent by the first VPN module to the first network interface.

[0101] After the second network interface receives the encrypted data sent by the first network interface, the encrypted data is passed to the second VPN function module. The second VPN function module decrypts the encrypted data using the negotiated second session key and sends it to the forwarding module. The forwarding module forwards the decrypted data to the corresponding service module of the target server.

[0102] In the embodiment provided by the present invention, the first VPN function module and the second VPN function module establish a first secure channel, including:

[0103] The first VPN function module sends the first random number, the validity period of establishing the first secure channel, the supported protocol version, and the supported post-quantum algorithm type to the second VPN function module.

[0104] The second VPN function module selects the protocol version and algorithm it supports from the protocol versions and algorithm types supported by the first VPN function module, and sends the selection result, the first server post-quantum algorithm public key, the second random number and the determined effective time for establishing the first secure channel to the first VPN function module.

[0105] The first VPN functional module uses the first server post-quantum algorithm public key to encapsulate the pre-master key and the ciphertext of the pre-master key, retains the pre-master key, uses the first random number, the second random number and the pre-master key to generate a master key, derives the first session key based on the master key, and then sends the ciphertext to the second VPN functional module.

[0106] The second VPN function module receives the ciphertext sent by the first VPN function module, decrypts it using the first server post-quantum algorithm private key to obtain the pre-master key, and generates the first session key using the first random number, the second random number and the pre-master key.

[0107] The first VPN function module uses the built-in second client post-quantum algorithm private key to sign the information sent by both parties and the client identity information to obtain the client signature, and sends it to the second VPN function module.

[0108] The second VPN function module uses the built-in second client post-quantum algorithm public key to verify the client signature, thereby confirming the identity of the other party.

[0109] The second VPN function module uses the built-in second server post-quantum algorithm private key to sign the information sent by both parties and the server identity information to obtain a server signature, and sends it to the first VPN function module.

[0110] The first VPN function module uses the built-in second server post-quantum algorithm public key to verify the server signature, thereby confirming the identity of the other party.

[0111] In the embodiment provided by the present invention, the first VPN function module and the second VPN function module establish a second secure channel, including:

[0112] The first VPN function module sends the validity period, supported protocol versions, and supported classic algorithm types for establishing the second secure channel to the second VPN function module.

[0113] The second VPN function module selects the protocol version and the classic algorithm supported by itself from the protocol versions and the classic algorithm types supported by the first VPN function module, and sends the selection result and the determined effective time of establishing the second secure channel this time to the first VPN function module.

[0114] The first VPN function module sends the built-in first client classic algorithm public key to the second VPN function module; the second VPN function module sends the built-in first server classic algorithm public key to the first VPN function module.

[0115] The first VPN function module calculates a second session key based on the first client classic algorithm private key and the first server classic algorithm public key, and the second VPN function module calculates a second session key based on the first client classic algorithm public key and the first server classic algorithm private key.

[0116] The first VPN function module uses the built-in first client classic algorithm private key to sign the information sent by both parties and the second session key calculated by the first VPN function module and sends them to the second VPN function module.

[0117] The second VPN function module uses the built-in first server classic algorithm private key to sign the information sent by both parties and the second session key calculated by the second VPN function module and sends them to the first VPN function module.

[0118] The first VPN function module and the second VPN function module mutually verify each other's signatures. After both signatures are successfully verified, the first VPN function module uses the second session key to perform encrypted communication with the second VPN function module.

[0119] In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to implement the steps in any one of the above method embodiments.

[0120] Specifically, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0121] Specifically, in this embodiment, the processor may be configured to implement the following steps through a computer program:

[0122] Step S101: Establish a first secure channel and a second secure channel with a VPN server. The first secure channel uses a post-quantum algorithm to output a first session key, and the second secure channel uses a classical algorithm to output a second session key. Information transmitted during the establishment of the second secure channel is encrypted using the first session key.

[0123] Step S102: Encrypt the original data using the negotiated second session key, and send the encrypted data to the VPN server.

[0124] Step S103: The encrypted data is decrypted by the VPN server using the negotiated second session key and then sent to the target server.

[0125] In a fourth aspect, an embodiment of the present invention further provides a storage medium, in which a computer program is stored, wherein the computer program is configured to implement the steps of any of the above method embodiments when run.

[0126] Specifically, in this embodiment, the above storage medium may be configured to store a computer program for implementing the following steps:

[0127] Step S101: Establish a first secure channel and a second secure channel with a VPN server. The first secure channel uses a post-quantum algorithm to output a first session key, and the second secure channel uses a classical algorithm to output a second session key. Information transmitted during the establishment of the second secure channel is encrypted using the first session key.

[0128] Step S102: Encrypt the original data using the negotiated second session key, and send the encrypted data to the VPN server.

[0129] Step S103: The encrypted data is decrypted by the VPN server using the negotiated second session key and then sent to the target server.

[0130] The above describes in detail the structure, features and effects of the present invention based on the embodiments shown in the drawings. The above is only a preferred embodiment of the present invention, but the present invention is not limited to the scope of implementation shown in the drawings. Any changes made according to the concept of the present invention, or modifications to equivalent embodiments with equivalent changes, which still do not exceed the spirit covered by the description and drawings, should be within the protection scope of the present invention.

Claims

1. A method for remote access to IPSEC VPN supporting post-quantum algorithms, characterized in that: Applied to a client so that the client remotely accesses a target server through a VPN server, the method comprises: Establishing a first secure channel and a second secure channel with a VPN server, wherein the first secure channel outputs a first session key using a post-quantum algorithm, and the second secure channel outputs a second session key using a classical algorithm, and information transmission during the establishment of the second secure channel is encrypted by the first session key; Encrypting the original data using the second session key, and sending the encrypted data to the VPN server; The encrypted data is decrypted by the VPN server using the second session key and then sent to the target server.

2. The method according to claim 1, characterized in that: The client and the VPN server establish a first secure channel, including: Sending the first random number, the validity period of establishing the first secure channel, the supported protocol version, and the supported post-quantum algorithm type to the VPN server; Receiving a second random number, a first server-side post-quantum algorithm public key, a determined effective time for establishing the first secure channel, a selected protocol version, and a selected post-quantum algorithm sent by the VPN server; Encapsulate the pre-master key and the ciphertext of the pre-master key using the first server post-quantum algorithm public key, retain the pre-master key, generate a master key using the first random number, the second random number and the pre-master key, derive a first session key based on the master key, and then send the ciphertext to the VPN server; The information sent by both parties and the client identity information are signed using the built-in second client post-quantum algorithm private key to obtain the client signature, which is then sent to the VPN server. Obtaining a server signature sent from the VPN server, wherein the server signature is obtained by signing the information sent between the client and the VPN server and the client identity information using the built-in second server post-quantum algorithm private key after the VPN server verifies the client signature; The server signature is verified using the built-in second server post-quantum algorithm public key, thereby verifying the identity of the VPN server.

3. The method according to claim 2, characterized in that: The client and the VPN server establish a second secure channel, including: Sending the VPN server the validity period of establishing the second secure channel, the supported protocol version, and the supported classic algorithm types; Receiving the determined effective time, the selected protocol version, and the selected classical algorithm for establishing the second secure channel sent by the VPN server; Sending a built-in first client classic algorithm public key to the VPN server, and receiving a first server classic algorithm public key sent by the VPN server; A second session key is calculated based on the first client classic algorithm private key and the first server classic algorithm public key, where the second session key is also generated by the VPN server; The information sent by both parties and the second session key are signed using the built-in first client classic algorithm private key to obtain the client signature, and then sent to the VPN server; Obtaining a server-side signature sent from the VPN server, where the VPN server signs the information sent by both parties and the second session key using the built-in first server-side classic algorithm private key; The client and the VPN server mutually verify each other's signatures. After both signatures are successfully verified, the client uses the second session key to perform encrypted communication with the VPN server.

4. The method according to claim 1, characterized in that: The post-quantum algorithm includes a post-quantum cryptographic encapsulation algorithm or a post-quantum cryptographic signature algorithm.

5. The method according to claim 1, characterized in that: The classical algorithms include SM1, SM2, SM3, SM4, SM7, SM9 or ZUC algorithms.

6. An IPSEC VPN remote access system, characterized in that: The invention comprises a client, a VPN server and a target server, wherein the client has an application program, a first VPN function module and a first network interface which are sequentially connected by signals, the VPN server has a second network interface, a second VPN function module and a forwarding module which are sequentially connected by signals, and the target server has a plurality of service modules, wherein: The application sends original data to the first VPN function module, and the first VPN function module establishes a first secure channel and a second secure channel with the second VPN function module to negotiate and determine a second session key; the first VPN function module encrypts the original data using the negotiated second session key, and the encrypted data is sent by the first VPN module to the first network interface; After the second network interface receives the encrypted data sent by the first network interface, the encrypted data is passed to the second VPN function module. The second VPN function module decrypts the encrypted data using the negotiated second session key and sends it to the forwarding module. The forwarding module forwards the decrypted data to the corresponding business module of the target server.

7. The IPSEC VPN remote access system according to claim 6, characterized in that: The first VPN function module and the second VPN function module establish a first secure channel, including: The first VPN function module sends a first random number, a valid time for establishing the first secure channel, a supported protocol version, and a supported post-quantum algorithm type to the second VPN function module; The second VPN function module selects a protocol version and an algorithm supported by itself from the protocol versions and algorithm types supported by the first VPN function module, and sends the selection result, the first server post-quantum algorithm public key, the second random number, and the determined effective time for establishing the first secure channel this time to the first VPN function module; The first VPN function module uses the first server post-quantum algorithm public key to encapsulate the pre-master key and the ciphertext of the pre-master key, retains the pre-master key, generates a master key using the first random number, the second random number and the pre-master key, derives a first session key based on the master key, and then sends the ciphertext to the second VPN function module; The second VPN function module receives the ciphertext sent by the first VPN function module, decrypts it using the first server post-quantum algorithm private key to obtain a pre-master key, and generates a first session key using the first random number, the second random number and the pre-master key; The first VPN function module uses the built-in second client post-quantum algorithm private key to sign the information sent between the first VPN function module and the second VPN function module and the client identity information to obtain a client signature, and sends it to the second VPN function module; The second VPN function module verifies the client signature using the built-in second client post-quantum algorithm public key, thereby confirming the identity of the first VPN function module; The second VPN function module uses the built-in second server post-quantum algorithm private key to sign the information sent between the first VPN function module and the second VPN function module and the server identity information to obtain a server signature, and sends it to the first VPN function module; The first VPN function module verifies the server signature using the built-in second server post-quantum algorithm public key, thereby confirming the identity of the second VPN function module.

8. The IPSEC VPN remote access system according to claim 6, characterized in that: The first VPN function module and the second VPN function module establish a second secure channel, including: The first VPN function module sends the validity period, supported protocol version, and supported classic algorithm types of the second secure channel to the second VPN function module; The second VPN function module selects a protocol version and a classic algorithm supported by itself from the protocol versions and classic algorithm types supported by the first VPN function module, and sends the selection result and the determined effective time of establishing the second secure channel this time to the first VPN function module; The first VPN function module sends a built-in first client classic algorithm public key to the second VPN function module; The second VPN function module sends the built-in first server classic algorithm public key to the first VPN function module; The first VPN function module calculates a second session key based on the first client classic algorithm private key and the first server classic algorithm public key, and the second VPN function module calculates a second session key based on the first client classic algorithm public key and the first server classic algorithm private key; The first VPN function module uses the built-in first client classic algorithm private key to sign the information sent between the first VPN function module and the second VPN function module and the second session key calculated by the first VPN function module and send them to the second VPN function module; The second VPN function module uses the built-in first server classic algorithm private key to sign the information sent between the first VPN function module and the second VPN function module and the second session key calculated by the second VPN function module and send them to the first VPN function module; The first VPN function module and the second VPN function module mutually verify each other's signatures. After both signatures are successfully verified, the first VPN function module uses the second session key to perform encrypted communication with the second VPN function module.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores the method for executing any one of claims 1 to 6.

Images