MQTT connection method and system based on quantum key

Abstract

The invention discloses an MQTT connection method and system based on a quantum key, and the method comprises the following steps: obtaining the quantum key, and enabling a client to output encryption authentication information to a server based on the quantum key; the server decrypts the encrypted authentication information based on the quantum key, performs authentication information matching according to a decryption result, and performs primary identity authentication between the server and the client based on the digital signature if matching succeeds; if the primary identity authentication is passed, the client encrypts user information in the MQTT protocol based on the quantum key, and outputs the encrypted user information to the server; the server decrypts the encrypted user information based on the quantum key and executes secondary identity authentication according to a decryption result; and if the secondary identity authentication is passed, constructing MQTT connection between the client and the server. The method has the beneficial effects that the connection accuracy between the client and the server and the user information security are ensured, and both the connection security and the connection efficiency are considered.

Description

Technical Field

[0001] The present application relates to the field of MQTT technology, and in particular to a MQTT connection method and system based on quantum key. Background Art

[0002] After decades of rapid development, the Internet of Things (IoT) technology has been increasingly applied to all aspects of life. According to statistics, it is estimated that by 2030, the number of devices connected to the IoT will reach 50 billion. With the rapid increase of IoT devices, the IoT environment has become more and more complex. Therefore, communication protocols suitable for various IoT environments have been proposed one after another. Message Queuing Telemetry Transport (MQTT) is a message transmission protocol based on the agent-based publish / subscribe mode. It is an application layer protocol on top of the TCP / IP protocol. Because of its lightweight, simple, open and easy-to-implement characteristics, it is suitable for IoT scenarios with low power consumption and limited network bandwidth. It has become one of the popular communication protocols in the IoT. The MQTT protocol is now widely used in many aspects such as smart medical care, smart home, and smart vehicles. The traditional MQTT protocol has two security issues: 1) Lack of effective identity authentication. The MQTT server can authenticate the identity of the connected client through the username and password, but the username and password are transmitted in plain text, and attackers can easily impersonate the real user identity. 2) The message content of the topic is transmitted in plain text. The content of the topic messages of the MQTT protocol is transmitted in plain text, which makes the security of the protocol data unguaranteed. In order to improve the security of the MQTT protocol, the Organization for the Promotion of Structured Information Standards proposed that SSL / TLS can be used to solve the security issues of the MQTT protocol. Although this solution provides a security protection mechanism, the digital certificate management and verification involved in it bring a lot of computing and communication overhead, and the algorithms involved are all based on international standard algorithms for computational complexity. If an eavesdropper has huge computing power, such as a quantum computer, he can crack the key, thereby threatening the security and confidentiality of the MQTT protocol.

[0003] The patent "A communication method based on MQTT protocol and resistant to quantum attack", publication number: CN117176340A, publication date: December 5, 2023, specifically discloses that identity authentication includes: the server generates a public key and a private key; receives a first ciphertext, the first ciphertext is the first ciphertext generated by the client randomly encrypting a random number according to the public key; uses the private key to decrypt the first ciphertext to generate a shared key; receives a link data request; the link data request includes a second ciphertext, the second ciphertext is the second ciphertext generated by the client symmetrically encrypting the username and password through the shared key; decrypts the second ciphertext to obtain the decrypted username and password, and when they match, the identity authentication is passed. Message transmission includes: the receiver receives the first message and the signature; the signature is the signature generated by signing the first message with the private key generated by the sender; the signature is decrypted by the public key generated by the sender to obtain the second message; when the first message is consistent with the second message, the message verification is completed. This scheme combines asymmetric encryption (public key and private key) and symmetric encryption (shared key), but the implementation is relatively complex and the amount of calculation is large. Summary of the invention

[0004] In view of the fact that the existing technology cannot balance the efficiency and security of the communication connection between the client and the server, the present application provides an MQTT connection method and system based on quantum key, which utilizes the unconditional security of quantum key to encrypt the authentication information and user information output by the client to prevent the leakage of user information during transmission. At the same time, digital signature and user information authentication are used to realize two-way authentication between the client and the server, which can not only ensure the connection accuracy and user information security between the client and the server, but also utilize the rapidity of quantum key distribution and the rapid verification of digital signatures to improve the efficiency of secondary authentication, thus achieving a balance between connection security and connection efficiency.

[0005] To achieve the above technical objectives, a technical solution provided by the present application is a MQTT connection method based on quantum key, comprising the following steps: obtaining a quantum key, and the client outputs encrypted authentication information to a server based on the quantum key; the server decrypts the encrypted authentication information based on the quantum key, and performs authentication information matching based on the decryption result. If the match is successful, a one-time identity authentication is performed between the server and the client based on the digital signature; if the one-time identity authentication passes, the client encrypts the user information in the MQTT protocol based on the quantum key, and outputs the encrypted user information to the server; the server decrypts the encrypted user information based on the quantum key, and performs a second identity authentication based on the decryption result; if the second identity authentication passes, an MQTT connection is established between the client and the server.

[0006] Furthermore, the one-time identity authentication between the server and the client based on the digital signature includes: the server sends the server digital signature encrypted based on the quantum key to the client, the client decrypts the server digital signature encrypted based on the quantum key, and verifies the server digital signature; if the verification is successful, the client sends the client digital signature encrypted based on the quantum key to the server, the server decrypts the client digital signature encrypted based on the quantum key, and verifies the client digital signature; if the verification is successful, the one-time identity authentication is successful.

[0007] Furthermore, the client encrypts user information in the MQTT protocol based on the quantum key, and outputs the encrypted user information to the server, including: the client encrypts the user name and user password in the MQTT protocol based on the quantum key; puts the encrypted user name and encrypted user password into a preset position in the CONNECT data packet; and sends the CONNECT data packet to the server.

[0008] Furthermore, it also includes: using the quantum key as the encryption key of the data encryption protocol in the MQTT protocol to build an MQTT connection between the client and the server.

[0009] Furthermore, the obtaining of the quantum key also includes: obtaining, based on a quantum key distribution protocol, a first quantum key shared between the publisher and the server, a second quantum key shared between the subscriber and the server, and a third quantum key shared between the publisher and the subscriber.

[0010] Furthermore, the client outputs encrypted authentication information to the server based on the quantum key, and further includes: the publisher uses the first quantum key to encrypt the publisher authentication information and output it to the server; the subscriber uses the second quantum key to encrypt the subscriber authentication information and output it to the server.

[0011] Furthermore, the client encrypts user information in the MQTT protocol based on the quantum key, including: the publisher uses the first quantum key to encrypt the user information in the MQTT protocol and outputs it to the server; the subscriber uses the second quantum key to encrypt the user information in the MQTT protocol and outputs it to the server.

[0012] Furthermore, it also includes: when the subscriber sends subscription information to the server, the publisher encrypts the published information based on the third quantum key and outputs it to the server; the server forwards the encrypted published information to the subscriber; the subscriber decrypts the encrypted published information based on the third quantum key and extracts the published information.

[0013] Furthermore, the publishing end encrypts the publishing information based on the third quantum key and outputs it to the server, including: the publishing end encrypts the subject message content based on the third quantum key; puts the encrypted content into a preset position of the PUBLISH data packet; and sends the PUBLISH data packet to the server.

[0014] Another technical solution provided by the present application is a quantum key-based MQTT connection system, which is connected to a client and a server and is used to implement the above method, including: a quantum key generation center, which is used to generate quantum keys according to the client and the server.

[0015] The beneficial effects of this application are: 1. Since the client and the server perform digital signatures based on quantum keys, the identity authentication between the client and the server is unconditionally secure, and after completing the first identity authentication, the server further verifies the client's username and password to complete the second identity authentication. The username and password are transmitted in the form of ciphertext encrypted with the quantum key, so attackers cannot obtain information such as username and password, thereby achieving two secure identity authentications.

[0016] 2. By using ID information to authenticate the client through the server and digital signatures to authenticate the server through the client, different forms of two-way authentication are adopted, so that the client will not obtain the preset matching information on the server and the server will not obtain the digital signature on the client, thereby avoiding information leakage. When the server is an abnormal server, it is impossible to know the sent digital signature based on the ID information. When the client is an abnormal client, it is impossible to match the server's ID. At the same time, the verification complexity is reduced, and the connection efficiency and connection security are improved in both directions. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a flowchart of a MQTT connection method based on quantum key in this application.

[0018] Figure 2 This is an interactive framework diagram of an MQTT connection method based on quantum key for this application.

[0019] Figure 3 This is a connection diagram of a MQTT connection system based on quantum key in this application. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solutions and advantages of the present application more clear, the present application is further described in detail below in conjunction with the drawings and examples. It should be understood that the specific implementation method described here is only an optimal embodiment of the present application, which is only used to explain the present application and does not limit the scope of protection of the present application. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0021] like Figure 1 As shown, as the first embodiment of the present application, a MQTT connection method based on quantum key includes the following steps: Obtain the quantum key, and the client outputs encrypted authentication information to the server based on the quantum key; The server decrypts the encrypted authentication information based on the quantum key, and performs authentication information matching based on the decryption result. If the match is successful, an identity authentication is performed between the server and the client based on the digital signature; If the identity authentication is successful once, the client encrypts the user information in the MQTT protocol based on the quantum key and outputs the encrypted user information to the server; The server decrypts the encrypted user information based on the quantum key and performs secondary identity authentication based on the decryption result; If the secondary identity authentication passes, an MQTT connection is established between the client and the server.

[0022] Quantum Key Distribution (QKD) is based on quantum theory and can distribute security keys securely and in real time over unsecured public channels. Therefore, by combining quantum key distribution with a one-time encryption method to achieve quantum secure confidential communication, unconditionally secure confidential communication can be perfectly achieved. In this embodiment, the authentication information and user information output by the client are encrypted using the unconditional security of the quantum key to prevent leakage of user information during transmission. At the same time, digital signatures and user information authentication are used to achieve two-way authentication between the client and the server, which can ensure the connection accuracy between the client and the server and the security of user information, and utilize the rapidity of quantum key distribution and the rapid verification of digital signatures to improve the efficiency of secondary authentication, achieving a balance between connection security and connection efficiency.

[0023] Specifically, the authentication information at least includes ID information, and the corresponding server at least pre-stores matching information corresponding to the ID information. At this time, the quantum key is obtained, and the client uses the quantum key to encrypt its own ID information and sends it to the server. The server decrypts the encrypted information, obtains the client ID information, and compares it with the matching information. If the client ID information exists in the matching information, it is considered that the match is successful. Performing authentication information matching according to the decryption result includes: Determine whether the decryption result matches the pre-stored matching information. If so, the match is considered successful; if not, the match is considered failed.

[0024] The pre-stored matching information may be a local identity list. If the client ID information exists in the local identity list, the match is considered successful and an identity authentication is performed; if the client ID information does not exist in the local identity list, the match is considered failed. When the match fails, the client is considered abnormal and an alarm is issued to facilitate the server to detect malicious connections. Of course, in other embodiments, the authentication information may also be other information, such as dynamic token information, geographic location information, etc.

[0025] Then, the server and the client perform an identity authentication between the client and the server through the digital signature technology based on quantum key. The digital signature technology based on quantum key, namely quantum digital signature (Quantum Digital Signatures, QDS), is a digital signature method implemented by the principles of quantum mechanics. The identity authentication between the server and the client based on digital signature includes: The server sends the server digital signature encrypted based on the quantum key to the client, and the client decrypts the server digital signature encrypted based on the quantum key and verifies the server digital signature; If the verification is successful, the client sends the client digital signature encrypted based on the quantum key to the server, and the server decrypts the client digital signature encrypted based on the quantum key and verifies the client digital signature; If the verification is successful, the identity authentication is successful.

[0026] In this embodiment, two-way authentication between the server and the client is achieved through quantum digital signature technology to ensure the confidentiality and integrity of data during transmission.

[0027] In other embodiments, since the server has already matched the client once based on the ID information encrypted by the quantum key in the early stage, at this time, the identity authentication between the server and the client based on the digital signature only includes: the server sends the server digital signature encrypted based on the quantum key to the client, and the client decrypts the server digital signature encrypted based on the quantum key and verifies the server digital signature. If the client passes the server digital signature authentication, it is considered that the identity authentication has passed. By using ID information to realize the server's authentication of the client and using digital signatures to realize the client's authentication of the server, different forms of two-way authentication are adopted, so that the client will not obtain the preset matching information on the server and the server will not obtain the digital signature on the client, thereby avoiding information leakage. When the server is an abnormal server, it is impossible to know the sent digital signature based on the ID information. When the client is an abnormal client, it is impossible to match the server's ID. At the same time, the verification complexity is reduced, and the connection efficiency and connection security are improved in both directions.

[0028] User information includes at least user name and user password. At this time, the client encrypts the user information in the MQTT protocol based on the quantum key, and outputs the encrypted user information to the server including: The client encrypts the user name and password in the MQTT protocol based on the quantum key; Put the encrypted user name and encrypted user password into the preset position in the CONNECT data packet; Send a CONNECT packet to the server.

[0029] The CONNECT packet is a packet used in the MQTT protocol to establish a connection between the client and the server. The CONNECT packet contains three parts: a fixed header, a variable header, and a payload. In this embodiment, the preset position is the payload part, and the payload contains fields such as an identifier, and optional fields determined by the flag bit in the variable header, such as a user name, a password, a will subject, and a will message.

[0030] The client uses the quantum key to encrypt the username and password in the MQTT protocol, puts them in the corresponding position in the CONNECT data packet and sends them to the server. After receiving the CONNECT data packet, the server verifies the username and password information and completes the second authentication of the client. Since the client and the server perform digital signatures based on quantum keys, the authentication between the client and the server is unconditionally secure, and after completing the first authentication, the server further verifies the client's username and password to complete the second authentication. The username and password are transmitted in the form of ciphertext encrypted with the quantum key, so attackers cannot obtain information such as username and password, thereby achieving two secure authentications.

[0031] like Figure 2 As shown, as the second embodiment of the present application, a MQTT connection method based on quantum key also includes: using the quantum key as the encryption key of the data encryption protocol in the MQTT protocol to establish an MQTT connection between the client and the server.

[0032] In this embodiment, the subject message content and other data of the data packet in the MQTT protocol are encrypted by quantum key to ensure the security of data transmission.

[0033] Specifically, obtaining the quantum key also includes: Based on the quantum key distribution protocol, a first quantum key shared between the publisher and the server, a second quantum key shared between the subscriber and the server, and a third quantum key shared between the publisher and the subscriber are obtained.

[0034] The client includes a publisher and a subscriber. The server is responsible for forwarding messages. The publisher is responsible for publishing messages to the server, and the subscriber is responsible for receiving messages from the server. The quantum key generation center sends quantum keys to the client and server that have established communication connections in advance. Through quantum key distribution protocols such as the BB84 protocol, the measurement device-independent quantum key distribution protocol (MDI-QKD), and the send and non-send dual-field quantum key distribution protocol (SNS-TF-QKD), the first quantum key KEY1 is shared between the publisher and the server, the second quantum key KEY2 is shared between the subscriber and the server, and the third quantum key KEY3 is shared between the publisher and the subscriber. Different ends can verify each other to ensure the security of information transmission.

[0035] The client outputs encrypted authentication information to the server based on the quantum key and also includes: The publisher uses the first quantum key to encrypt the publisher authentication information and output it to the server; The subscriber uses the second quantum key to encrypt the subscriber authentication information and output it to the server.

[0036] When the authentication information is ID information, the publisher uses quantum key KEY1 to encrypt its own ID information and sends it to the server, and the subscriber uses quantum key KEY2 to encrypt its own ID information and sends it to the server.

[0037] At this point, the server decrypts the encrypted authentication information based on the quantum key, including: The server decrypts the encrypted issuing end authentication information based on the first quantum key; The server decrypts the encrypted subscriber authentication information based on the second quantum key.

[0038] Performing authentication information matching based on the decryption result includes: A primary authentication information match is performed based on the decrypted publisher authentication information, and a secondary authentication information match is performed based on the decrypted subscriber authentication information. The match is considered successful only when both the primary authentication information match and the secondary authentication information match are successful.

[0039] The server decrypts the encrypted information, obtains the publisher ID information and the subscriber ID information, and compares them with the local identity list. If the publisher ID information and the subscriber ID information exist in the local identity list, the server and the client are matched successfully.

[0040] Correspondingly, the client encrypts user information in the MQTT protocol based on the quantum key, including: The publisher uses the first quantum key to encrypt the user information in the MQTT protocol and output it to the server; The subscriber uses the second quantum key to encrypt the user information in the MQTT protocol and output it to the server.

[0041] The server decrypts the encrypted user information based on the quantum key, and performs secondary identity authentication based on the decryption result, which also includes: The server decrypts the encrypted user information output by the publisher based on the first quantum key to obtain a first decryption result; The server decrypts the encrypted user information output by the subscriber based on the second quantum key to obtain a second decryption result; A secondary identity authentication is performed using the first decryption result and the second decryption result.

[0042] In this embodiment, the secondary identity authentication is considered to be successful only when the first decryption result and the second decryption result both match the secondary authentication information pre-stored in the server. By authenticating the output information of the client's publishing and subscription ends twice, it is ensured that the client is not an abnormal end, thereby improving the connection security.

[0043] Similarly, an identity authentication between a server and a client based on a digital signature also includes: The server sends the server digital signature encrypted based on the quantum key to the publisher and subscriber respectively. The publisher and subscriber respectively decrypt the server digital signature encrypted based on the quantum key and verify the server digital signature; If the verification is successful, the publisher and subscriber will respectively send the publisher's digital signature and subscriber's digital signature encrypted based on the quantum key to the server. The server will decrypt the publisher's digital signature and subscriber's digital signature encrypted based on the quantum key, and verify the publisher's digital signature and subscriber's digital signature.

[0044] It is understandable that in this embodiment and the first embodiment, the client may first issue a digital signature, and after the server receives and verifies the digital signature, it sends the server digital signature to the client for verification.

[0045] A quantum key-based MQTT connection method also includes: When the subscriber sends subscription information to the server, the publisher encrypts the published information based on the third quantum key and outputs it to the server; The server forwards the encrypted publishing information to the subscriber; The subscriber decrypts the encrypted publication information based on the third quantum key and extracts the publication information.

[0046] In this embodiment, when the subscriber sends a SUBSCRIBE packet to the server, it subscribes to the topic. The publisher obtains the third quantum key KEY3, encrypts the published information, forms a PUBLISH packet, and sends it to the server. The server directly forwards the PUBLISH packet to the subscriber. After receiving the PUBLISH packet forwarded by the server, the subscriber uses the third quantum key KEY3 to decrypt and extract the published information.

[0047] The published information is data corresponding to the subscription information. For example, when the subscription information is a topic, the published information is the content of the topic message. The publishing end encrypts the published information based on the third quantum key and outputs it to the server, including: The publisher encrypts the subject message content based on the third quantum key; Put the encrypted content into the preset location of the PUBLISH data packet; Send a PUBLISH packet to the server.

[0048] In other cases, a quantum key-based MQTT connection method further includes: When the subscriber sends a cancel subscription message to the server, the server responds to the subscriber; The subscriber and publisher send disconnect information to the server to disconnect the client and the server.

[0049] The subscriber sends an UNSUBSCRIBE packet to the server to unsubscribe from the topic, and the server returns an UNSUBACK packet to respond to the subscriber. The subscriber and publisher send an UNCONNECT packet to the server to disconnect the server.

[0050] like Figure 3 As shown, as the third embodiment of the present application, a MQTT connection system based on quantum key is connected to the client and the server, including: The quantum key generation center is used to generate quantum keys according to the client and server.

[0051] The quantum key generation center generates quantum keys for the next stage of identity authentication and data transmission. The quantum key generation center sends quantum keys to the client and server that have established communication connections in advance. After receiving the quantum keys, the client and server write the quantum keys into the specified text, so that the quantum keys can be read from the specified text for the next stage of identity authentication and data transmission.

[0052] The specific implementation described above is a preferred implementation of a MQTT connection method and system based on quantum key in the present application, and is not intended to limit the specific implementation scope of the present application. The scope of the present application includes but is not limited to the specific implementation embodiment. All equivalent changes made in accordance with the shape and structure of the present application are within the protection scope of the present application.

Claims

1. A MQTT connection method based on quantum key, characterized in that: The steps include: Obtain the quantum key, and the client outputs encrypted authentication information to the server based on the quantum key; The server decrypts the encrypted authentication information based on the quantum key, and performs authentication information matching based on the decryption result. If the match is successful, an identity authentication is performed between the server and the client based on the digital signature; If the identity authentication is successful once, the client encrypts the user information in the MQTT protocol based on the quantum key and outputs the encrypted user information to the server; The server decrypts the encrypted user information based on the quantum key and performs secondary identity authentication based on the decryption result; If the secondary identity authentication passes, an MQTT connection is established between the client and the server.

2. The MQTT connection method based on quantum key according to claim 1, characterized in that: The one-time identity authentication between the server and the client based on the digital signature includes: The server sends the server digital signature encrypted based on the quantum key to the client, and the client decrypts the server digital signature encrypted based on the quantum key and verifies the server digital signature; If the verification is successful, the client sends the client digital signature encrypted based on the quantum key to the server, and the server decrypts the client digital signature encrypted based on the quantum key and verifies the client digital signature; If the verification is successful, the identity authentication is successful.

3. The MQTT connection method based on quantum key according to claim 1, characterized in that: The client encrypts user information in the MQTT protocol based on the quantum key, and outputs the encrypted user information to the server, including: The client encrypts the user name and password in the MQTT protocol based on the quantum key; Put the encrypted user name and encrypted user password into the preset position in the CONNECT data packet; Send a CONNECT packet to the server.

4. The MQTT connection method based on quantum key according to claim 1, characterized in that: Also includes: The quantum key is used as the encryption key of the data encryption protocol in the MQTT protocol to build an MQTT connection between the client and the server.

5. The MQTT connection method based on quantum key according to claim 1, characterized in that: The obtaining of the quantum key further comprises: Based on the quantum key distribution protocol, a first quantum key shared between the publisher and the server, a second quantum key shared between the subscriber and the server, and a third quantum key shared between the publisher and the subscriber are obtained.

6. The MQTT connection method based on quantum key according to claim 5, characterized in that: The client outputs encrypted authentication information to the server based on the quantum key and further includes: The publisher uses the first quantum key to encrypt the publisher authentication information and output it to the server; The subscriber uses the second quantum key to encrypt the subscriber authentication information and output it to the server.

7. The MQTT connection method based on quantum key according to claim 5, characterized in that: The client encrypts user information in the MQTT protocol based on the quantum key, including: The publisher uses the first quantum key to encrypt the user information in the MQTT protocol and output it to the server; The subscriber uses the second quantum key to encrypt the user information in the MQTT protocol and output it to the server.

8. The MQTT connection method based on quantum key according to claim 5, characterized in that: Also includes: When the subscriber sends subscription information to the server, the publisher encrypts the published information based on the third quantum key and outputs it to the server; The server forwards the encrypted publishing information to the subscriber; The subscriber decrypts the encrypted publication information based on the third quantum key and extracts the publication information.

9. The MQTT connection method based on quantum key according to claim 5, characterized in that: The publishing end encrypts the publishing information based on the third quantum key and outputs it to the server, including: The publisher encrypts the subject message content based on the third quantum key; Put the encrypted content into the preset location of the PUBLISH data packet; Send a PUBLISH packet to the server.

10. A MQTT connection system based on quantum key, connected to a client and a server, for implementing the method according to any one of claims 1 to 9, characterized in that: include: The quantum key generation center is used to generate quantum keys according to the client and server.

Images