IPsec vpn remote access method, system and computer device supporting post-quantum algorithm

Abstract

The application discloses an IPSEC VPN remote access method and system supporting a post-quantum algorithm and a computer device, and relates to the technical field of VPN remote access methods. The method comprises the following steps: a first security channel and a second security channel are established with a VPN server, the first security channel uses a post-quantum algorithm to output a first session key, the second security channel uses a classical algorithm to output a second session key, and information transmission in the second security channel establishment process is all encrypted by the first session key; the second session key is used to encrypt original data, and the encrypted data is sent to the VPN server; and the encrypted data is decrypted by the VPN server using the negotiated second session key and then sent to a target server. Compared with the prior art, the application protects data from being read or tampered with by unauthorized third parties, thereby providing protection against quantum computer attacks and ensuring the security of the key exchange process.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of quantum encryption communication, and in particular to an IPSEC VPN remote access method and system supporting post-quantum algorithms and a computer device. BACKGROUND

[0002] VPN stands for Virtual Private Network, which is commonly used for communication between private networks of large enterprises or groups. For example, a company with offices in different locations can use VPN to connect them to the same internal network. Or when working from home, you can also access the company's internal network through VPN.

[0003] When a user wants to use VPN to interact with the target server of the internal network on the external network, the VPN client will establish an encrypted connection between the user and the VPN server, which is called a VPN tunnel. This tunnel uses encryption protocols to encrypt the user's data packets, ensuring the security of the data during transmission. In the VPN tunnel, the user's data packets are encapsulated in new data packets and encrypted before being sent to the target server. Once the data reaches the VPN server, the VPN server will decrypt the user's data packets and send them to the target server. When returning the data, the VPN server will encrypt the data packets and transmit them to the user through the tunnel. In this way, the communication between the user and the target server can be protected on the public network, and third parties cannot eavesdrop or intercept the user's data.

[0004] Currently, the communication between the user and the target server is protected using classical algorithms, which are difficult to resist quantum computer attacks in the future. SUMMARY

[0005] The present application provides an IPSEC VPN remote access method, system and computer device supporting post-quantum algorithms to solve the technical problems in the prior art, which can provide quantum resistance.

[0006] In a first aspect, the present application provides an IPSEC VPN remote access method supporting post-quantum algorithms, applied to a client to enable the client to remotely access a target server through a VPN server, the method comprising:

[0007] establishing a first security channel and a second security channel with the VPN server, the first security channel using a post-quantum algorithm to output a first session key, the second security channel using a classical algorithm to output a second session key, and the information transmission during the establishment of the second security channel being encrypted by the first session key;

[0008] Encrypt the original data using the second session key and send the encrypted data to the VPN server;

[0009] The encrypted data is decrypted by the VPN server using the second session key and then sent to the target server.

[0010] The IPSEC VPN remote access method supporting post-quantum algorithms as described above, wherein preferably, the client and the VPN server establish a first secure channel, comprising:

[0011] Send the first random number, the effective time of this establishment of the first secure channel, the supported protocol version, and the supported post-quantum algorithm type to the VPN server;

[0012] Receive the second random number, the first server post-quantum algorithm public key, the determined effective time of this establishment of the first secure channel, the selected protocol version, and the selected post-quantum algorithm sent by the VPN server;

[0013] Use the first server post-quantum algorithm public key to encapsulate the pre-master key and the ciphertext of the pre-master key, retain the pre-master key, generate the master key using the first random number, the second random number, and the pre-master key, and derive the first session key according to the master key, and then send the ciphertext to the VPN server;

[0014] Use the built-in second client post-quantum algorithm private key to sign the information sent by both parties and the client identity information to obtain the client signature, and send it to the VPN server;

[0015] Obtain the server signature sent from the VPN server, which is obtained by the server using the built-in second server post-quantum algorithm private key to sign the information sent between the client and the VPN server and the client identity information after the VPN server verifies the client signature;

[0016] Verify the server signature using the built-in second server post-quantum algorithm public key to confirm the identity of the VPN server.

[0017] The IPSEC VPN remote access method supporting post-quantum algorithms as described above, wherein preferably, the client and the VPN server establish a second secure channel, comprising:

[0018] Send the effective time of this establishment of the second secure channel, the supported protocol version, and the supported classical algorithm type to the VPN server;

[0019] receive the determination effective time of the second security channel establishment, the selected protocol version and the selected classic algorithm sent by the VPN server;

[0020] send the first client classic algorithm public key to the VPN server, and receive the first server classic algorithm public key sent by the VPN server;

[0021] calculate the second session key based on the first client classic algorithm private key and the first server classic algorithm public key, wherein the second session key is also generated by the VPN server;

[0022] use the first client classic algorithm private key to sign the information sent by both parties and the second session key to obtain the client signature, and send the client signature to the VPN server;

[0023] obtain the server signature sent by the VPN server, wherein the server signature is obtained by the VPN server using the first server classic algorithm private key to sign the information sent by both parties and the second session key;

[0024] the client and the VPN server verify each other's signature, and after the signature is verified successfully, the client uses the second session key to perform encrypted communication with the VPN server.

[0025] The IPSEC VPN remote access method supporting the post-quantum algorithm, wherein preferably, the post-quantum algorithm comprises a post-quantum cryptographic encapsulation algorithm or a post-quantum cryptographic signature algorithm.

[0026] The IPSEC VPN remote access method supporting the post-quantum algorithm, wherein preferably, the classic algorithm comprises an SM1, SM2, SM3, SM4, SM7, SM9 or ZUC algorithm.

[0027] In a second aspect, the application provides an IPSEC VPN remote access system, comprising a client, a VPN server and a target server, wherein the client has an application program, a first VPN function module and a first network interface connected in sequence, the VPN server has a second network interface, a second VPN function module and a forwarding module connected in sequence, and the target server has a plurality of service modules.

[0028] The application program sends original data to the first VPN function module, the first VPN function module and the second VPN function module establish a first security channel and a second security channel to negotiate a second session key, the first VPN function module encrypts the original data using the negotiated second session key, and the encrypted data is sent by the first VPN function module to the first network interface;

[0029] After the second network interface receives the encrypted data sent by the first network interface, the encrypted data is transmitted to the second VPN function module, the second VPN function module decrypts the encrypted data using the negotiated second session key and sends it to the forwarding module, and the forwarding module forwards the decrypted data to the corresponding service module of the target server.

[0030] The IPSEC VPN remote access system as described above, preferably, the first VPN function module and the second VPN function module establish a first security channel, comprising:

[0031] The first VPN function module sends a first random number, a valid time for establishing the first security channel this time, a supported protocol version and a supported post-quantum algorithm type to the second VPN function module;

[0032] The second VPN function module selects a protocol version and an algorithm supported by itself from the protocol version and the algorithm supported by the first VPN function module, and sends the selection result, a first server post-quantum algorithm public key, a second random number and a determined valid time for establishing the first security channel this time to the first VPN function module;

[0033] The first VPN function module uses the first server post-quantum algorithm public key to encapsulate a pre-master key and a ciphertext of the pre-master key, retains the pre-master key, generates a master key using the first random number, the second random number and the pre-master key, and derives a first session key according to the master key, and then sends the ciphertext to the second VPN function module;

[0034] The second VPN function module receives the ciphertext sent by the first VPN function module, and decrypts the ciphertext using a first server post-quantum algorithm private key to obtain a pre-master key, and generates a first session key using the first random number, the second random number and the pre-master key;

[0035] The first VPN function module uses a built-in second client post-quantum algorithm private key to sign information transmitted between the first VPN function module and the second VPN function module and client identity information to obtain a client signature, and sends the client signature to the second VPN function module;

[0036] The second VPN function module verifies the client signature by using the built-in second client post-quantum algorithm public key, thereby confirming the identity of the first VPN function module;

[0037] The second VPN function module signs the information transmitted between the first VPN function module and the second VPN function module and the server identity information by using the built-in second server post-quantum algorithm private key to obtain a server signature, and sends the server signature to the first VPN function module;

[0038] The first VPN function module verifies the server signature by using the built-in second server post-quantum algorithm public key, thereby confirming the identity of the second VPN function module.

[0039] The IPSEC VPN remote access system as described above, preferably, the first VPN function module and the second VPN function module establish a second secure channel, comprising:

[0040] The first VPN function module sends the effective time of establishing the second secure channel, the supported protocol version, and the supported classical algorithm type to the second VPN function module;

[0041] The second VPN function module selects the supported protocol version and the classical algorithm supported by itself from the supported protocol version and the classical algorithm supported by the first VPN function module, and sends the selection result and the determined effective time of establishing the second secure channel to the first VPN function module;

[0042] The first VPN function module sends the built-in first client classical algorithm public key to the second VPN function module;

[0043] The second VPN function module sends the built-in first server classical algorithm public key to the first VPN function module;

[0044] The first VPN function module calculates a second session key based on the first client classical algorithm private key and the first server classical algorithm public key, and the second VPN function module calculates a second session key based on the first client classical algorithm public key and the first server classical algorithm private key;

[0045] The first VPN function module signs the information transmitted between the first VPN function module and the second VPN function module and the second session key calculated by the first VPN function module by using the built-in first client classical algorithm private key, and sends the signed information to the second VPN function module;

[0046] The second VPN function module uses a built-in first server classic algorithm private key to sign information transmitted between the first VPN function module and the second VPN function module and a second session key calculated by the second VPN function module and sends the signed information to the first VPN function module.

[0047] The first VPN function module and the second VPN function module verify each other's signatures, and after the signatures are verified successfully, the first VPN function module uses the second session key to perform encrypted communication with the second VPN function module.

[0048] In a third aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the method described above.

[0049] In a fourth aspect, the present application provides a computer readable storage medium, which stores a computer program for executing the method described above.

[0050] Compared with the prior art, the present application establishes a first security channel and a second security channel between the client and the VPN server, the first security channel uses a post-quantum algorithm to output a first session key, the second security channel uses a classic algorithm to output a second session key, and information transmission in the process of establishing the second security channel is encrypted by the first session key. In this process, data is encrypted by the post-quantum algorithm, protecting the data from being read or tampered with by unauthorized third parties, thereby providing protection against quantum computer attacks and ensuring the security of the key exchange process. BRIEF DESCRIPTION OF DRAWINGS

[0051] Figure 1 is a flowchart of an IPSEC VPN remote access method provided by an embodiment of the present application;

[0052] Figure 2 is a construction flowchart of the first security channel and the second security channel provided by an embodiment of the present application. DETAILED DESCRIPTION

[0053] The embodiments described below with reference to the drawings are exemplary and are only used to explain the present application and cannot be interpreted as a limitation of the present application.

[0054] Reference Figure 1As shown, the embodiment of the present application provides an IPSEC VPN remote access method supporting post-quantum algorithm, which is applied to a client to enable the client to remotely access a target server through a VPN server. In a feasible implementation, the client has an application program, a first VPN function module and a first network interface connected in sequence, the VPN server has a second network interface, a second VPN function module and a forwarding module connected in sequence, and the target server has a plurality of service modules. The method comprises the following steps:

[0055] Step S101: A first security channel and a second security channel are established with the VPN server. The first security channel uses a post-quantum algorithm to output a first session key, and the second security channel uses a classical algorithm to output a second session key. Information transmission in the process of establishing the second security channel is encrypted by the first session key.

[0056] The first security channel is constructed based on a post-quantum algorithm (PQC) and is used to provide identity authentication and data protection for the second security channel. The first security channel generates a first session key, which is used to encrypt all data in the process of establishing the second security channel. The post-quantum cryptographic algorithm can provide protection against quantum computer attacks and ensure the security of the information exchange process.

[0057] The first security channel has a long validity period, and multiple second security channel negotiations can be performed within the validity period. The two-stage negotiation has the advantage that the identity authentication and key negotiation process can be divided into two parts, with the complex work being completed by the first security channel with a long validity period and the simple work being completed by the second security channel. In this way, even if multiple communications are required, only one first security channel needs to be completed, which can save time for both parties.

[0058] Specifically, the application program sends raw data to the first VPN function module, and the first security channel and the second security channel are established between the first VPN function module and the second VPN function module.

[0059] After the first security channel is established, the first VPN function module and the second VPN function module will establish the second security channel. This process includes using the first session key negotiated by the first security channel to protect data exchange, ensuring that the security of data exchange can be guaranteed even in the quantum computing era. At the same time of establishing the first security channel, the first VPN function module and the second VPN function module also perform identity authentication to ensure that the identities of the two communication parties are trustworthy.

[0060] Step S102: The second session key negotiated is used to encrypt the raw data, and the encrypted data is sent to the VPN server.

[0061] Specifically, the first VPN function module encrypts the original data using the negotiated second session key, and the encrypted data is sent to the first network interface. Once the second secure channel is established, the client and the VPN server will use the negotiated second session key to encrypt the original data.

[0062] The first network interface sends the encrypted data to the second network interface of the VPN server. After receiving the encrypted data sent by the first network interface, the second network interface transmits the encrypted data to the second VPN function module.

[0063] Step S103: The encrypted data is decrypted by the VPN server using the negotiated second session key and then sent to the target server.

[0064] Specifically, after the second VPN function module in the VPN server receives the encrypted data sent from the second network interface, it decrypts these data using the second session key determined through the key negotiation process. This step ensures the security of the data during transmission and prevents unauthorized third parties from accessing or tampering with the data.

[0065] The decrypted data is sent to the forwarding module of the VPN server. The forwarding module is responsible for forwarding data from the VPN server to the target server on the internal network or the Internet. The forwarding module forwards the decrypted data to the corresponding business module of the target server. This business module is the part of the target server responsible for handling specific business logic, which receives and processes data from the VPN.

[0066] After the business module of the target server receives the data, it further processes the data according to business needs, such as storing, calculating, or responding to the client's request. If the business module needs to return a response to the client, it will send the response data back to the forwarding module of the VPN server, and then the forwarding module sends the response data to the second VPN function module, which encrypts the response data and sends it back to the client via the second network interface. After the first VPN function module of the client receives the encrypted response data, it decrypts the data using the corresponding decryption key and displays the decrypted data to the user or further processes it.

[0067] Through the above process, a protection chain is realized, in which PQC algorithms protect classical algorithms, and classical algorithms protect data transmission. The PQC algorithm, which has slower operation speed and larger data volume, is placed in the first stage, and the classical algorithm, which has faster operation speed and smaller data volume, is placed in the second stage. The secure channel established in the first stage has a long effective time, and only needs to be executed once in a long period of time, so the PQC algorithm has less impact.

[0068] In a feasible implementation, refer to Figure 2As shown, the client establishes a first secure channel with the VPN server, including the following steps:

[0069] Step S1011: sending a first random number, a valid time for establishing the first secure channel this time, a supported protocol version, and a supported post-quantum algorithm type to the VPN server; and receiving a second random number, a first server post-quantum algorithm public key, a determined valid time for establishing the first secure channel this time, a selected protocol version, and a selected post-quantum algorithm sent by the VPN server.

[0070] Specifically, the first random number is used for subsequent key generation and verification processes. Preferably, the first random number is a quantum random number (QRNG), which is a random number generated based on the principles of quantum mechanics and has unpredictability and aperiodicity to ensure the security and reliability of the communication process.

[0071] The protocol version sent by the first VPN function module determines the specification and rule framework followed by the subsequent communication between the two parties. The protocol version defines the rules and steps that must be followed in the communication process, including how to establish a connection, how to exchange information, and how to handle errors. The algorithm type is related to subsequent security-related operations such as encryption and signature to establish initial parameters for communication. The valid time specifies the duration of the secure channel, and after the valid time is exceeded, the secure channel will be invalid. If the two parties need to continue communication, they need to re-establish a secure channel.

[0072] After receiving the information from the first VPN function module, the second VPN function module starts to filter from the protocol version and algorithm type set provided by the first VPN function module, determines a suitable option based on the configuration of its own system, pre-set security policies, and support capabilities for various protocols and algorithms, and after determining the selection, the second VPN function module will explicitly inform the first VPN function module which protocol version and algorithm type are selected, as well as the determined value of the valid time, so that the first VPN function module knows that the subsequent communication will be carried out accordingly.

[0073] In addition, the second VPN function module also generates and transmits a second random number to the first VPN function module. The second random number, similar to the first random number sent by the first VPN function module, is also used for subsequent operations such as generating a first session key. Preferably, the second random number is also a quantum random number. By providing random numbers by both parties, the randomness and confidentiality of key generation are further enhanced.

[0074] By exchanging random numbers and confirming the protocol version and algorithm, the first VPN function module and the second VPN function module confirm that they use the same communication rules and security measures, thereby establishing a secure communication channel.

[0075] In the embodiments provided by the present application, the post-quantum algorithm includes a first server post-quantum algorithm and a second post-quantum algorithm. In a feasible implementation, the first server post-quantum algorithm is a post-quantum cryptographic encapsulation algorithm. An example of the first post-quantum cryptographic encapsulation algorithm is the Kyber algorithm, which is a lattice-based public key encryption scheme and is used for key encapsulation and the like. The second VPN function module sends a Kyber public key to the first VPN function module, which is used in subsequent key encapsulation and decryption operations to construct a two-party secure communication key system. The second post-quantum algorithm is a post-quantum cryptographic signature algorithm. An example of the second post-quantum cryptographic signature algorithm is the Dilithium algorithm, which is a lattice-based digital signature scheme and is used for identity verification and the like.

[0076] Step S1012: The first server post-quantum algorithm is used to encapsulate a pre-master key and ciphertext of the pre-master key. The pre-master key is retained, a master key is generated using the first random number, the second random number and the pre-master key, and a first session key is derived according to the master key, and then the ciphertext is sent to the VPN server.

[0077] The first VPN function module performs a key encapsulation operation using the Kyber public key sent by the second VPN function module. In this process, a pre-master key and a corresponding ciphertext form (i.e., Cipher) are generated by a specific key encapsulation algorithm in combination with relevant parameters.

[0078] The pre-master key is usually a randomly generated random number, preferably a quantum random number, which is used for subsequent session encryption. The encryption of the pre-master key into Cipher is to ensure that the pre-master key is not leaked during transmission to the second VPN function module and to protect its confidentiality. Subsequently, the first VPN function module sends the Cipher to the second VPN function module.

[0079] After receiving the Cipher, the second VPN function module decrypts it using its own Kyber private key. Since there is a specific mathematical correspondence between the Kyber public key and the private key, only the matching private key can correctly decrypt the ciphertext generated by the corresponding public key. Through this decryption process, the second VPN function module can successfully obtain the plaintext content of the pre-master key.

[0080] After the ciphertext is decrypted by the second VPN function module, the second VPN function module has the necessary elements to generate the first session key, i.e., the first random number, the second random number and the pre-master key. The second VPN function module generates a master key using the same algorithm in combination with the first random number, the second random number and the pre-master key, and derives a first session key according to the master key.

[0081] Step S1013: The information sent by both parties and the client identity information are signed by the built-in second client post-quantum algorithm private key to obtain a client signature, which is sent to the VPN server.

[0082] Specifically, the client signature is obtained by signing the information sent by both parties and the client identity information by the first VPN function module using the built-in Dilithium private key. After receiving the client signature, the second VPN function module verifies the signature using the built-in Dilithium public key to determine the identity of the other party. Through the signature based on the private key, the first VPN function module proves the identity of the second VPN function module. Only the party with the corresponding Dilithium private key can generate a correct signature, which can be verified by the second VPN function module using the corresponding Dilithium public key. If the verification is passed, it means that the first VPN function module communicating with it is legal and has the corresponding private key, thereby confirming the identity of the first VPN function module and laying a foundation for subsequent secure and reliable communication. If the verification fails, it may mean that there is a security risk, such as a man-in-the-middle attack, and the communication will be interrupted.

[0083] Step S1014: Obtain the server signature sent from the VPN server. The server signature is obtained by signing the information sent by both parties and the client identity information by the server using the built-in second server post-quantum algorithm private key after the VPN server verifies the client signature. The client verifies the server signature using the built-in second server post-quantum algorithm public key to confirm the identity of the other party.

[0084] Specifically, the server signature is obtained by signing the information sent by both parties and the server identity information by the second VPN function module using the built-in Dilithium private key. After receiving the client signature, the first VPN function module verifies the signature using the built-in Dilithium public key to determine the identity of the other party. Through the signature based on the private key, the second VPN function module proves the identity of the first VPN function module. Only the party with the corresponding Dilithium private key can generate a correct signature, which can be verified by the first VPN function module using the corresponding Dilithium public key. If the verification is passed, it means that the second VPN function module communicating with it is legal and has the corresponding private key, thereby confirming the identity of the second VPN function module and laying a foundation for subsequent secure and reliable communication. If the verification fails, it may mean that there is a security risk, such as a man-in-the-middle attack, and the communication will be interrupted.

[0085] After the key verification step, the first VPN function module and the second VPN function module have determined a consistent and secure first session key, and on this basis, the first VPN function module and the second VPN function module can use the first session key to establish a second secure channel.

[0086] In an embodiment, as shown in FIG. 1, the client establishes a second secure channel with the VPN server, including the following steps: Figure 2

[0087] Step S1015: Send the effective time of this time of establishing the second secure channel, the supported protocol version, and the supported classic algorithm type to the VPN server; receive the determined effective time of this time of establishing the second secure channel, the selected protocol version, and the selected classic algorithm sent by the VPN server.

[0088] The protocol version sent by the first VPN function module determines the specification and rule framework followed by the subsequent communication between the two parties, and the protocol version defines the rules and steps that must be followed in the communication process, including how to establish a connection, how to exchange information, and how to handle errors. The algorithm type is related to subsequent security-related operations such as encryption and signature, and the initial parameters for establishing communication. The effective time specifies the duration of the secure channel, and after the effective time is exceeded, the secure channel will be invalid, and if the two parties need to continue communication, they need to re-establish a secure channel.

[0089] After the second VPN function module receives the information of the first VPN function module, it starts to filter from the protocol version and algorithm type set provided by the first VPN function module, determines a suitable option based on the configuration of its own system, the pre-set security policy, and the support capability for various protocols and algorithms, and after determining the selection, the second VPN function module will explicitly inform the first VPN function module which protocol version and algorithm type are selected, and the determined value of the effective time, so that the first VPN function module knows that the subsequent communication will be carried out according to this.

[0090] By confirming the protocol version and the algorithm, the first VPN function module and the second VPN function module confirm that they use the same communication rules and security measures, thereby establishing a secure communication channel.

[0091] The classic algorithm includes SM1, SM2, SM3, SM4, SM7, SM9, or ZUC algorithm, and in the embodiment provided by the present application, the classic algorithm is SM2 algorithm.

[0092] ​Step S1016: the first built-in client classic algorithm public key is sent to the VPN server, and the first server classic algorithm public key sent by the VPN server is received; the second session key is calculated based on the first client classic algorithm public key and the first server classic algorithm public key, and the second session key is also generated by the VPN server.

[0093] Specifically, the first VPN function module sends the first built-in client classic algorithm public key (for example, an SM2 public key) to the second VPN function module; and the second VPN function module also sends the first built-in server classic algorithm public key (for example, an SM2 public key) to the first VPN function module.

[0094] The first VPN function module calculates the second session key based on the first client classic algorithm private key and the first server classic algorithm public key, and the second VPN function module calculates the second session key based on the first client classic algorithm public key and the first server classic algorithm private key.

[0095] Step S1017: the first built-in client classic algorithm private key is used to sign the information sent by both parties and the second session key to obtain a client signature, and the client signature is sent to the VPN server; and a server signature sent from the VPN server is obtained, wherein the server signature is obtained by the VPN server using the first built-in server classic algorithm private key to sign the information sent by both parties and the second session key.

[0096] Specifically, the first VPN function module uses the first built-in client classic algorithm private key (for example, an SM2 private key) to sign the information sent by both parties and the second session key to obtain a client signature, and the client signature is sent to the second VPN function module.

[0097] The second VPN function module uses the second built-in client classic algorithm private key (for example, an SM2 private key) to sign the information sent by both parties and the second session key to obtain a client signature, and the client signature is sent to the first VPN function module.

[0098] Step S1018: the client and the VPN server verify the signatures of each other, and after the signatures are verified successfully, the client uses the second session key to perform encrypted communication with the VPN server.

[0099] In a second aspect, the application provides an IPSEC VPN remote access system, comprising a client, a VPN server and a target server, the client has an application program, a first VPN function module and a first network interface connected in sequence, the VPN server has a second network interface, a second VPN function module and a forwarding module connected in sequence, and the target server has a plurality of service modules, wherein:

[0100] The application program sends original data to the first VPN function module, the first VPN function module and the second VPN function module establish a first security channel and a second security channel to negotiate a second session key, the first VPN function module encrypts the original data using the negotiated second session key, and the encrypted data is sent to the first network interface by the first VPN function module.

[0101] After the second network interface receives the encrypted data sent by the first network interface, the encrypted data is transmitted to the second VPN function module, the second VPN function module decrypts the encrypted data using the negotiated second session key and sends the decrypted data to the forwarding module, and the forwarding module forwards the decrypted data to the corresponding service module of the target server.

[0102] In the embodiments provided by the application, the first VPN function module and the second VPN function module establish a first security channel, which comprises:

[0103] The first VPN function module sends a first random number, a valid time for establishing the first security channel this time, a supported protocol version and a supported post-quantum algorithm type to the second VPN function module.

[0104] The second VPN function module selects a protocol version and an algorithm supported by itself from the protocol version and the algorithm supported by the first VPN function module, and sends the selection result, a first server post-quantum algorithm public key, a second random number and a determined valid time for establishing the first security channel this time to the first VPN function module.

[0105] The first VPN function module uses the first server post-quantum algorithm public key to encapsulate a pre-master key and a ciphertext of the pre-master key, retains the pre-master key, generates a master key using the first random number, the second random number and the pre-master key, and derives a first session key according to the master key, and then sends the ciphertext to the second VPN function module.

[0106] The second VPN function module receives the ciphertext sent by the first VPN function module, and decrypts the ciphertext using a first server post-quantum algorithm private key to obtain a pre-master key, and generates a first session key using the first random number, the second random number and the pre-master key.

[0107] The first VPN function module uses a built-in second client post-quantum algorithm private key to sign the information sent by both parties and client identity information to obtain a client signature, and sends the client signature to the second VPN function module.

[0108] The second VPN function module uses a built-in second client post-quantum algorithm public key to verify the client signature, thereby confirming the identity of the other party.

[0109] The second VPN function module uses a built-in second server post-quantum algorithm private key to sign information sent by both parties and server identity information to obtain a server signature and sends the server signature to the first VPN function module.

[0110] The first VPN function module uses a built-in second server post-quantum algorithm public key to verify the server signature, thereby confirming the identity of the other party.

[0111] In the embodiments provided by the application, the first VPN function module and the second VPN function module establish a second secure channel, including:

[0112] The first VPN function module sends, to the second VPN function module, an effective time for establishing the second secure channel this time, a supported protocol version, and a supported classical algorithm type.

[0113] The second VPN function module selects a supported protocol version and a classical algorithm supported by itself from the protocol version and the classical algorithm type supported by the first VPN function module, and sends the selection result and a determined effective time for establishing the second secure channel this time to the first VPN function module.

[0114] The first VPN function module sends a built-in first client classical algorithm public key to the second VPN function module, and the second VPN function module sends a built-in first server classical algorithm public key to the first VPN function module.

[0115] The first VPN function module calculates a second session key based on a first client classical algorithm private key and a first server classical algorithm public key, and the second VPN function module calculates a second session key based on a first client classical algorithm public key and a first server classical algorithm private key.

[0116] The first VPN function module uses a built-in first client classical algorithm private key to sign information sent by both parties and the second session key calculated by the first VPN function module and sends the signed information to the second VPN function module.

[0117] The second VPN function module uses a built-in first server classical algorithm private key to sign information sent by both parties and the second session key calculated by the second VPN function module and sends the signed information to the first VPN function module.

[0118] The first VPN function module and the second VPN function module verify each other's signatures, and after the signatures are both verified successfully, the first VPN function module uses the second session key to perform encrypted communication with the second VPN function module.

[0119] In a third aspect, an electronic device is provided, comprising a memory and a processor, the memory storing a computer program, and the processor configured to execute the computer program to implement the steps of any of the method embodiments.

[0120] In particular, the electronic device can further comprise a transmission device connected to the processor, and an input / output device connected to the processor.

[0121] In particular, in the present embodiment, the processor can be configured to implement the following steps through the computer program:

[0122] Step S101: establishing a first secure channel and a second secure channel with a VPN server, the first secure channel being output with a first session key using a post-quantum algorithm, the second secure channel being output with a second session key using a classical algorithm, and information transmission during the establishment of the second secure channel being encrypted by the first session key.

[0123] Step S102: encrypting the original data using the negotiated second session key, and sending the encrypted data to the VPN server.

[0124] Step S103: the encrypted data being decrypted by the VPN server using the negotiated second session key and then sent to a target server.

[0125] In a fourth aspect, a storage medium is provided, the storage medium storing a computer program, wherein the computer program is configured to implement the steps of any of the method embodiments when executed.

[0126] In particular, in the present embodiment, the storage medium can be configured to store a computer program for implementing the following steps:

[0127] Step S101: establishing a first secure channel and a second secure channel with a VPN server, the first secure channel being output with a first session key using a post-quantum algorithm, the second secure channel being output with a second session key using a classical algorithm, and information transmission during the establishment of the second secure channel being encrypted by the first session key.

[0128] Step S102: encrypting the original data using the negotiated second session key, and sending the encrypted data to the VPN server.

[0129] Step S103: the encrypted data being decrypted by the VPN server using the negotiated second session key and then sent to a target server.

[0130] The above detailed description of the structure, features and effects of the present application is based on the embodiments shown in the drawings. The above description is only the preferred embodiments of the present application, but the present application is not limited to the embodiments shown in the drawings. Any changes or modifications made in accordance with the concept of the present application, or equivalent embodiments with equivalent changes, are still within the scope of the present application.

Claims

1. An IPSEC VPN remote access method supporting a post-quantum algorithm, characterized in that: The application is applied to a client to remotely access a target server through a VPN server, and the method comprises the following steps: establishing a first security channel and a second security channel with the VPN server, the first security channel uses a post-quantum algorithm to output a first session key, and the second security channel uses a classical algorithm to output a second session key, and information transmission in the second security channel establishment process is encrypted by the first session key; encrypting original data by using the second session key and sending the encrypted data to the VPN server; the encrypted data is decrypted by the VPN server by using the second session key and then sent to the target server.

2. The method of claim 1, wherein: The client and the VPN server establish the first security channel, which comprises the following steps: sending a first random number, a valid time for establishing the first security channel this time, a supported protocol version and a supported post-quantum algorithm type to the VPN server; receiving a second random number, a first server post-quantum algorithm public key, a determined valid time for establishing the first security channel this time, a selected protocol version and a selected post-quantum algorithm sent by the VPN server; using the first server post-quantum algorithm public key to encapsulate a pre-master key and a ciphertext of the pre-master key, reserving the pre-master key, generating a master key by using the first random number, the second random number and the pre-master key, and deriving a first session key according to the master key, and then sending the ciphertext to the VPN server; using a built-in second client post-quantum algorithm private key to sign information transmitted between the client and the VPN server and client identity information to obtain a client signature, and sending the client signature to the VPN server; obtaining a server signature sent from the VPN server, the server signature being obtained by the server by using a built-in second server post-quantum algorithm private key to sign information transmitted between the client and the VPN server and client identity information after the VPN server verifies the client signature; verifying the server signature by using a built-in second server post-quantum algorithm public key, so as to verify the identity of the VPN server.

3. The method of claim 2, wherein: The client and the VPN server establish the second security channel, which comprises the following steps: sending a valid time for establishing the second security channel this time, a supported protocol version and a supported classical algorithm type to the VPN server; receiving a determined valid time for establishing the second security channel this time, a selected protocol version and a selected classical algorithm sent by the VPN server; sending a built-in first client classical algorithm public key to the VPN server and receiving a first server classical algorithm public key sent by the VPN server; calculating a second session key based on the first client classical algorithm private key and the first server classical algorithm public key, the second session key also being generated by the VPN server; using a built-in first client classical algorithm private key to sign information transmitted between the client and the VPN server and the second session key to obtain a client signature, and sending the client signature to the VPN server; Obtaining a server signature sent from the VPN server, the server signature being obtained by the VPN server signing information sent by both parties and a second session key using a built-in first server classical algorithm private key; The client and the VPN server verify each other's signatures, and after both signatures are verified, the client uses the second session key to perform encrypted communication with the VPN server.

4. The method of claim 1, wherein: The post-quantum algorithm includes a post-quantum cryptographic encapsulation algorithm or a post-quantum cryptographic signature algorithm.

5. The method of claim 1, wherein: The classical algorithm includes SM1, SM2, SM3, SM4, SM7, SM9, or ZUC algorithm.

6. An IPSEC VPN remote access system characterized by comprising: The client, the VPN server, and the target server, the client has an application program, a first VPN function module, and a first network interface connected in sequence, the VPN server has a second network interface, a second VPN function module, and a forwarding module connected in sequence, and the target server has a plurality of business modules, wherein: The application program sends original data to the first VPN function module, and the first VPN function module and the second VPN function module establish a first secure channel and a second secure channel to negotiate a second session key; the first VPN function module uses the negotiated second session key to encrypt the original data, and the encrypted data is sent to the first network interface by the first VPN function module; wherein the first secure channel outputs a first session key using a post-quantum algorithm, and the second secure channel outputs a second session key using a classical algorithm, and information transmission in the second secure channel establishment process is encrypted by the first session key; After the second network interface receives the encrypted data sent by the first network interface, the encrypted data is transmitted to the second VPN function module, the second VPN function module uses the negotiated second session key to decrypt the encrypted data and sends it to the forwarding module, and the forwarding module forwards the decrypted data to the corresponding business module of the target server.

7. The IPSEC VPN remote access system of claim 6, wherein, The first VPN function module and the second VPN function module establish a first secure channel, including: The first VPN function module sends a first random number, a valid time for establishing the first secure channel this time, a supported protocol version, and a supported post-quantum algorithm type to the second VPN function module; The second VPN function module selects a protocol version and an algorithm supported by itself from the protocol version and the algorithm supported by the first VPN function module, and sends the selection result, a first server post-quantum algorithm public key, a second random number, and a determined valid time for establishing the first secure channel this time to the first VPN function module; The first VPN function module uses the first server post-quantum algorithm public key to encapsulate a pre-master key and a ciphertext of the pre-master key, retains the pre-master key, generates a master key using the first random number, the second random number, and the pre-master key, and derives a first session key according to the master key, and then sends the ciphertext to the second VPN function module; The second VPN function module receives the ciphertext sent by the first VPN function module, and uses a first server post-quantum algorithm private key to decrypt the ciphertext to obtain a pre-master key, and uses the first random number, the second random number and the pre-master key to generate a first session key; The first VPN function module uses a built-in second client post-quantum algorithm private key to sign information transmitted between the first VPN function module and the second VPN function module and client identity information to obtain a client signature, and sends the client signature to the second VPN function module; The second VPN function module uses a built-in second client post-quantum algorithm public key to verify the client signature, thereby confirming the identity of the first VPN function module; The second VPN function module uses a built-in second server post-quantum algorithm private key to sign information transmitted between the first VPN function module and the second VPN function module and server identity information to obtain a server signature, and sends the server signature to the first VPN function module; The first VPN function module uses a built-in second server post-quantum algorithm public key to verify the server signature, thereby confirming the identity of the second VPN function module.

8. The IPSEC VPN remote access system of claim 6, wherein, The first VPN function module and the second VPN function module establish a second secure channel, including: The first VPN function module sends, to the second VPN function module, a valid time for establishing the second secure channel this time, a supported protocol version and a supported classical algorithm type; The second VPN function module selects a protocol version and a classical algorithm that the second VPN function module supports from the protocol version and the classical algorithm supported by the first VPN function module, and sends, to the first VPN function module, a selection result and a determined valid time for establishing the second secure channel this time; The first VPN function module sends, to the second VPN function module, a built-in first client classical algorithm public key; The second VPN function module sends, to the first VPN function module, a built-in first server classical algorithm public key; The first VPN function module calculates a second session key based on the first client classical algorithm private key and the first server classical algorithm public key, and the second VPN function module calculates a second session key based on the first client classical algorithm public key and the first server classical algorithm private key; The first VPN function module uses a built-in first client classical algorithm private key to sign information transmitted between the first VPN function module and the second VPN function module and the second session key calculated by the first VPN function module, and sends the signed information to the second VPN function module; The second VPN function module uses a built-in first server classical algorithm private key to sign information transmitted between the first VPN function module and the second VPN function module and the second session key calculated by the second VPN function module, and sends the signed information to the first VPN function module; The first VPN function module and the second VPN function module verify each other's signature, and after the signature verification is successful, the first VPN function module uses the second session key to perform encrypted communication with the second VPN function module.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the method in any one of claims 1 to 5 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores the method in any one of claims 1 to 5.

Images