Digital signature verification method and device, equipment and medium

Abstract

The invention provides a digital signature verification method and device, equipment and a medium, and relates to the technical field of network security. The method comprises the following steps: a second communication party receives a first key identifier and a first encrypted data packet sent by a first communication party; the second communication party decrypts the first encrypted data packet by using a first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm to obtain a digital signature and an original message text corresponding to the digital signature; the second communication party decrypts the digital signature by using the public key of the first communication party to obtain a first abstract; the second communication party uses the same hash function as the first communication party to calculate the message original text to obtain a second abstract; and the second communication party determines that the digital signature verification of the first communication party is successful under the condition that the first abstract is the same as the second abstract. According to the embodiment of the invention, the security of the digital signature can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a digital signature verification method, device, equipment and medium. Background Art

[0002] A digital signature, also known as a public key digital signature, is a string of numbers that can only be generated by the sender of the information and cannot be forged by others. This string of numbers is also an effective proof of the authenticity of the information sent by the sender. Existing digital signatures usually use calculation methods based on the complexity of mathematical algorithms. Today's mainstream public key cryptographic algorithms, such as RSA, are based on two mathematical problems: factorization of large integers or calculation of discrete logarithms over finite fields.

[0003] The development of quantum computing has brought new security threats to traditional encrypted communications. Shor's algorithm can reduce the time required to crack large number factorization problems and discrete logarithm solving problems from exponential to polynomial, posing a serious threat to the currently widely used public key cryptography system.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present disclosure provides a digital signature verification method, apparatus, device and medium, which introduce quantum key encryption into the digital signature scheme to at least solve the problem of insufficient security of existing digital signatures to a certain extent and improve the security of digital signatures.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a digital signature verification method is provided. The method is performed by a second communication party, and the method includes:

[0008] Receiving a first key identifier and a first encrypted data packet sent by a first communication party;

[0009] Decrypting the first encrypted data packet using a first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm to obtain a digital signature and an original message corresponding to the digital signature;

[0010] Decrypting the digital signature using the public key of the first communication party to obtain a first summary;

[0011] Applying the same hash function as that of the first communication party to calculate the original message to obtain a second digest;

[0012] When the first digest and the second digest are identical, it is determined that the digital signature verification of the first communication party succeeds.

[0013] In one embodiment of the present disclosure, the first quantum key corresponding to the first key identifier and the symmetric cryptographic algorithm are used to decrypt the first encrypted data packet, and a digital certificate of the first communication party is obtained; the method further includes:

[0014] Using the root certificate of the certificate issuing authority to verify the digital certificate of the first communication party;

[0015] Applying the public key of the first communication party to decrypt the digital signature to obtain the first summary includes: when the digital certificate of the first communication party is verified, applying the public key of the first communication party to decrypt the digital signature to obtain the first summary.

[0016] In one embodiment of the present disclosure, the second communication party and the first communication party share and synchronize the quantum key in the following manner:

[0017] Offline key filling method or online real-time generation method based on quantum key distribution network.

[0018] According to another aspect of the present disclosure, a digital signature verification method is provided, the method is performed by a first communication party, and the method includes:

[0019] Applying a hash function to calculate the original message to generate a first summary;

[0020] Using the private key to encrypt the first digest to obtain a digital signature;

[0021] Using a first quantum key and a symmetric cryptographic algorithm to encrypt the original message and the digital signature to obtain a first encrypted data packet;

[0022] The first encrypted data packet and the first key identifier corresponding to the first quantum key are sent to the second communication party, so that the second communication party applies the first quantum key corresponding to the first key identifier and the symmetric encryption algorithm to decrypt the first encrypted data packet, obtains the digital signature and the message original corresponding to the digital signature, applies the public key of the first communication party to decrypt the digital signature, obtains the first summary, applies the same hash function as the first communication party, calculates the message original, obtains the second summary, and when the first summary and the second summary are the same, determines that the digital signature verification of the first communication party is successful.

[0023] In one embodiment of the present disclosure, a digital signature and a message original are encrypted using a first quantum key and a symmetric cryptographic algorithm to obtain a first encrypted data packet, including:

[0024] The first quantum key and the symmetric encryption algorithm are used to encrypt the digital certificate, the original message and the digital signature of the first communication party to obtain a first encrypted data packet.

[0025] In one embodiment of the present disclosure, the method further includes:

[0026] Using a second quantum key and a symmetric cryptographic algorithm to encrypt the identity information of the first communication party and the public key of the first communication party to obtain a second encrypted data packet;

[0027] Sending the second encrypted data packet and the second key identifier corresponding to the second quantum key to the certificate issuing authority, so that the certificate issuing authority applies the second quantum key and the symmetric cryptographic algorithm to decrypt the second encrypted data packet, obtains the identity information of the first communication party and the public key of the first communication party, reviews the identity information of the first communication party, and issues a digital certificate containing the public key to the first communication party if the review is passed;

[0028] Obtaining a third key identifier and a third encrypted data packet sent by a certificate issuing authority;

[0029] The third encrypted data packet is decrypted using a third quantum key corresponding to the third key identifier and a symmetric cryptographic algorithm to obtain a digital certificate.

[0030] According to another aspect of the present disclosure, a digital signature verification device is provided, the device is arranged at a second communication party, and the device includes:

[0031] A data receiving module, used for receiving a first key identifier and a first encrypted data packet sent by a first communication party;

[0032] A first decryption module, used to decrypt the first encrypted data packet using a first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm to obtain a digital signature and a message original corresponding to the digital signature;

[0033] A second decryption module, used to decrypt the digital signature using the public key of the first communication party to obtain a first summary;

[0034] A first hash calculation module, used to apply the same hash function as the first communication party to calculate the original message to obtain a second summary;

[0035] The signature verification module is used to determine that the digital signature verification of the first communication party is successful when the first digest and the second digest are the same.

[0036] According to another aspect of the present disclosure, a digital signature verification device is provided, the device is arranged at a first communication party, and the device includes:

[0037] A second hash calculation module, used to apply a hash function to calculate the original message to generate a first summary;

[0038] A first encryption module, used to encrypt the first summary using a private key to obtain a digital signature;

[0039] A second encryption module is used to encrypt the original message and the digital signature using the first quantum key and the symmetric encryption algorithm to obtain a first encrypted data packet;

[0040] A data sending module is used to send a first encrypted data packet and a first key identifier corresponding to a first quantum key to a second communication party, so that the second communication party applies the first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm to decrypt the first encrypted data packet, obtain a digital signature and a message original corresponding to the digital signature, apply the public key of the first communication party to decrypt the digital signature, obtain a first summary, apply the same hash function as the first communication party to calculate the message original, obtain a second summary, and determine that the digital signature of the first communication party is successfully verified when the first summary and the second summary are the same.

[0041] According to another aspect of the present disclosure, an electronic device is provided, including: a memory for storing instructions; and a processor for calling the instructions stored in the memory to implement the above-mentioned digital signature verification method.

[0042] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which computer instructions are stored. When the computer instructions are executed by a processor, the above-mentioned digital signature verification method is implemented.

[0043] According to another aspect of the present disclosure, a computer program product is provided. The computer program product stores instructions, and when the instructions are executed by a computer, the computer implements the above-mentioned digital signature verification method.

[0044] According to yet another aspect of the present disclosure, there is provided a chip, comprising at least one processor and an interface;

[0045] An interface for providing program instructions or data to at least one processor;

[0046] At least one processor is used to execute program instructions to implement the above-mentioned digital signature verification method.

[0047] The digital signature verification method, device, equipment and medium provided by the embodiments of the present disclosure combine quantum key distribution with the traditional digital signature mechanism. The generation and distribution process of quantum keys theoretically provides an unbreakable security guarantee. The use of quantum keys to symmetric encrypt digital signatures and original messages can enhance the security of the transmission process. The digital signature is then decrypted using the public key of the first communication party, and the second summary of the message is recalculated and compared with the first summary in the decrypted digital signature. If the two summaries are the same, it indicates that the message has not been tampered with and is indeed from the first communication party, thereby completing the verification process of the digital signature. In other words, the embodiments of the present disclosure utilize the security characteristics of quantum keys to protect encrypted communications, and realize the dual protection of sender identity authentication and message integrity through digital signatures, which not only improves the security of data transmission, but also ensures the authenticity and integrity of messages. In addition, through the application of symmetric encryption algorithms, the speed of encryption and decryption is also improved, which is suitable for secure communication scenarios that require efficient processing of large amounts of data.

[0048] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0050] Obviously, the drawings described below are only some embodiments of the present disclosure, and a person skilled in the art can obtain other drawings based on these drawings without any creative work.

[0051] Figure 1 A flow chart of a digital signature verification method performed by a second communication party in an embodiment of the present disclosure is shown;

[0052] Figure 2 A flow chart of a digital signature verification method performed by a first communication party in an embodiment of the present disclosure is shown;

[0053] Figure 3 A flowchart of obtaining a digital certificate in an embodiment of the present disclosure is shown;

[0054] Figure 4 A flow chart of a digital signature verification method in an embodiment of the present disclosure is shown;

[0055] Figure 5 Another digital signature verification method flow chart in the embodiment of the present disclosure is shown;

[0056] Figure 6 A flowchart of another digital signature verification method in an embodiment of the present disclosure is shown;

[0057] Figure 7 A schematic diagram of the architecture of a digital signature system in an embodiment of the present disclosure is shown;

[0058] Figure 8 A schematic diagram of a digital signature verification device in an embodiment of the present disclosure is shown;

[0059] Fig. 9 A schematic diagram of a digital signature verification device in an embodiment of the present disclosure is shown;

[0060] Fig.10 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the embodiments of the present disclosure generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the present disclosure for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0062] Quantum Key Distribution (QKD) uses quantum states to encode information, enabling both communicating parties to generate the same key. Its security is based on the principles of quantum physics rather than the requirements and assumptions of mathematical computing complexity. It has reliable security even when quantum computing technology matures.

[0063] The digital signature verification method, apparatus, device and medium provided in the embodiments of the present disclosure add quantum key encryption on the basis of hash calculation, digital signature and signature verification, so that the public key and private key plaintext are not transmitted on the network, and thus quantum computing will not crack the private key based on the public key, thereby preventing the signature from being forged.

[0064] The present exemplary implementation is described in detail below with reference to the accompanying drawings and embodiments.

[0065] Figure 1 A digital signature verification method in an embodiment of the present disclosure is shown, and the digital signature verification method is executed by the second communication party, such as Figure 1 As shown, the digital signature verification method provided in the embodiment of the present disclosure includes S101-S105.

[0066] In S101, the second communication party receives a first key identifier and a first encrypted data packet sent by the first communication party.

[0067] The first key identifier corresponds to the first quantum key, and the second communication party can retrieve the corresponding first quantum key based on the first key identifier to decrypt the first encrypted data packet, wherein the first encrypted data packet is encrypted by the first communication party using the first quantum key and a symmetric cryptographic algorithm.

[0068] It can be understood that the above-mentioned first communication party and second communication party correspond to the sending end and receiving end in the message transmission process respectively, both of which are used to represent communication devices. The first communication party and the second communication party can specifically be servers, terminal devices, and clients, etc.

[0069] In S102, the second communication party applies the first quantum key corresponding to the first key identifier and the symmetric encryption algorithm to decrypt the first encrypted data packet to obtain the digital signature and the original message corresponding to the digital signature.

[0070] In S103, the second communication party uses the public key of the first communication party to decrypt the digital signature to obtain a first summary.

[0071] The digital signature is obtained by encrypting the first digest using a private key by the first communication party.

[0072] In S104, the second communication party applies the same hash function as the first communication party to calculate the original message to obtain a second summary.

[0073] In S105, the second communication party determines that the digital signature verification of the first communication party succeeds if the first digest and the second digest are identical.

[0074] If the first key identifier and the first encrypted data packet in the foregoing text are authentic and complete, then the first summary should be calculated by the first communication party using a hash function on the original message, and further, the first summary and the second summary calculated in S104 should be the same.

[0075] The disclosed embodiment utilizes the security characteristics of quantum keys to protect encrypted communications, and achieves dual protection of sender identity authentication and message integrity through digital signatures, which not only improves the security of data transmission, but also ensures the authenticity and integrity of messages. In addition, through the application of symmetric encryption algorithms, the speed of encryption and decryption is also improved, which is suitable for secure communication scenarios that require efficient processing of large amounts of data.

[0076] In some embodiments, in the above S102, the second communication party applies the first quantum key corresponding to the first key identifier and the symmetric encryption algorithm to decrypt the first encrypted data packet, and also obtains the digital certificate of the first communication party. Before the above S103, the second communication party may also apply the root certificate of the certificate issuing authority to verify the digital certificate of the first communication party. In the above S103, the second communication party applies the public key of the first communication party to decrypt the digital signature to obtain the first summary, which may be the case that the digital certificate of the first communication party is verified, and the public key of the first communication party is applied to decrypt the digital signature to obtain the first summary.

[0077] In some embodiments, the second communication party and the first communication party share and synchronize quantum keys in the following ways: offline key injection or online real-time generation based on a quantum key distribution (QKD) network.

[0078] In the offline key filling method, quantum keys are pre-generated in a secure environment and stored on physical media (such as quantum USB drives or dedicated hardware devices), and then physically transported to the location where the key is needed, namely the first and second communication parties.

[0079] The online real-time generation method based on the quantum key distribution (QKD) network is a key generation process that is performed in real time through a quantum channel. The communicating parties use quantum systems such as photons to exchange information and establish a shared secret key based on the rules of quantum mechanics. The QKD network-based method can provide higher flexibility and immediacy, allowing the communicating parties to generate new keys on demand at any time without relying on a pre-prepared key inventory.

[0080] Figure 2 A digital signature verification method in an embodiment of the present disclosure is shown, and the digital signature verification method is executed by a first communication party, such as Figure 2 As shown, the digital signature verification method provided in the embodiment of the present disclosure includes S201-S204.

[0081] In S201, the first communication party applies a hash function to calculate the original message to generate a first summary.

[0082] A hash function is an algorithm that converts an input of arbitrary length (the original message) into an output of fixed length (a digest or hash value).

[0083] The above hash function can be one of the SHA-2 series (such as SHA-256, SHA-512), the SHA-3 series, BLAKE2 and BLAKE3.

[0084] The message original text may be any form of data, such as text files, binary data, etc.

[0085] In S202, the first communication party applies a private key to encrypt the first digest to obtain a digital signature.

[0086] In S203, the first communication party applies the first quantum key and the symmetric encryption algorithm to encrypt the original message and the digital signature to obtain a first encrypted data packet.

[0087] In S204, the first communication party sends the first encrypted data packet and the first key identifier corresponding to the first quantum key to the second communication party, so that the second communication party applies the first quantum key corresponding to the first key identifier and the symmetric encryption algorithm to decrypt the first encrypted data packet, obtains the digital signature and the message original corresponding to the digital signature, applies the public key of the first communication party to decrypt the digital signature to obtain a first summary, applies the same hash function as the first communication party to calculate the message original to obtain a second summary, and when the first summary and the second summary are the same, it is determined that the digital signature of the first communication party has been successfully verified.

[0088] In some embodiments, in the above-mentioned S203, the first communication party applies the first quantum key and the symmetric encryption algorithm to encrypt the digital signature and the original message to obtain a first encrypted data packet. It can be that the first quantum key and the symmetric encryption algorithm are applied to encrypt the digital certificate, the original message and the digital signature of the first communication party to obtain the first encrypted data packet.

[0089] In some embodiments, the digital signature verification method further includes a process of obtaining a digital certificate, such as Figure 3 As shown, the process of obtaining a digital certificate includes S301-S304.

[0090] In S301, the first communication party applies a second quantum key and a symmetric cryptographic algorithm to encrypt the identity information of the first communication party and the public key of the first communication party to obtain a second encrypted data packet;

[0091] In S302, the first communication party sends the second encrypted data packet and the second key identifier corresponding to the second quantum key to a certificate authority (CA), so that the certificate authority applies the second quantum key and the symmetric cryptographic algorithm to decrypt the second encrypted data packet, obtains the identity information of the first communication party and the public key of the first communication party, and reviews the identity information of the first communication party. If the review is passed, a digital certificate containing the public key is issued to the first communication party;

[0092] In S303, the first communication party obtains a third key identifier and a third encrypted data packet sent by the certificate issuing authority;

[0093] In S304, the first communication party applies the third quantum key corresponding to the third key identifier and the symmetric encryption algorithm to decrypt the third encrypted data packet to obtain a digital certificate.

[0094] Figure 4 A digital signature verification method in an embodiment of the present disclosure is shown. Figure 4 As shown, the digital signature verification method provided in the embodiment of the present disclosure includes S401-S408.

[0095] In S401, the first communication party applies a hash function to calculate the original message to generate a first summary;

[0096] In S402, the first communication party encrypts the first digest using a private key to obtain a digital signature;

[0097] In S403, the first communication party applies the first quantum key and the symmetric encryption algorithm to encrypt the original message and the digital signature to obtain a first encrypted data packet;

[0098] In S404, the first communication party sends the first key identifier and the first encrypted data packet to the second communication party;

[0099] In S405, the second communication party applies the first quantum key corresponding to the first key identifier and the symmetric cryptographic algorithm to decrypt the first encrypted data packet to obtain the digital signature and the original message corresponding to the digital signature;

[0100] In S406, the second communication party uses the public key of the first communication party to decrypt the digital signature to obtain a first summary;

[0101] In S407, the second communication party applies the same hash function as the first communication party to calculate the original message to obtain a second summary;

[0102] In S408, the second communication party determines that the digital signature verification of the first communication party succeeds if the first digest and the second digest are the same.

[0103] Figure 5 A digital signature verification method in an embodiment of the present disclosure is shown. Figure 5 As shown, the digital signature verification method provided in the embodiment of the present disclosure includes S501-S509.

[0104] In S501, the first communication party applies a hash function to calculate the original message to generate a first summary;

[0105] In S502, the first communication party encrypts the first digest using a private key to obtain a digital signature;

[0106] In S503, the first communication party uses the first quantum key and the symmetric encryption algorithm to encrypt the digital certificate, the original message and the digital signature of the first communication party to obtain a first encrypted data packet;

[0107] In S504, the first communication party sends the first key identifier and the first encrypted data packet to the second communication party;

[0108] In S505, the second communication party applies the first quantum key corresponding to the first key identifier and the symmetric cryptographic algorithm to decrypt the first encrypted data packet to obtain the digital certificate, the original message and the digital signature of the first communication party;

[0109] In S506, the second communication party verifies the digital certificate of the first communication party using the root certificate of the certificate issuing authority;

[0110] In S507, when the digital certificate of the first communication party is verified, the second communication party uses the public key of the first communication party to decrypt the digital signature to obtain a first summary;

[0111] In S508, the second communication party applies the same hash function as the first communication party to calculate the original message to obtain a second summary;

[0112] In S509, the second communication party determines that the digital signature verification of the first communication party succeeds if the first digest and the second digest are the same.

[0113] Figure 6 A digital signature verification method in an embodiment of the present disclosure is shown. Figure 6 As shown, the digital signature verification method provided in the embodiment of the present disclosure includes S601-S617, wherein S609-S617 are the same as S501-S509 and will not be described in detail here.

[0114] In S601, the first communication party applies a second quantum key and a symmetric cryptographic algorithm to encrypt the identity information of the first communication party and the public key of the first communication party to obtain a second encrypted data packet;

[0115] In S602, the first communication party sends the second encrypted data packet and the second key identifier corresponding to the second quantum key to a certificate authority (CA);

[0116] In S603, the certificate issuing authority applies the second quantum key and the symmetric cryptographic algorithm to decrypt the second encrypted data packet to obtain the identity information of the first communication party and the public key of the first communication party;

[0117] In S604, the certificate issuing authority reviews the identity information of the first communication party;

[0118] In S605, if the review is passed, the certificate issuing authority issues a digital certificate including a public key to the first communication party;

[0119] In S606, the certificate issuing authority applies the third quantum key and the symmetric cryptographic algorithm to encrypt the digital certificate including the public key to obtain a third encrypted data packet;

[0120] In S607, the certificate issuing authority sends the third key identifier and the third encrypted data packet corresponding to the third quantum key to the first communication party;

[0121] In S608, the first communication party applies the third quantum key and the symmetric encryption algorithm to decrypt the third encrypted data packet to obtain a digital certificate.

[0122] Figure 7 A digital signature system in an embodiment of the present disclosure is shown. Figure 7 As shown, the digital signature system includes a server 701, a client 702 and a certificate issuing authority 703, wherein the server 701 may be the first communication party in the above embodiment, and the client 702 may be the second communication party in the above embodiment. The devices corresponding to the server 701, the client 702 and the certificate issuing authority 703 are all provided with a quantum key module and an encryption and decryption module.

[0123] The quantum key module is used for quantum key generation and distribution as well as quantum key extraction. The generation and distribution of quantum keys can be done by offline key filling or online real-time generation based on the QKD network. This module can achieve end-to-end quantum key sharing and synchronization. The quantum key module can retrieve the corresponding quantum key according to the quantum key identifier, for example, retrieve the first quantum key according to the first key identifier.

[0124] The encryption and decryption module is used to encrypt and decrypt communication messages using a symmetric cryptographic algorithm based on the shared quantum key of the communicating parties.

[0125] Indicates that the quantum key K is used i And the symmetric encryption algorithm Enc_s is used to encrypt the information composed of m1, m2 and m3 in sequence.

[0126] It should be noted that Figure 7 Although not shown in the figure, the devices corresponding to the server 701, the client 702 and the certificate issuing authority 703 are also provided with a hash calculation module, a digital signature module and a signature verification module.

[0127] The hash calculation module performs hash calculation on the data to generate a summary; the digital signature module uses the private key and an asymmetric cryptographic algorithm to encrypt the data; the signature verification module uses the public key corresponding to the private key and an asymmetric cryptographic algorithm to decrypt the data.

[0128] The digital signature system provided by the embodiments of the present disclosure can implement quantum computing-resistant digital signatures between the CA organization and the client, and between the server and the client in the digital signature process without changing the overall process and data structure of the traditional CA and the digital signature system based on digital certificates.

[0129] In the embodiments of the present disclosure, the terms “first”, “second” and “third” are used for descriptive purposes only and should not be understood as indicating or implying relative importance.

[0130] The term "and / or" in this disclosure is only a description of the association relationship of associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0131] Furthermore, although the steps of the method in the present disclosure are described in a particular order in the drawings, this does not require or imply that the steps must be performed in this particular order or that all the steps shown must be performed to achieve the desired results.

[0132] In some embodiments, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0133] Based on the same inventive concept, the present disclosure also provides a digital signature verification device, which is arranged at the second communication party, such as Figure 8 As shown, the digital signature verification device includes a data receiving module 801 , a first decryption module 802 , a second decryption module 803 , a first hash calculation module 804 and a signature verification module 805 .

[0134] The data receiving module 801 is used to receive a first key identifier and a first encrypted data packet sent by a first communication party;

[0135] A first decryption module 802 is used to decrypt the first encrypted data packet using a first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm to obtain a digital signature and a message original corresponding to the digital signature;

[0136] A second decryption module 803, configured to decrypt the digital signature using the public key of the first communication party to obtain a first summary;

[0137] A first hash calculation module 804 is used to apply the same hash function as the first communication party to calculate the original message to obtain a second summary;

[0138] The signature verification module 805 is used to determine that the digital signature verification of the first communication party is successful when the first digest and the second digest are the same.

[0139] In some embodiments, the first decryption module 802 applies the first quantum key corresponding to the first key identifier and the symmetric encryption algorithm to decrypt the first encrypted data packet, and also obtains the digital certificate of the first communication party; the above-mentioned digital signature verification device also includes a certificate verification module.

[0140] A certificate verification module, used to verify the digital certificate of the first communication party using the root certificate of the certificate issuing authority;

[0141] The second decryption module 803 is used to apply the public key of the first communication party to decrypt the digital signature and obtain the first summary when the digital certificate of the first communication party is verified.

[0142] In some embodiments, the second communication party and the first communication party share and synchronize quantum keys in the following ways: offline key injection or online real-time generation based on a quantum key distribution network.

[0143] Based on the same inventive concept, a digital signature verification device is also provided in the embodiment of the present disclosure. The device is arranged at the first communication party, such as Fig. 9 As shown, the digital signature verification device includes a second hash calculation module 901 , a first encryption module 902 , a second encryption module 903 and a data sending module 904 .

[0144] The second hash calculation module 901 is used to apply a hash function to the original message to generate a first digest;

[0145] A first encryption module 902, used to encrypt the first digest using a private key to obtain a digital signature;

[0146] The second encryption module 903 is used to encrypt the original message and the digital signature using the first quantum key and the symmetric encryption algorithm to obtain a first encrypted data packet;

[0147] The data sending module 904 is used to send the first encrypted data packet and the first key identifier corresponding to the first quantum key to the second communication party, so that the second communication party applies the first quantum key corresponding to the first key identifier and the symmetric encryption algorithm to decrypt the first encrypted data packet, obtain the digital signature and the message original corresponding to the digital signature, apply the public key of the first communication party to decrypt the digital signature to obtain the first summary, apply the same hash function as the first communication party to calculate the message original to obtain the second summary, and determine that the digital signature of the first communication party is successfully verified when the first summary and the second summary are the same.

[0148] In some embodiments, the second encryption module 903 is used to apply the first quantum key and the symmetric encryption algorithm to encrypt the digital certificate, the original message and the digital signature of the first communication party to obtain a first encrypted data packet.

[0149] In some embodiments, the digital signature verification device also includes a certificate acquisition module.

[0150] The certificate acquisition module is used to apply a second quantum key and a symmetric encryption algorithm to encrypt the identity information of the first communication party and the public key of the first communication party to obtain a second encrypted data packet; send the second encrypted data packet and the second key identifier corresponding to the second quantum key to a certificate issuing authority, so that the certificate issuing authority applies the second quantum key and the symmetric encryption algorithm to decrypt the second encrypted data packet to obtain the identity information of the first communication party and the public key of the first communication party, review the identity information of the first communication party, and issue a digital certificate containing the public key to the first communication party if the review is passed; obtain a third key identifier and a third encrypted data packet sent by the certificate issuing authority; apply a third quantum key corresponding to the third key identifier and a symmetric encryption algorithm to decrypt the third encrypted data packet to obtain a digital certificate.

[0151] The concepts of “first”, “second”, etc. mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0152] Regarding the digital signature verification device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the digital signature verification method, and will not be elaborated here.

[0153] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, such division is not mandatory.

[0154] In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0155] Some of the blocks shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0156] Refer to the following Fig.10 To describe the electronic device provided by the embodiment of the present disclosure. Fig.10 The electronic device 1000 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0157] Fig.10 FIG. 1 is a schematic diagram showing the architecture of an electronic device 1000 provided by an embodiment of the present disclosure. Fig.10 As shown, the electronic device 1000 includes but is not limited to: at least one processor 1010 and at least one memory 1020 .

[0158] The memory 1020 is used to store instructions.

[0159] In some embodiments, the memory 1020 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 10201 and / or a cache memory unit 10202 , and may further include a read-only memory unit (ROM) 10203 .

[0160] In some embodiments, memory 1020 may also include a program / utility 10204 having a set (at least one) of program modules 10205, such program modules 10205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0161] In some embodiments, the memory 1020 may store an operating system, which may be a real-time operating system (RTX), LINUX, UNIX, WINDOWS, or OS X.

[0162] In some embodiments, data may also be stored in the memory 1020 .

[0163] As an example, the processor 1010 may read data stored in the memory 1020 , where the data may be stored at the same storage address as the instruction, or the data may be stored at a different storage address than the instruction.

[0164] The processor 1010 is used to call the instructions stored in the memory 1020 to implement the steps of various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processor 1010 can execute the steps of the above digital signature verification method embodiment.

[0165] It should be noted that the processor 1010 may be a general-purpose processor or a special-purpose processor. The processor 1010 may include one or more processing cores, and the processor 1010 executes various functional applications and data processing by running instructions.

[0166] In some embodiments, the processor 1010 may include a central processing unit (CPU) and / or a baseband processor.

[0167] In some embodiments, the processor 1010 may determine an instruction according to the priority identifier and / or function category information carried in each control instruction.

[0168] In the present disclosure, the processor 1010 and the memory 1020 may be provided separately or integrated together.

[0169] As an example, the processor 1010 and the memory 1020 may be integrated on a single board or a system on chip (SOC).

[0170] like Fig.10 As shown, the electronic device 1000 is in the form of a general-purpose computing device. The electronic device 1000 may further include a bus 1030 .

[0171] The bus 1030 may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0172] The electronic device 1000 may also communicate with one or more external devices 1040 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device 1000, and / or any device that enables the electronic device 1000 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface 1050.

[0173] Furthermore, the electronic device 1000 can also communicate with one or more networks (eg, a local area network (LAN), a wide area network (WAN) and / or a public network, such as the Internet) through the network adapter 1060 .

[0174] like Fig.10 As shown, the network adapter 1060 communicates with other modules of the electronic device 1000 via the bus 1030 .

[0175] It should be understood that although not shown in the figures, other hardware and / or software modules may be used in conjunction with the electronic device 1000, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0176] It is understood that the structure shown in the embodiment of the present disclosure does not constitute a specific limitation on the electronic device 1000. In other embodiments of the present disclosure, the electronic device 1000 may include Fig.10 More or fewer components may be shown, or some components may be combined or separated, or the components may be arranged differently. Fig.10 The components shown may be implemented in hardware, software or a combination of software and hardware.

[0177] The present disclosure also provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed by a processor, the digital signature verification method described in the above method embodiment is implemented.

[0178] The computer-readable storage medium in the embodiments of the present disclosure is a computer instruction that can be sent, propagated or transmitted for use by or in conjunction with an instruction execution system, apparatus or device.

[0179] As one example, computer readable storage media are non-volatile storage media.

[0180] In some embodiments, more specific examples of computer-readable storage media in the present disclosure may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, a USB flash drive, a mobile hard disk, or any suitable combination of the foregoing.

[0181] In the embodiments of the present disclosure, the computer-readable storage medium may include a data signal propagated in a baseband or as a part of a carrier wave, in which computer instructions (readable program codes) are carried.

[0182] Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing.

[0183] In some examples, computing instructions contained on a computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0184] The embodiments of the present disclosure also provide a computer program product, which stores instructions. When the instructions are executed by a computer, the computer implements the digital signature verification method described in the above method embodiment.

[0185] The above instructions may be program codes. In specific implementation, the program codes may be written in any combination of one or more programming languages.

[0186] The programming language includes object-oriented programming languages, such as Java, C++, etc., and also includes conventional procedural programming languages, such as "C" language or similar programming languages.

[0187] The program code may execute entirely on the user's computing device, partly on the user's computing device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server.

[0188] Where a remote computing device is involved, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0189] The embodiment of the present disclosure also provides a chip, including at least one processor and an interface;

[0190] An interface for providing program instructions or data to at least one processor;

[0191] At least one processor is used to execute program instructions to implement the digital signature verification method described in the above method embodiment.

[0192] In some embodiments, the chip may further include a memory, which is used to store program instructions and data, and the memory is located inside or outside the processor.

[0193] Those skilled in the art will appreciate that all or part of the steps for implementing the above embodiments may be implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0194] Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein.

[0195] The present disclosure is intended to cover any variation, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field not disclosed in the present disclosure. The description and examples are to be regarded as exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A digital signature verification method, characterized in that: The method is performed by a second communication party, and the method includes: Receiving a first key identifier and a first encrypted data packet sent by a first communication party; Decrypting the first encrypted data packet using a first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm to obtain a digital signature and an original message corresponding to the digital signature; Decrypting the digital signature using the public key of the first communication party to obtain a first summary; Applying the same hash function as that of the first communication party to calculate the original message to obtain a second digest; When the first digest and the second digest are identical, it is determined that the digital signature verification of the first communicating party is successful.

2. The method according to claim 1, characterized in that The first encrypted data packet is decrypted by applying the first quantum key corresponding to the first key identifier and the symmetric cryptographic algorithm, and a digital certificate of the first communication party is obtained; the method further comprises: Using a root certificate of a certificate issuing authority to verify the digital certificate of the first communication party; The applying the public key of the first communication party to decrypt the digital signature to obtain the first summary includes: when the digital certificate of the first communication party is verified, applying the public key of the first communication party to decrypt the digital signature to obtain the first summary.

3. The method according to claim 1, characterized in that The second communication party and the first communication party share and synchronize the quantum key in the following manner: Offline key injection method or online real-time generation method based on quantum key distribution network.

4. A digital signature verification method, characterized in that: The method is performed by a first communication party, and the method includes: Applying a hash function to calculate the original message to generate a first summary; Using a private key to encrypt the first summary to obtain a digital signature; Using a first quantum key and a symmetric cryptographic algorithm to encrypt the original message and the digital signature to obtain a first encrypted data packet; The first encrypted data packet and the first key identifier corresponding to the first quantum key are sent to the second communication party, so that the second communication party applies the first quantum key corresponding to the first key identifier and a symmetric encryption algorithm to decrypt the first encrypted data packet to obtain a digital signature and a message original corresponding to the digital signature, applies the public key of the first communication party to decrypt the digital signature to obtain a first summary, applies the same hash function as the first communication party to calculate the message original to obtain a second summary, and when the first summary and the second summary are the same, determines that the digital signature verification of the first communication party is successful.

5. The method according to claim 4, characterized in that The applying the first quantum key and the symmetric cryptographic algorithm to encrypt the digital signature and the original message to obtain a first encrypted data packet includes: A first quantum key and a symmetric cryptographic algorithm are used to encrypt the digital certificate of the first communication party, the original message and the digital signature to obtain a first encrypted data packet.

6. The method according to claim 5, characterized in that The method further comprises: Using a second quantum key and a symmetric cryptographic algorithm to encrypt the identity information of the first communication party and the public key of the first communication party to obtain a second encrypted data packet; sending the second encrypted data packet and the second key identifier corresponding to the second quantum key to a certificate issuing authority, so that the certificate issuing authority applies the second quantum key and the symmetric cryptographic algorithm to decrypt the second encrypted data packet, obtains the identity information of the first communication party and the public key of the first communication party, reviews the identity information of the first communication party, and, if the review is passed, issues a digital certificate containing the public key to the first communication party; Obtaining a third key identifier and a third encrypted data packet sent by the certificate issuing authority; The third encrypted data packet is decrypted using a third quantum key corresponding to the third key identifier and the symmetric cryptographic algorithm to obtain the digital certificate.

7. A digital signature verification device, characterized in that: The device is arranged at the second communication party, and the device comprises: A data receiving module, used for receiving a first key identifier and a first encrypted data packet sent by a first communication party; A first decryption module, configured to decrypt the first encrypted data packet by applying a first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm to obtain a digital signature and an original message corresponding to the digital signature; A second decryption module, configured to decrypt the digital signature using the public key of the first communication party to obtain a first summary; A first hash calculation module, configured to apply the same hash function as that of the first communication party to calculate the original message to obtain a second summary; The signature verification module is used to determine that the digital signature verification of the first communication party is successful when the first digest and the second digest are the same.

8. A digital signature verification device, characterized in that: The device is arranged at a first communication party, and comprises: A second hash calculation module, used to apply a hash function to calculate the original message to generate a first summary; A first encryption module, used to encrypt the first summary using a private key to obtain a digital signature; A second encryption module is used to encrypt the original message and the digital signature using a first quantum key and a symmetric encryption algorithm to obtain a first encrypted data packet; A data sending module is used to send the first encrypted data packet and the first key identifier corresponding to the first quantum key to a second communication party, so that the second communication party applies the first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm to decrypt the first encrypted data packet to obtain a digital signature and a message original corresponding to the digital signature, applies the public key of the first communication party to decrypt the digital signature to obtain a first summary, applies the same hash function as the first communication party to calculate the message original to obtain a second summary, and determines that the digital signature of the first communication party is successfully verified when the first summary and the second summary are the same.

9. An electronic device, characterized in that: include: A memory for storing instructions; A processor, configured to call instructions stored in the memory to implement the digital signature verification method according to any one of claims 1 to 6.

10. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed by a processor, the digital signature verification method described in any one of claims 1 to 6 is implemented.

Images