Digital signature verification method, device, equipment and medium

Abstract

The present disclosure provides a digital signature verification method, device, equipment and medium, and relates to the technical field of network security. The method comprises the following steps: a second communication party receives a first key identifier and a first encrypted data packet sent by a first communication party; the second communication party decrypts the first encrypted data packet by using a first quantum key corresponding to the first key identifier and a symmetric cipher algorithm to obtain a digital signature and a message original text corresponding to the digital signature; the second communication party decrypts the digital signature by using a public key of the first communication party to obtain a first digest; the second communication party calculates the message original text by using a same hash function as the first communication party to obtain a second digest; and the second communication party determines that the digital signature verification of the first communication party is successful in the case that the first digest and the second digest are the same. According to the embodiment of the present disclosure, the security of the digital signature can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a digital signature verification method, apparatus, device, and medium. Background Art

[0002] A digital signature, also known as a public key digital signature, is a string of numbers that can only be generated by the sender and cannot be forged by others. This string of numbers also effectively proves the authenticity of the message sent by the sender. Existing digital signatures typically use calculation methods based on the complexity of mathematical algorithms. Today's mainstream public key cryptography algorithms, such as RSA, are based on two difficult mathematical problems: factoring large integers or calculating discrete logarithms over finite fields.

[0003] The development of quantum computing has brought new security threats to traditional encrypted communications. Shor's algorithm can reduce the time required to solve large number factorization problems and discrete logarithm problems from exponential to polynomial, posing a serious threat to the currently widely used public key cryptography system.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the Invention

[0005] The present disclosure provides a digital signature verification method, apparatus, device and medium, which, by introducing quantum key encryption into the digital signature scheme, at least to a certain extent solves the problem of insufficient security of existing digital signatures and improves the security of digital signatures.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a digital signature verification method is provided. The method is performed by a second communication party, and the method includes:

[0008] receiving a first key identifier and a first encrypted data packet sent by a first communication party;

[0009] Decrypting the first encrypted data packet using a first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm to obtain a digital signature and an original message corresponding to the digital signature;

[0010] Decrypting the digital signature using the public key of the first communication party to obtain a first digest;

[0011] Applying the same hash function as that used by the first communication party to the original message to calculate a second digest;

[0012] When the first digest and the second digest are identical, it is determined that the digital signature verification of the first communicating party is successful.

[0013] In one embodiment of the present disclosure, the first encrypted data packet is decrypted using a first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm, and a digital certificate of the first communication party is obtained; the method further includes:

[0014] Verifying the digital certificate of the first communication party using the root certificate of the certificate issuing authority;

[0015] Applying the public key of the first communication party to decrypt the digital signature to obtain the first summary includes: applying the public key of the first communication party to decrypt the digital signature to obtain the first summary when the digital certificate of the first communication party is verified.

[0016] In one embodiment of the present disclosure, the second communication party and the first communication party share and synchronize the quantum key in the following manner:

[0017] Offline key injection method or online real-time generation method based on quantum key distribution network.

[0018] According to another aspect of the present disclosure, a digital signature verification method is provided. The method is performed by a first communication party, and the method includes:

[0019] Applying a hash function to the original message to generate a first digest;

[0020] Using the private key to encrypt the first digest to obtain a digital signature;

[0021] Using the first quantum key and the symmetric cryptographic algorithm to encrypt the original message and the digital signature to obtain a first encrypted data packet;

[0022] The first encrypted data packet and the first key identifier corresponding to the first quantum key are sent to the second communication party, so that the second communication party applies the first quantum key corresponding to the first key identifier and a symmetric encryption algorithm to decrypt the first encrypted data packet, obtains the digital signature and the original message corresponding to the digital signature, applies the public key of the first communication party to decrypt the digital signature, obtains a first digest, applies the same hash function as the first communication party, calculates the original message, obtains a second digest, and determines that the digital signature of the first communication party is successfully verified when the first digest and the second digest are the same.

[0023] In one embodiment of the present disclosure, a digital signature and a message original are encrypted using a first quantum key and a symmetric cryptographic algorithm to obtain a first encrypted data packet, including:

[0024] The first quantum key and the symmetric cryptographic algorithm are used to encrypt the digital certificate, the original message and the digital signature of the first communication party to obtain a first encrypted data packet.

[0025] In one embodiment of the present disclosure, the method further includes:

[0026] Using a second quantum key and a symmetric cryptographic algorithm to encrypt the identity information of the first communication party and the public key of the first communication party to obtain a second encrypted data packet;

[0027] sending the second encrypted data packet and the second key identifier corresponding to the second quantum key to a certificate issuing authority, so that the certificate issuing authority decrypts the second encrypted data packet using the second quantum key and a symmetric cryptographic algorithm, obtains the identity information of the first communication party and the public key of the first communication party, verifies the identity information of the first communication party, and, if the verification is passed, issues a digital certificate including the public key to the first communication party;

[0028] Obtaining a third key identifier and a third encrypted data packet sent by a certificate issuing authority;

[0029] The third encrypted data packet is decrypted using a third quantum key and a symmetric cryptographic algorithm corresponding to the third key identifier to obtain a digital certificate.

[0030] According to another aspect of the present disclosure, a digital signature verification device is provided, the device being disposed at a second communication party, and the device comprising:

[0031] A data receiving module, configured to receive a first key identifier and a first encrypted data packet sent by a first communication party;

[0032] a first decryption module, configured to decrypt the first encrypted data packet using a first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm to obtain a digital signature and an original message corresponding to the digital signature;

[0033] a second decryption module, configured to decrypt the digital signature using the public key of the first communication party to obtain a first digest;

[0034] A first hash calculation module, configured to apply the same hash function as that used by the first communication party to calculate the original message to obtain a second digest;

[0035] The signature verification module is used to determine that the digital signature of the first communication party is successfully verified when the first digest and the second digest are the same.

[0036] According to another aspect of the present disclosure, a digital signature verification device is provided, the device being provided at a first communication party, and the device comprising:

[0037] A second hash calculation module, configured to apply a hash function to the original message to generate a first digest;

[0038] A first encryption module, configured to encrypt the first digest using a private key to obtain a digital signature;

[0039] A second encryption module is used to encrypt the original message and the digital signature using the first quantum key and the symmetric encryption algorithm to obtain a first encrypted data packet;

[0040] The data sending module is used to send the first encrypted data packet and the first key identifier corresponding to the first quantum key to the second communication party, so that the second communication party applies the first quantum key corresponding to the first key identifier and a symmetric encryption algorithm to decrypt the first encrypted data packet to obtain the digital signature and the original message corresponding to the digital signature, applies the public key of the first communication party to decrypt the digital signature to obtain a first digest, applies the same hash function as that of the first communication party to calculate the original message to obtain a second digest, and determines that the digital signature of the first communication party is successfully verified when the first digest and the second digest are the same.

[0041] According to another aspect of the present disclosure, an electronic device is provided, including: a memory for storing instructions; and a processor for calling the instructions stored in the memory to implement the above-mentioned digital signature verification method.

[0042] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which computer instructions are stored. When the computer instructions are executed by a processor, the above-mentioned digital signature verification method is implemented.

[0043] According to another aspect of the present disclosure, a computer program product is provided. The computer program product stores instructions, and when the instructions are executed by a computer, the computer implements the above-mentioned digital signature verification method.

[0044] According to yet another aspect of the present disclosure, there is provided a chip comprising at least one processor and an interface;

[0045] An interface for providing program instructions or data to at least one processor;

[0046] At least one processor is configured to execute program instructions to implement the above-mentioned digital signature verification method.

[0047] The digital signature verification method, apparatus, device, and medium provided by the embodiments of the present disclosure combine quantum key distribution with the traditional digital signature mechanism. The generation and distribution process of the quantum key theoretically provides an unbreakable security guarantee. The use of quantum keys to symmetric encrypt the digital signature and the original message can enhance the security of the transmission process. The digital signature is then decrypted using the public key of the first communication party, and the second digest of the message is recalculated and compared with the first digest in the decrypted digital signature. If the two digests are the same, it indicates that the message has not been tampered with and is indeed from the first communication party, thereby completing the digital signature verification process. In other words, the embodiments of the present disclosure utilize the security characteristics of quantum keys to protect encrypted communications, and achieve dual protection of sender identity authentication and message integrity through digital signatures, which not only improves the security of data transmission, but also ensures the authenticity and integrity of the message. In addition, through the application of symmetric encryption algorithms, the speed of encryption and decryption is also improved, which is suitable for secure communication scenarios that require efficient processing of large amounts of data.

[0048] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0050] Obviously, the drawings described below are only some embodiments of the present disclosure. A person skilled in the art can obtain other drawings based on these drawings without any creative effort.

[0051] Figure 1 A flow chart of a digital signature verification method performed by a second communication party in an embodiment of the present disclosure is shown;

[0052] Figure 2 A flow chart of a digital signature verification method performed by a first communication party in an embodiment of the present disclosure is shown;

[0053] Figure 3 A flowchart of obtaining a digital certificate in an embodiment of the present disclosure is shown;

[0054] Figure 4 A flow chart of a digital signature verification method according to an embodiment of the present disclosure is shown;

[0055] Figure 5 Another digital signature verification method flow chart is shown in the embodiment of the present disclosure;

[0056] Figure 6 A flow chart of another digital signature verification method according to an embodiment of the present disclosure is shown;

[0057] Figure 7 A schematic diagram illustrating the architecture of a digital signature system according to an embodiment of the present disclosure is shown;

[0058] Figure 8 A schematic diagram of a digital signature verification device according to an embodiment of the present disclosure is shown;

[0059] Figure 9 A schematic diagram of a digital signature verification device according to an embodiment of the present disclosure is shown;

[0060] Figure 10 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. The components of the embodiments of the present disclosure generally described and shown in the drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the disclosure for which protection is sought, but merely represents selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present disclosure.

[0062] Quantum Key Distribution (QKD) uses quantum states to encode information, enabling both communicating parties to generate the same key. Its security is based on the principles of quantum physics rather than the requirements and assumptions of mathematical computational complexity. Even when quantum computing technology matures, it has reliable security.

[0063] The digital signature verification method, apparatus, device, and medium provided by the embodiments of the present disclosure add quantum key encryption to hash calculation, digital signature, and signature verification, so that neither the public key nor the private key plaintext is transmitted over the network, and thus quantum computing will not be used to crack the private key based on the public key, thereby preventing the signature from being forged.

[0064] This exemplary implementation is described in detail below with reference to the accompanying drawings and examples.

[0065] Figure 1 A digital signature verification method according to an embodiment of the present disclosure is shown, and the digital signature verification method is executed by the second communication party, such as Figure 1 As shown, the digital signature verification method provided in the embodiment of the present disclosure includes S101-S105.

[0066] In S101, the second communication party receives a first key identifier and a first encrypted data packet sent by the first communication party.

[0067] The first key identifier corresponds to the first quantum key, and the second communication party can retrieve the corresponding first quantum key based on the first key identifier to decrypt the first encrypted data packet. The first encrypted data packet is encrypted by the first communication party using the first quantum key and a symmetric cryptographic algorithm.

[0068] It can be understood that the above-mentioned first communication party and second communication party correspond to the sending end and receiving end in the message transmission process respectively, and both are used to represent communication devices. The first communication party and the second communication party can specifically be servers, terminal devices, and clients, etc.

[0069] In S102, the second communication party applies the first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm to decrypt the first encrypted data packet to obtain the digital signature and the original message corresponding to the digital signature.

[0070] In S103, the second communication party uses the public key of the first communication party to decrypt the digital signature to obtain a first digest.

[0071] The digital signature is obtained by encrypting the first digest using the private key of the first communication party.

[0072] In S104, the second communication party applies the same hash function as the first communication party to calculate the original message to obtain a second digest.

[0073] In S105 , the second communication party determines that the digital signature of the first communication party is successfully verified if the first digest and the second digest are identical.

[0074] If the first key identifier and the first encrypted data packet are true and complete, then the first digest should be calculated by the first communication party using a hash function on the original message, and furthermore, the first digest should be the same as the second digest calculated in S104.

[0075] The disclosed embodiments leverage the security properties of quantum keys to protect encrypted communications and implement dual guarantees of sender authentication and message integrity through digital signatures. This not only enhances data transmission security but also ensures the authenticity and integrity of messages. Furthermore, the application of symmetric encryption algorithms increases encryption and decryption speeds, making it suitable for secure communications scenarios requiring efficient processing of large amounts of data.

[0076] In some embodiments, in S102, the second communication party applies the first quantum key corresponding to the first key identifier and the symmetric cryptographic algorithm to decrypt the first encrypted data packet, and also obtains the digital certificate of the first communication party. Before S103, the second communication party may also verify the digital certificate of the first communication party using the root certificate of the certificate issuing authority. In S103, the second communication party applies the public key of the first communication party to decrypt the digital signature to obtain the first digest. This may be done by applying the public key of the first communication party to decrypt the digital signature to obtain the first digest when the digital certificate of the first communication party is verified successfully.

[0077] In some embodiments, the second communication party and the first communication party share and synchronize quantum keys in the following ways: offline key injection or online real-time generation based on a quantum key distribution (QKD) network.

[0078] In the offline key filling method, quantum keys are pre-generated in a secure environment and stored on physical media (such as quantum USB drives or dedicated hardware devices), and then physically transported to the locations where the keys need to be used, namely the first and second communication parties.

[0079] Quantum Key Distribution (QKD) network-based online, real-time key generation is a process performed in real time over a quantum channel. The communicating parties utilize quantum systems, such as photons, to exchange information and establish a shared secret key based on the rules of quantum mechanics. This QKD network-based approach offers greater flexibility and immediacy, allowing both parties to generate new keys on demand at any time without relying on a pre-prepared key inventory.

[0080] Figure 2 A digital signature verification method according to an embodiment of the present disclosure is shown, and the digital signature verification method is executed by the first communication party, such as Figure 2 As shown, the digital signature verification method provided in the embodiment of the present disclosure includes S201-S204.

[0081] In S201, the first communication party applies a hash function to calculate the original message to generate a first digest.

[0082] A hash function is an algorithm that converts an input of arbitrary length (the original message) into an output of fixed length (a digest or hash value).

[0083] The above hash function can be one of the SHA-2 series (such as SHA-256, SHA-512), the SHA-3 series, BLAKE2 and BLAKE3.

[0084] The message original text may be data in any form, such as text files, binary data, etc.

[0085] In S202, the first communication party applies a private key to encrypt the first digest to obtain a digital signature.

[0086] In S203, the first communication party applies the first quantum key and the symmetric encryption algorithm to encrypt the original message and the digital signature to obtain a first encrypted data packet.

[0087] In S204, the first communication party sends the first encrypted data packet and the first key identifier corresponding to the first quantum key to the second communication party, so that the second communication party applies the first quantum key corresponding to the first key identifier and the symmetric encryption algorithm to decrypt the first encrypted data packet, obtains the digital signature and the original message corresponding to the digital signature, applies the public key of the first communication party to decrypt the digital signature to obtain a first digest, applies the same hash function as the first communication party to calculate the original message to obtain a second digest, and when the first digest and the second digest are the same, determines that the digital signature of the first communication party is successfully verified.

[0088] In some embodiments, the above-mentioned S203 first communication party applies the first quantum key and symmetric encryption algorithm to encrypt the digital signature and the original message to obtain a first encrypted data packet, which can be to apply the first quantum key and symmetric encryption algorithm to encrypt the digital certificate, original message and digital signature of the first communication party to obtain the first encrypted data packet.

[0089] In some embodiments, the digital signature verification method further includes a process of obtaining a digital certificate, such as Figure 3 As shown, the process of obtaining a digital certificate includes S301-S304.

[0090] In S301, the first communication party applies a second quantum key and a symmetric cryptographic algorithm to encrypt the identity information of the first communication party and the public key of the first communication party to obtain a second encrypted data packet;

[0091] In S302, the first communication party sends the second encrypted data packet and the second key identifier corresponding to the second quantum key to a certificate authority (CA), so that the certificate authority uses the second quantum key and a symmetric cryptographic algorithm to decrypt the second encrypted data packet, obtains the identity information of the first communication party and the public key of the first communication party, verifies the identity information of the first communication party, and issues a digital certificate containing the public key to the first communication party if the verification is passed;

[0092] In S303, the first communication party obtains the third key identifier and the third encrypted data packet sent by the certificate issuing authority;

[0093] In S304, the first communication party applies the third quantum key corresponding to the third key identifier and the symmetric cryptographic algorithm to decrypt the third encrypted data packet to obtain a digital certificate.

[0094] Figure 4 A digital signature verification method according to an embodiment of the present disclosure is shown. Figure 4 As shown, the digital signature verification method provided in the embodiment of the present disclosure includes S401-S408.

[0095] In S401, the first communication party applies a hash function to calculate the original message to generate a first digest;

[0096] In S402, the first communication party encrypts the first digest using a private key to obtain a digital signature;

[0097] In S403, the first communication party applies the first quantum key and the symmetric cryptographic algorithm to encrypt the original message and the digital signature to obtain a first encrypted data packet;

[0098] In S404, the first communication party sends the first key identifier and the first encrypted data packet to the second communication party;

[0099] In S405, the second communication party applies the first quantum key corresponding to the first key identifier and the symmetric cryptographic algorithm to decrypt the first encrypted data packet to obtain the digital signature and the original message corresponding to the digital signature;

[0100] In S406, the second communication party uses the public key of the first communication party to decrypt the digital signature to obtain a first digest;

[0101] In S407, the second communication party applies the same hash function as the first communication party to calculate the original message to obtain a second digest;

[0102] In S408 , if the first digest and the second digest are identical, the second communication party determines that the digital signature of the first communication party has been successfully verified.

[0103] Figure 5 A digital signature verification method according to an embodiment of the present disclosure is shown. Figure 5 As shown, the digital signature verification method provided in the embodiment of the present disclosure includes S501-S509.

[0104] In S501, the first communication party applies a hash function to calculate the original message to generate a first digest;

[0105] In S502, the first communication party encrypts the first digest using a private key to obtain a digital signature;

[0106] In S503, the first communication party encrypts the digital certificate, the message original text and the digital signature of the first communication party by using the first quantum key and the symmetric cipher algorithm to obtain a first encrypted data packet;

[0107] In S504, the first communication party sends the first key identifier and the first encrypted data packet to the second communication party;

[0108] In S505, the second communication party decrypts the first encrypted data packet by using the first quantum key corresponding to the first key identifier and the symmetric cipher algorithm to obtain the digital certificate, the message original text and the digital signature of the first communication party;

[0109] In S506, the second communication party verifies the digital certificate of the first communication party by using the root certificate of the certificate issuing authority;

[0110] In S507, when the digital certificate of the first communication party is verified, the second communication party decrypts the digital signature by using the public key of the first communication party to obtain a first digest;

[0111] In S508, the second communication party calculates a second digest by using the same hash function as that of the first communication party on the message original text;

[0112] In S509, the second communication party determines that the digital signature of the first communication party is verified successfully when the first digest is the same as the second digest.

[0113] Figure 6 A digital signature verification method is shown in the embodiments of the present disclosure, as shown in Figure 6 The digital signature verification method provided in the embodiments of the present disclosure includes S601-S617, wherein S609-S617 are the same as S501-S509, and will not be described here.

[0114] In S601, the first communication party encrypts the identity information of the first communication party and the public key of the first communication party by using the second quantum key and the symmetric cipher algorithm to obtain a second encrypted data packet;

[0115] In S602, the first communication party sends the second encrypted data packet and a second key identifier corresponding to the second quantum key to a certificate issuing authority (CA);

[0116] In S603, the certificate issuing authority decrypts the second encrypted data packet by using the second quantum key and the symmetric cipher algorithm to obtain the identity information of the first communication party and the public key of the first communication party;

[0117] In S604, the certificate issuing authority audits the identity information of the first communication party;

[0118] In S605, if the review is passed, the certificate issuing authority issues a digital certificate including the public key to the first communication party;

[0119] In S606, the certificate issuing authority applies the third quantum key and the symmetric cryptographic algorithm to encrypt the digital certificate including the public key to obtain a third encrypted data packet;

[0120] In S607, the certificate issuing authority sends the third key identifier and the third encrypted data packet corresponding to the third quantum key to the first communication party;

[0121] In S608, the first communication party applies the third quantum key and the symmetric cryptographic algorithm to decrypt the third encrypted data packet to obtain a digital certificate.

[0122] Figure 7 A digital signature system according to an embodiment of the present disclosure is shown. Figure 7 As shown, the digital signature system includes a server 701, a client 702, and a certificate issuing authority 703. The server 701 may be the first communication party in the above embodiment, and the client 702 may be the second communication party in the above embodiment. The devices corresponding to the server 701, the client 702, and the certificate issuing authority 703 are all equipped with a quantum key module and an encryption and decryption module.

[0123] The quantum key module is used for quantum key generation, distribution, and retrieval. Quantum keys can be generated and distributed using either offline key injection or online, real-time generation over a QKD network. This module enables end-to-end quantum key sharing and synchronization. The quantum key module can retrieve the corresponding quantum key based on the quantum key identifier, for example, retrieving the first quantum key based on the first key identifier.

[0124] The encryption and decryption module is used to encrypt and decrypt communication messages using a symmetric cryptographic algorithm based on the shared quantum key of the communicating parties.

[0125] Indicates that the quantum key K is used i And the symmetric encryption algorithm Enc_s is used to encrypt the information composed of m1, m2 and m3 in sequence.

[0126] It should be noted that Figure 7 Although not shown in the figure, the devices corresponding to the server 701, the client 702 and the certificate issuing authority 703 are also provided with a hash calculation module, a digital signature module and a signature verification module.

[0127] The hash calculation module performs hash calculation on the data to generate a summary; the digital signature module uses the private key and asymmetric cryptographic algorithm to encrypt the data; the signature verification module uses the public key corresponding to the private key and the asymmetric cryptographic algorithm to decrypt the data.

[0128] The digital signature system provided by the embodiments of the present disclosure can implement quantum computing-resistant digital signatures between the CA organization and the client, and between the server and the client in the digital signature process without changing the overall process and data structure of the traditional CA and the digital signature system based on digital certificates.

[0129] In the embodiments of the present disclosure, the terms “first,” “second,” and “third” are used for descriptive purposes only and should not be understood as indicating or implying relative importance.

[0130] In this disclosure, the term "and / or" simply describes an association relationship between related objects, indicating that three possible relationships exist. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this document generally indicates that the related objects are in an "or" relationship.

[0131] Furthermore, although the steps of the methods of the present disclosure are depicted in a particular order in the drawings, this does not require or imply that the steps must be performed in this particular order, or that all illustrated steps must be performed to achieve desired results.

[0132] In some embodiments, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0133] Based on the same inventive concept, a digital signature verification device is also provided in the embodiment of the present disclosure. The device is set at the second communication party, such as Figure 8 As shown, the digital signature verification device includes a data receiving module 801 , a first decryption module 802 , a second decryption module 803 , a first hash calculation module 804 and a signature verification module 805 .

[0134] The data receiving module 801 is configured to receive a first key identifier and a first encrypted data packet sent by a first communication party;

[0135] A first decryption module 802 is configured to decrypt the first encrypted data packet using a first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm to obtain a digital signature and an original message corresponding to the digital signature;

[0136] A second decryption module 803 is configured to decrypt the digital signature using the public key of the first communication party to obtain a first digest;

[0137] A first hash calculation module 804 is configured to apply the same hash function as that used by the first communication party to calculate the original message to obtain a second digest;

[0138] The signature verification module 805 is configured to determine that the digital signature of the first communication party has been successfully verified if the first digest and the second digest are identical.

[0139] In some embodiments, the first decryption module 802 applies the first quantum key corresponding to the first key identifier and the symmetric encryption algorithm to decrypt the first encrypted data packet, and also obtains the digital certificate of the first communication party; the above-mentioned digital signature verification device also includes a certificate verification module.

[0140] a certificate verification module, configured to verify the digital certificate of the first communication party using the root certificate of the certificate issuing authority;

[0141] The second decryption module 803 is configured to decrypt the digital signature using the public key of the first communication party to obtain the first digest when the digital certificate of the first communication party is verified successfully.

[0142] In some embodiments, the second communication party and the first communication party share and synchronize quantum keys in the following ways: offline key injection or online real-time generation based on a quantum key distribution network.

[0143] Based on the same inventive concept, the embodiment of the present disclosure further provides a digital signature verification device, which is set at the first communication party, such as Figure 9 As shown, the digital signature verification device includes a second hash calculation module 901 , a first encryption module 902 , a second encryption module 903 and a data sending module 904 .

[0144] A second hash calculation module 901 is configured to apply a hash function to the original message to generate a first digest;

[0145] A first encryption module 902 is configured to encrypt the first digest using a private key to obtain a digital signature;

[0146] The second encryption module 903 is configured to encrypt the original message and the digital signature using the first quantum key and the symmetric encryption algorithm to obtain a first encrypted data packet;

[0147] The data sending module 904 is used to send the first encrypted data packet and the first key identifier corresponding to the first quantum key to the second communication party, so that the second communication party applies the first quantum key corresponding to the first key identifier and the symmetric encryption algorithm to decrypt the first encrypted data packet, obtain the digital signature and the original message corresponding to the digital signature, apply the public key of the first communication party to decrypt the digital signature to obtain a first digest, apply the same hash function as the first communication party to calculate the original message to obtain a second digest, and determine that the digital signature of the first communication party is successfully verified when the first digest and the second digest are the same.

[0148] In some embodiments, the second encryption module 903 is used to apply the first quantum key and the symmetric encryption algorithm to encrypt the digital certificate, the original message and the digital signature of the first communication party to obtain a first encrypted data packet.

[0149] In some embodiments, the digital signature verification device further includes a certificate acquisition module.

[0150] The certificate acquisition module is used to apply a second quantum key and a symmetric cryptographic algorithm to encrypt the identity information and the public key of the first communication party to obtain a second encrypted data packet; send the second encrypted data packet and a second key identifier corresponding to the second quantum key to a certificate issuing authority, so that the certificate issuing authority applies the second quantum key and the symmetric cryptographic algorithm to decrypt the second encrypted data packet to obtain the identity information and the public key of the first communication party, review the identity information of the first communication party, and if the review is passed, issue a digital certificate containing the public key to the first communication party; obtain a third key identifier and a third encrypted data packet sent by the certificate issuing authority; and decrypt the third encrypted data packet using a third quantum key corresponding to the third key identifier and a symmetric cryptographic algorithm to obtain a digital certificate.

[0151] The concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0152] Regarding the digital signature verification device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the digital signature verification method, and will not be elaborated here.

[0153] It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, such division is not mandatory.

[0154] In fact, according to the embodiment of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0155] Some of the blocks shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0156] Refer to the following Figure 10 To describe the electronic device provided by the embodiment of the present disclosure. Figure 10 The electronic device 1000 shown is merely an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0157] Figure 10 FIG. 1 shows a schematic diagram of the architecture of an electronic device 1000 provided by an embodiment of the present invention. Figure 10 As shown, the electronic device 1000 includes but is not limited to: at least one processor 1010 and at least one memory 1020.

[0158] The memory 1020 is used to store instructions.

[0159] In some embodiments, the memory 1020 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 10201 and / or a cache memory unit 10202 , and may further include a read-only memory unit (ROM) 10203 .

[0160] In some embodiments, the memory 1020 may also include a program / utility 10204 having a set (at least one) of program modules 10205, such program modules 10205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0161] In some embodiments, the memory 1020 may store an operating system, which may be a real-time operating system (RTX), LINUX, UNIX, WINDOWS, or OS X.

[0162] In some embodiments, data may also be stored in the memory 1020 .

[0163] As an example, the processor 1010 may read data stored in the memory 1020 . The data may be stored at the same storage address as the instruction, or the data may be stored at a different storage address from the instruction.

[0164] Processor 1010 is configured to call instructions stored in memory 1020 to implement the steps described in the "Exemplary Method" section above according to various exemplary embodiments of the present disclosure. For example, processor 1010 may execute the steps of the aforementioned digital signature verification method embodiment.

[0165] It should be noted that the processor 1010 may be a general-purpose processor or a dedicated processor. The processor 1010 may include one or more processing cores, and the processor 1010 executes various functional applications and data processing by running instructions.

[0166] In some embodiments, the processor 1010 may include a central processing unit (CPU) and / or a baseband processor.

[0167] In some embodiments, the processor 1010 may determine an instruction based on the priority identifier and / or function category information carried in each control instruction.

[0168] In the present disclosure, the processor 1010 and the memory 1020 may be provided separately or integrated together.

[0169] As an example, the processor 1010 and the memory 1020 may be integrated on a single board or a system on chip (SOC).

[0170] like Figure 10 As shown, the electronic device 1000 is implemented as a general-purpose computing device. The electronic device 1000 may further include a bus 1030 .

[0171] The bus 1030 may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0172] The electronic device 1000 may also communicate with one or more external devices 1040 (e.g., a keyboard, a pointing device, a Bluetooth device, etc.), one or more devices that enable a user to interact with the electronic device 1000, and / or any device that enables the electronic device 1000 to communicate with one or more other computing devices (e.g., a router, a modem, etc.). Such communication may be performed through an input / output (I / O) interface 1050.

[0173] Furthermore, the electronic device 1000 can also communicate with one or more networks (eg, a local area network (LAN), a wide area network (WAN) and / or a public network, such as the Internet) through the network adapter 1060 .

[0174] like Figure 10 As shown, the network adapter 1060 communicates with other modules of the electronic device 1000 via the bus 1030 .

[0175] It should be understood that although not shown in the figures, other hardware and / or software modules may be used in conjunction with the electronic device 1000, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0176] It is understood that the structure shown in the embodiment of the present disclosure does not constitute a specific limitation on the electronic device 1000. In other embodiments of the present disclosure, the electronic device 1000 may include Figure 10 More or fewer components may be shown, or some components may be combined or separated, or the components may be arranged differently. Figure 10 The components shown can be implemented in hardware, software, or a combination of software and hardware.

[0177] The present disclosure also provides a computer-readable storage medium having computer instructions stored thereon. When the computer instructions are executed by a processor, the digital signature verification method described in the above method embodiment is implemented.

[0178] The computer-readable storage medium in the embodiments of the present disclosure is a computer instruction that can be sent, propagated or transmitted for use by or in conjunction with an instruction execution system, apparatus or device.

[0179] As an example, computer readable storage media are non-volatile storage media.

[0180] In some embodiments, more specific examples of computer-readable storage media in the present disclosure may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, a USB flash drive, a mobile hard disk, or any suitable combination of the foregoing.

[0181] In the embodiments of the present disclosure, the computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer instructions (readable program codes).

[0182] Such a propagated data signal may take any of a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof.

[0183] In some examples, computing instructions contained on a computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0184] The embodiments of the present disclosure further provide a computer program product, which stores instructions. When the instructions are executed by a computer, the computer implements the digital signature verification method described in the above method embodiment.

[0185] The above instructions may be program codes. In specific implementation, the program codes may be written in any combination of one or more programming languages.

[0186] Programming languages ​​include object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages.

[0187] The program code may execute entirely on the user's computing device, partly on the user's computing device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server.

[0188] Where a remote computing device is involved, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0189] The embodiment of the present disclosure further provides a chip, comprising at least one processor and an interface;

[0190] An interface for providing program instructions or data to at least one processor;

[0191] At least one processor is used to execute program instructions to implement the digital signature verification method described in the above method embodiment.

[0192] In some embodiments, the chip may further include a memory for storing program instructions and data, and the memory may be located inside or outside the processor.

[0193] Those skilled in the art will appreciate that all or part of the steps for implementing the above embodiments may be implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation combining hardware and software, which may be collectively referred to herein as a "circuit," "module," or "system."

[0194] Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein.

[0195] This disclosure is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered as exemplary only, with the true scope and spirit of the present disclosure being indicated by the appended claims.

Claims

1. A digital signature verification method, characterized in that: The method is performed by the second communication party, and the method includes: receiving a first key identifier and a first encrypted data packet sent by a first communication party; decrypting the first encrypted data packet using a first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm to obtain a digital signature and an original message corresponding to the digital signature; Decrypting the digital signature using the public key of the first communication party to obtain a first digest; Applying the same hash function as that used by the first communication party to calculate the original message to obtain a second digest; When the first digest and the second digest are identical, it is determined that the digital signature verification of the first communication party is successful.

2. The method according to claim 1, characterized in that The method further comprises: decrypting the first encrypted data packet by applying the first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm, and obtaining a digital certificate of the first communicating party; Verifying the digital certificate of the first communication party using the root certificate of the certificate issuing authority; The applying the public key of the first communication party to decrypt the digital signature to obtain the first summary includes: when the digital certificate of the first communication party is verified, applying the public key of the first communication party to decrypt the digital signature to obtain the first summary.

3. The method according to claim 1, characterized in that The second communication party and the first communication party share and synchronize the quantum key in the following manner: Offline key injection method or online real-time generation method based on quantum key distribution network.

4. A digital signature verification method, characterized in that: The method is performed by a first communication party, and includes: Applying a hash function to the original message to generate a first digest; Encrypting the first digest using a private key to obtain a digital signature; Encrypting the original message and the digital signature using a first quantum key and a symmetric cryptographic algorithm to obtain a first encrypted data packet; The first encrypted data packet and the first key identifier corresponding to the first quantum key are sent to a second communication party, so that the second communication party applies the first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm to decrypt the first encrypted data packet to obtain a digital signature and a message original corresponding to the digital signature, applies the public key of the first communication party to decrypt the digital signature to obtain a first digest, applies the same hash function as that of the first communication party to calculate the message original to obtain a second digest, and determines that the digital signature of the first communication party is successfully verified if the first digest and the second digest are the same.

5. The method according to claim 4, characterized in that The applying the first quantum key and the symmetric cryptographic algorithm to encrypt the digital signature and the original message to obtain a first encrypted data packet includes: A first quantum key and a symmetric cryptographic algorithm are used to encrypt the digital certificate of the first communication party, the original message, and the digital signature to obtain a first encrypted data packet.

6. The method according to claim 5, characterized in that The method further comprises: encrypting the identity information of the first communication party and the public key of the first communication party using a second quantum key and a symmetric cryptographic algorithm to obtain a second encrypted data packet; sending the second encrypted data packet and the second key identifier corresponding to the second quantum key to a certificate issuing authority, so that the certificate issuing authority uses the second quantum key and the symmetric cryptographic algorithm to decrypt the second encrypted data packet, obtain the identity information of the first communication party and the public key of the first communication party, review the identity information of the first communication party, and, if the review is passed, issue a digital certificate containing the public key to the first communication party; Obtaining a third key identifier and a third encrypted data packet sent by the certificate issuing authority; The third encrypted data packet is decrypted using a third quantum key corresponding to the third key identifier and the symmetric cryptographic algorithm to obtain the digital certificate.

7. A digital signature verification device, characterized in that: The device is provided at the second communication party, and the device includes: A data receiving module, configured to receive a first key identifier and a first encrypted data packet sent by a first communication party; a first decryption module, configured to decrypt the first encrypted data packet using a first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm to obtain a digital signature and an original message corresponding to the digital signature; a second decryption module, configured to decrypt the digital signature using the public key of the first communication party to obtain a first digest; a first hash calculation module, configured to apply the same hash function as that of the first communication party to calculate the original message to obtain a second digest; The signature verification module is used to determine that the digital signature of the first communication party is successfully verified when the first digest and the second digest are the same.

8. A digital signature verification device, characterized in that: The device is provided at the first communication party, and the device includes: A second hash calculation module, configured to apply a hash function to the original message to generate a first digest; A first encryption module, configured to encrypt the first digest using a private key to obtain a digital signature; a second encryption module, configured to encrypt the original message and the digital signature using a first quantum key and a symmetric cryptographic algorithm to obtain a first encrypted data packet; A data sending module is configured to send the first encrypted data packet and the first key identifier corresponding to the first quantum key to a second communication party, so that the second communication party applies the first quantum key corresponding to the first key identifier and a symmetric cryptographic algorithm to decrypt the first encrypted data packet to obtain a digital signature and a message original corresponding to the digital signature, decrypt the digital signature using the public key of the first communication party to obtain a first digest, and calculate the message original using the same hash function as that of the first communication party to obtain a second digest. If the first digest and the second digest are the same, it is determined that the digital signature of the first communication party has been successfully verified.

9. An electronic device, characterized in that: include: a memory for storing instructions; A processor, configured to call instructions stored in the memory to implement the digital signature verification method according to any one of claims 1 to 6.

10. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed by a processor, the digital signature verification method according to any one of claims 1 to 6 is implemented.

Images