System and method for resisting migration of quantum cryptography algorithm, storage medium, equipment and product

Abstract

The invention relates to the technical field of cryptography, and particularly provides a system and method for resisting migration of a quantum cryptographic algorithm, a storage medium, equipment and a product, the system comprises a first end, a second end and a third end, the first end is used for performing cryptographic operation on target data according to an operation configuration strategy to obtain a cryptographic operation result, the operation configuration strategy comprises at least one of traditional cryptographic operation and anti-quantum cryptographic operation, and the cryptographic operation result comprises at least one of a traditional operation result and an anti-quantum operation result; and the second end is used for verifying the password operation result according to a verification configuration strategy to obtain a verification result, and sending the verification result to the first end. According to the system provided by the embodiment of the invention, migration of the quantum cryptography resisting algorithm can be realized, and the transformation cost is relatively low.

Description

Technical Field

[0001] The present application relates to the technical field of cryptography, and in particular to a system, method, storage medium, device and product for resisting quantum cryptographic algorithm migration. Background Art

[0002] In order to cope with the threat of quantum computing, developing anti-quantum migration solutions has become a major research hotspot. The current mainstream anti-quantum algorithms have difficulty in memory allocation due to their output sizes, such as digital signatures and public keys, which are much larger than traditional algorithms. In addition, in business systems, it is often necessary to save some business flow data in relational databases. When anti-quantum digital certificates and digital signatures also need to be saved in the database, the table structure needs to be adjusted to adapt. However, it is very difficult to adjust the table structure when there is already a large amount of data in the business table. Therefore, the current workload of transforming the anti-quantum cryptographic algorithm migration system is high and the cost is also high.

[0003] Therefore, how to provide a low-cost technical solution for anti-quantum cryptographic algorithm migration has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] The purpose of some embodiments of the present application is to provide a system, method, storage medium, device and product for anti-quantum cryptographic algorithm migration. The technical solutions of the embodiments of the present application can reduce the complexity of anti-quantum cryptographic algorithm migration, reduce the cost of system transformation, and have high practicality.

[0005] In a first aspect, some embodiments of the present application provide a system for quantum-resistant cryptographic algorithm migration, comprising: a first end, used to perform cryptographic operations on target data according to an operation configuration strategy, and obtain cryptographic operation results, wherein the operation configuration strategy includes at least one of traditional cryptographic operations and quantum-resistant cryptographic operations, and the cryptographic operation results include at least one of traditional operation results and quantum-resistant operation results; a second end, used to verify the cryptographic operation results according to a verification configuration strategy, obtain a verification result, and send the verification result to the first end.

[0006] Some embodiments of the present application implement traditional cryptographic operations and / or anti-quantum cryptographic operations on target data by configuring an operation configuration strategy at the first end, and configure a verification configuration strategy at the second end to implement verification of the corresponding cryptographic operation results. The system provided by the present application can implement traditional cryptographic operations and anti-quantum cryptographic operations, the system transformation cost is low, the complexity of anti-quantum cryptographic algorithm migration is reduced, and the practicality is high.

[0007] In some embodiments, the first end is an operator initiating end, and the second end is an operation receiving end; the cryptographic operation includes: encryption operation and digital signature.

[0008] In some embodiments of the present application, the types of the first end and the second end can be flexibly selected, and the cryptographic operation can be an encryption operation or a digital signature, which has a wide range of applications.

[0009] In some embodiments, the first end includes: a traditional cryptographic module and an anti-quantum cryptographic module connected to the same interface; the traditional cryptographic module is used to perform the traditional cryptographic operation on the target data to obtain the traditional operation result, and send the traditional operation result to the business system, so that the business system sends the traditional operation result to the second end; the anti-quantum cryptographic module is used to perform the anti-quantum cryptographic operation on the target data to obtain the anti-quantum operation result.

[0010] Some embodiments of the present application connect a traditional cryptographic module and an anti-quantum cryptographic module at the same interface at the first end, and different modules can be called to perform cryptographic operations according to the actual configured operation configuration strategy, thereby being compatible with traditional cryptographic operations and anti-quantum cryptographic operations.

[0011] In some embodiments, when the operation configuration strategy includes the anti-quantum cryptographic operation, the first end is used to perform the anti-quantum cryptographic operation on the target data, obtain the anti-quantum operation result, and generate an index value corresponding to the anti-quantum operation result; the second end is used to store the index value and the anti-quantum operation result.

[0012] Some embodiments of the present application generate an index value while generating a quantum-resistant computing result and store it on the second end, so that the second end can retrieve and read it on demand, thereby ensuring data access security.

[0013] In some embodiments, the verification configuration strategy includes verifying the anti-quantum operation result, and the second end is used to: read the anti-quantum operation result through the index value; verify the anti-quantum operation result to obtain the verification result.

[0014] Some embodiments of the present application can ensure data access security by reading the quantum-resistant operation result through the index value and then verifying it.

[0015] In some embodiments, when the operation configuration strategy includes the traditional cryptographic operation and the anti-quantum cryptographic operation, the verification configuration strategy includes: if the traditional operation result or the anti-quantum operation result passes the verification, the verification result is a successful verification; or, if both the traditional operation result and the anti-quantum operation result pass the verification, the verification result is a successful verification.

[0016] Some embodiments of the present application can be compatible with traditional cryptographic operations and quantum-resistant cryptographic operations and corresponding verification functions by configuring operation configuration strategies and verification configuration strategies.

[0017] In some embodiments, the verification configuration policy is deployed inside the second end, or deployed in a cryptographic support layer connected to the second end.

[0018] Some embodiments of the present application can flexibly deploy verification configuration policy deployment.

[0019] In a second aspect, some embodiments of the present application provide a method for migrating a quantum-resistant cryptographic algorithm, which is applied to a first end, and includes: performing a cryptographic operation on target data according to an operation configuration strategy to obtain a cryptographic operation result, wherein the operation configuration strategy includes at least one of a traditional cryptographic operation and a quantum-resistant cryptographic operation, and the cryptographic operation result includes at least one of a traditional operation result and a quantum-resistant operation result; sending the cryptographic operation result to a second end so that the second end verifies the cryptographic operation result according to a verification configuration strategy to obtain a verification result; and receiving the verification result sent by the second end.

[0020] In a third aspect, some embodiments of the present application provide a method for migrating a quantum-resistant cryptographic algorithm, which is applied to a second end, comprising: receiving a cryptographic operation result sent by a first end, wherein the cryptographic operation result is obtained by the first end performing a cryptographic operation on target data according to an operation configuration strategy; wherein the operation configuration strategy includes at least one of a traditional cryptographic operation and a quantum-resistant cryptographic operation, and the cryptographic operation result includes at least one of a traditional operation result and a quantum-resistant operation result; verifying the cryptographic operation result according to a verification configuration strategy to obtain a verification result, and sending the verification result to the first end.

[0021] In a fourth aspect, some embodiments of the present application provide a device for migrating a quantum-resistant cryptographic algorithm, which is applied to a first end and includes: an operation module, which is used to perform a cryptographic operation on target data according to an operation configuration strategy, and obtain a cryptographic operation result, wherein the operation configuration strategy includes at least one of a traditional cryptographic operation and a quantum-resistant cryptographic operation, and the cryptographic operation result includes at least one of a traditional operation result and a quantum-resistant operation result; a sending module, which is used to send the cryptographic operation result to a second end, so that the second end verifies the cryptographic operation result according to a verification configuration strategy to obtain a verification result; and a receiving module, which is used to receive the verification result sent by the second end.

[0022] In a fifth aspect, some embodiments of the present application provide a device for quantum-resistant cryptographic algorithm migration, which is applied to a second end and includes: a receiving module, used to receive a cryptographic operation result sent by a first end, wherein the cryptographic operation result is obtained by the first end performing a cryptographic operation on target data according to an operation configuration strategy; wherein the operation configuration strategy includes at least one of a traditional cryptographic operation and a quantum-resistant cryptographic operation, and the cryptographic operation result includes at least one of a traditional operation result and a quantum-resistant operation result; a verification module, used to verify the cryptographic operation result according to the verification configuration strategy, obtain a verification result, and send the verification result to the first end.

[0023] In a sixth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the second and third aspects.

[0024] In the seventh aspect, some embodiments of the present application provide an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method described in any embodiment of the second aspect and the third aspect can be implemented.

[0025] In an eighth aspect, some embodiments of the present application provide a computer program product, comprising a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the second and third aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0027] Figure 1 One of the system diagrams for quantum-resistant cryptographic algorithm migration provided for some embodiments of the present application;

[0028] Figure 2 One of the schematic diagrams of configuration strategy deployment provided for some embodiments of the present application;

[0029] Figure 3 A second schematic diagram of configuration strategy deployment provided for some embodiments of the present application;

[0030] Figure 4A flow chart of a method for quantum-resistant cryptographic algorithm migration provided for some embodiments of the present application;

[0031] Figure 5 A schematic diagram of a traditional digital signature scenario provided for some embodiments of the present application;

[0032] Figure 6 System diagram 2 of quantum-resistant cryptographic algorithm migration provided for some embodiments of the present application;

[0033] Figure 7 One of the block diagrams of the device composition for resisting quantum cryptographic algorithm migration provided in some embodiments of the present application;

[0034] Figure 8 The second block diagram of the device composition for resisting quantum cryptographic algorithm migration provided in some embodiments of the present application;

[0035] Fig. 9 A schematic diagram of an electronic device is provided for some embodiments of the present application. DETAILED DESCRIPTION

[0036] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0037] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0038] In the relevant technologies, the typical solution in anti-quantum migration requires cryptographic manufacturers to provide relevant modules of new cryptographic algorithms and new cryptographic support systems to provide relevant interfaces of anti-quantum cryptographic algorithms, such as key generation, digital signature and verification, public key encapsulation and decapsulation, etc. In addition, the business system needs to be transformed and the code that originally calls the cryptographic function needs to be modified, from calling the traditional algorithm to calling the anti-quantum cryptographic algorithm.

[0039] For simple systems, the above transformation method is not a big problem, but for systems that require long-term maintenance and multiple version iterations, it is very laborious to sort out and locate the code that originally called the cryptographic function. Moreover, the output size of mainstream anti-quantum algorithms is very large, which makes system transformation very complicated.

[0040] For example, it is very difficult to adjust the table structure when there is already a large amount of data in the business table of the business system. At present, the data in the mainstream relational database table is usually stored in pages, and the page size can be configured to be 4KB-16KB. Database best practices point out that each field is best stored on a data page, which is also the principle of database table design. If the data stored in the table increases suddenly by dozens of times, it is very likely to exceed the capacity of the page space, so additional design is required, such as the use of BLOB fields. Moreover, when the business system is transformed, due to the substantial increase in output size, the change of business call interface needs to consider memory allocation issues. Interface transformation has to make more design changes due to the feature that the size of public keys, digital signatures, and public key encapsulation increases by dozens or hundreds of times, such as memory processing solutions and error handling methods, rather than simple function replacement. For example, for large-size outputs, its related variables may consider changing from stack memory to heap memory, using methods such as malloc to apply, or using pre-allocated memory pools, etc., and the transformation cost is very high. On the terminal side, it is also necessary to replace the workload in anti-quantum signature activities. Moreover, these problems mentioned above usually appear in many different forms during system transformation, making them difficult to locate. In addition, errors may be triggered by external input and output during execution, making them difficult to test and debug. This requires a lot of testing after the transformation to confirm the robustness of the system.

[0041] It can be seen from the above-mentioned related technologies that the solutions for resisting quantum cryptographic algorithm migration in the existing technology are highly complex, have high transformation costs, and involve a lot of work.

[0042] In view of this, some embodiments of the present application provide a system for quantum-resistant cryptographic algorithm migration, which abandons the solution of massively transforming old systems in the prior art, and mainly introduces new subsystems and cryptographic devices in an incremental manner to obtain the system for quantum-resistant cryptographic algorithm migration of the present application. The system can provide traditional cryptographic operations and quantum-resistant cryptographic processing mechanisms, and maintain compatibility with the original interface, so that the business system and cryptographic module "maintain the old interface calls" but "realize new functions", reducing the complexity of quantum-resistant cryptographic algorithm migration and reducing costs.

[0043] The following is combined with Figure 1 The overall composition structure of the system for resisting quantum cryptographic algorithm migration provided by some embodiments of the present application is exemplified.

[0044] like Figure 1As shown, some embodiments of the present application provide a system for quantum-resistant cryptographic algorithm migration, the system comprising: a first end 110, a second end 120 and a business system 130. The first end 110 comprises: a new version interface 111, a traditional cryptographic module 112 and a quantum-resistant cryptographic module 113. The second end 120 comprises a cryptographic device 121 and a quantum-resistant data access module 122. The business system 130 can call the second end 120 through the traditional algorithm interface of the cryptographic support layer to verify the cryptographic operation result.

[0045] In some embodiments of the present application, the first end 110 can be considered as a "component that generates ciphertext", which contains an independent anti-quantum cryptographic module 113, which can provide various anti-quantum cryptographic function interfaces; it also includes a new version component of the traditional cryptographic module 112 interface, and the new version of the interface (that is, the new version interface 111) provides the same form and the same functions as the original interface, such as function name, input parameters and return values, error codes, and these functions remain unchanged corresponding to the traditional cryptographic algorithm. Moreover, the new version interface 111 supports operation strategy configuration, and the new version interface 111 is processed according to the logic determined by the operation strategy configuration. If the processing logic determines that anti-quantum cryptographic operation is to be performed, it is transferred to the independent anti-quantum cryptographic module 113 for processing using the anti-quantum cryptographic algorithm. If traditional cryptographic operation is required, it can be transferred to the independent traditional cryptographic module 112 for processing using the traditional cryptographic algorithm.

[0046] Specifically, the operation configuration strategy may include:

[0047] 1) Only traditional cryptographic algorithms are used for processing;

[0048] 2) Only use quantum-resistant cryptographic algorithms for processing;

[0049] 3) For the same request data (as a specific example of target data), both traditional cryptographic algorithms and quantum-resistant cryptographic algorithms must be used for processing.

[0050] It should be noted that when only using anti-quantum cryptographic algorithms for processing, traditional cryptographic operations are also required. At this time, a fake traditional cryptographic algorithm's traditional operation result can be generated. The format and size of the fake traditional operation result are the same as the real result. It serves as an occupant to meet various compatibility requirements.

[0051] In some embodiments of the present application, the second end 120 can be considered as a "cryptographic component for processing ciphertext", which includes a cryptographic device 121 for implementing quantum-resistant cryptographic algorithms and other required functions. The cryptographic device 121 supports the caller to call through the old interface (that is, the traditional algorithm interface mentioned above). The cryptographic device 121 supports the verification configuration strategy, which determines the processing logic of the processing request for the received traditional operation result, and the processing logic includes whether to process the quantum-resistant operation result.

[0052] Specifically, the verification configuration strategy may include:

[0053] 1) Only traditional cryptographic algorithms are used for verification;

[0054] 2) Only use quantum-resistant cryptographic algorithms for verification processing;

[0055] 3) For the same request data (as a specific example of target data), both the traditional cryptographic algorithm and the quantum-resistant cryptographic algorithm must be used for verification processing. In this case, it can also be configured that when both the traditional cryptographic algorithm and the quantum-resistant cryptographic algorithm are used for verification processing, "processing success" (as a specific example of verification result) can be returned if either algorithm is successfully processed (i.e., passes verification); or "processing success" can be returned only if both algorithms are successfully processed.

[0056] In some embodiments of the present application, the verification configuration policy is deployed inside the second end, or deployed in a cryptographic support layer connected to the second end.

[0057] For example, in some embodiments of the present application, Figure 2 As shown, the business system 130 is connected to the old cryptographic support layer through the old interface, and the cryptographic support layer is connected to the cryptographic device 121. The service layer in the cryptographic device 121 is deployed with a verification configuration strategy (i.e., the policy configuration in the figure), and the cryptographic device is used to verify the received cryptographic operation. Figure 3 As shown, the business system 130 is connected to the new password support layer through the old interface. The new password support layer has a policy configuration deployed inside. Through the verification configuration policy, the password device 121 can use the corresponding algorithm for verification processing. The password support layer belongs to a password library, which contains a variety of password algorithms that can be used.

[0058] In some embodiments of the present application, the first end is an operator initiating end, and the second end is an operation receiving end; the cryptographic operation includes: encryption operation and digital signature.

[0059] For example, in an actual application scenario, the first end may be a terminal where an operator initiates an operation, and the second end may be a server where the corresponding operation is received; or, the first end may be a server where an operator initiates an operation, and the second end may be a terminal where the corresponding operation is received.

[0060] For example, in some embodiments of the present application, the types of the first end and the second end can be selected according to the requirements. For example, the terminal can perform cryptographic operations (for example, data encryption or signature), and the server can verify the results of the cryptographic operations (for example, data decryption or signature verification); or the server can perform cryptographic operations, and the terminal can verify the results of the cryptographic operations. The specific settings can be made according to the actual situation, and the embodiments of the present application are not specifically limited here.

[0061] The following is an example of Figure 1 The specific functions of each component unit.

[0062] In some embodiments of the present application, the first end 110 is used to: perform cryptographic operations on target data according to an operation configuration strategy to obtain cryptographic operation results, wherein the operation configuration strategy includes at least one of traditional cryptographic operations and quantum-resistant cryptographic operations, and the cryptographic operation results include at least one of traditional operation results and quantum-resistant operation results.

[0063] For example, in some embodiments of the present application, the first end 110 may perform cryptographic operations on user data and service data (as a specific example of target data) according to a pre-configured operation configuration strategy to obtain a cryptographic operation result. The content of the operation configuration strategy may select traditional cryptographic operations and / or quantum-resistant cryptographic operations according to actual application scenarios.

[0064] In some embodiments of the present application, the first end 110 includes: a traditional cryptographic module and an anti-quantum cryptographic module connected to the same interface; the traditional cryptographic module is used to perform the traditional cryptographic operation on the target data, obtain the traditional operation result, and send the traditional operation result to the business system, so that the business system sends the traditional operation result to the second end; the anti-quantum cryptographic module is used to perform the anti-quantum cryptographic operation on the target data to obtain the anti-quantum operation result.

[0065] For example, in some embodiments of the present application, both the traditional cryptographic module 112 and the quantum-resistant cryptographic module 113 are connected to the interface 111 to be called.

[0066] Specifically, in one embodiment, a traditional cryptographic algorithm is deployed in the traditional cryptographic module 112, which can perform cryptographic operations on user data and business data to obtain a traditional operation result A. In another embodiment, if quantum-resistant cryptographic operations are set in the operation configuration policy, the traditional cryptographic module 112 needs to generate a placeholder data with the same format and size as the traditional operation result A. Subsequently, the business system 130 can send the traditional operation result A or the placeholder data to the cryptographic device 121 through the old interface for verification processing.

[0067] Specifically, an anti-quantum cryptographic algorithm is deployed in the anti-quantum cryptographic module 113, which can perform cryptographic operations on user data and business data to obtain anti-quantum operation results. It is understandable that the algorithm types of traditional cryptographic algorithms and anti-quantum cryptographic algorithms can be set according to actual application scenarios, and the embodiments of this application are not specifically limited here.

[0068] In some embodiments of the present application, when the operation configuration strategy includes anti-quantum cryptographic operation, the first end 110 is used to: perform the anti-quantum cryptographic operation on the target data, obtain the anti-quantum operation result, and generate an index value corresponding to the anti-quantum operation result. The second end 120 is used to: store the index value and the anti-quantum operation result.

[0069] For example, in some embodiments of the present application, the anti-quantum cryptographic module 113 performs cryptographic operations on user data and service data to obtain an anti-quantum operation result R, and then generates a unique index value I for the anti-quantum operation result R, and sends I and R to the anti-quantum data access module 122 and stores them. And the first end 100 can be informed that the storage is successful. Among them, I can use a cryptographic hash algorithm to calculate the interface call data, and obtain the unique identifier of the service data for determination, and the embodiments of the present application are not limited to this.

[0070] In some embodiments of the present application, the second end 120 is used to: verify the cryptographic operation result according to the verification configuration policy, obtain a verification result, and send the verification result to the first end.

[0071] For example, in some embodiments of the present application, the second end 120 can verify the result of the cryptographic operation according to a pre-configured verification configuration strategy. The content of the verification configuration strategy can select traditional cryptographic operations and / or anti-quantum cryptographic operations for verification processing according to the operation configuration strategy configured by the first end 110 in the actual application scenario. It can be understood that there is a corresponding relationship between the operation configuration strategy and the verification configuration strategy. The verification configuration strategy needs to be verified in a corresponding manner according to the operation method adopted by the operation configuration strategy. For example, the operation configuration strategy of the terminal is set to perform traditional cryptographic operations + anti-quantum cryptographic operations on the target data, and the server configuration corresponds to it. During verification, the same configuration strategy is used for verification. When verifying two algorithms, the consistency of the content protected by the cryptographic operation should also be determined as needed.

[0072] In some embodiments of the present application, when the verification configuration strategy includes verification of an anti-quantum operation result, the second end 120 is used to: read the anti-quantum operation result through the index value; and verify the anti-quantum operation result to obtain the verification result.

[0073] For example, in some embodiments of the present application, if the processing logic (that is, the verification configuration strategy) determines that an anti-quantum cryptographic operation is to be performed, the cryptographic device 121 in the second end 120 can calculate the index value I based on the interface call data, and obtain the anti-quantum operation result R of the first end 110 associated with the call from the anti-quantum data access module 122 of the network address L based on I, complete the anti-quantum operation, and return the processing result (that is, the verification result) to the first end 110.

[0074] The following is combined with Figure 4 Exemplary description of some embodiments of the present application provided by Figure 1 The implementation process of quantum-resistant cryptographic algorithm migration performed by the system shown.

[0075] Please see attached Figure 4 , Figure 4 A flow chart of a method for migrating a quantum-resistant cryptographic algorithm is provided for some embodiments of the present application. The method for migrating a quantum-resistant cryptographic algorithm may include: S410, the first end performs a cryptographic operation on target data according to an operation configuration strategy to obtain a cryptographic operation result, wherein the operation configuration strategy includes at least one of a traditional cryptographic operation and a quantum-resistant cryptographic operation, and the cryptographic operation result includes at least one of a traditional operation result and a quantum-resistant operation result; S420, the second end verifies the cryptographic operation result according to the verification configuration strategy, obtains a verification result, and sends the verification result to the first end.

[0076] It can be understood that the specific implementation process of S410 to S420 can refer to the system embodiment provided above, and in order to avoid repetition, the detailed description is appropriately omitted here.

[0077] The following embodiments of this application take a typical digital signature-related transformation scenario as an example to illustrate the implementation process of this application. Figure 5 The provided schematic diagram of the traditional digital signature scenario. In this scenario, before migrating to the quantum-resistant cryptographic algorithm, the terminal side uses a digital signature module (with a built-in traditional algorithm) to digitally sign the data generated by the business and the user data on the terminal side to obtain the business data containing the signature, and submit it to the business system; the business system calls the traditional cryptographic device through the interface of the cryptographic support layer to verify the signature, and saves the business data containing the digital certificate and digital signature to the DB (Data Base).

[0078] The following uses the application scenario of digital signature as an example. Figure 5 The system shown in the figure is improved to Figure 6 The system shown in the figure, combined with the attached Figure 6 The implementation process of quantum-resistant cryptographic algorithm migration is explained by way of example.

[0079] Please see attached Figure 6 , Figure 6 A system diagram of quantum-resistant cryptographic algorithm migration in a digital signature scenario provided for some embodiments of the present application. The system for quantum-resistant cryptographic algorithm migration includes: a new cryptographic device (i.e., a terminal side and a server side) Figure 1 The cryptographic device 121 in the example). An independent PQC digital signature module (as a specific example of an anti-quantum cryptographic module), an old digital signature module (as a specific example of a traditional cryptographic module), and a new version interface of the old digital signature module are deployed on the terminal side. Among them, PQC (Post-Quantum Cryptography, anti-quantum cryptography, also known as post-quantum cryptography). The new cryptographic device is connected to the anti-quantum data access module, which includes an anti-quantum data access service and a PQC database PQCDB. The business system 130 calls the new cryptographic device to verify the signature through the traditional algorithm interface connected to the cryptographic support layer.

[0080] The following embodiments adopt the traditional cryptographic operation + anti-quantum cryptographic operation as the operation configuration strategy, and the corresponding verification configuration strategy (i.e. Figure 6 The algorithm migration strategy in the example also needs to adopt traditional cryptographic operations + anti-quantum cryptographic operations, and the successful verification of any of the two algorithms will return a successful signature verification. The above implementation process is explained by way of example.

[0081] S1. According to the operation configuration strategy, the new version interface of the terminal sends the data to be signed to the PQC digital signature module and the old digital signature module respectively.

[0082] S2. The PQC digital signature module signs the data to be signed, obtains the business data containing the PQC signature, and generates the corresponding index value.

[0083] S3. The PQC digital signature module stores the business data and index values ​​containing the PQC signature in the PQCDB through the quantum-resistant data access service.

[0084] S4. The old digital signature module signs the data to be signed to obtain business data containing the traditional signature.

[0085] S5. The business system sends the business data containing the traditional signature to the new cryptographic device.

[0086] S6. The new cryptographic device uses the index value to retrieve the corresponding business data containing the PQC signature from the PQCDB through the quantum-resistant data access service.

[0087] S7. The new cryptographic device verifies the business data containing the traditional signature according to the pre-configured verification configuration strategy, and verifies the business data containing the PQC signature to obtain the verification result.

[0088] Among them, as long as one of the business data containing the traditional signature and the business data containing the PQC signature passes the signature verification, the verification result is verification passed.

[0089] S8. The new password device sends the verification result to the terminal side.

[0090] Through some of the above embodiments of the present application, it can be seen that the present application can achieve the following effects:

[0091] (1) This application can successfully achieve quantum-resistant computing migration by replacing the interface of the old device with the new version and replacing the old cryptographic device with the new cryptographic device. Since the interface remains the same, the business system and server code implementation do not need to be changed, thus changing the original "system transformation" to "adding modules" and "replacing equipment / components", simplifying the migration process and reducing risks.

[0092] (2) New quantum-resistant data access services, whose data storage, such as databases, can be designed completely according to the characteristics of quantum-resistant cryptographic output size, and do not need to be restricted by "old system transformation". Similarly, because the old business system does not need to transmit and store quantum-resistant cryptographic algorithm messages, there is no need to make additional designs and modifications to address the increase in quantum-resistant cryptographic algorithm messages.

[0093] (3) The interface names, passed parameters, and returned data provided by the new quantum-resistant cryptographic devices are exactly the same as those of the old devices, but the processing method is different from the original logic. Instead, its behavior is determined by the configuration policy set by the system. Therefore, even if the hybrid mode of quantum-resistant computing and traditional cryptographic algorithms changes, the part of the business system that calls the cryptographic interface does not need to be changed. Therefore, the complexity of migration is reduced, and the risk of future algorithm uncertainty is also reduced.

[0094] Some embodiments of the present application provide a method for migrating a quantum-resistant cryptographic algorithm, which is applied to a first end, and includes: performing a cryptographic operation on target data according to an operation configuration strategy to obtain a cryptographic operation result, wherein the operation configuration strategy includes at least one of a traditional cryptographic operation and a quantum-resistant cryptographic operation, and the cryptographic operation result includes at least one of a traditional operation result and a quantum-resistant operation result; sending the cryptographic operation result to a second end, so that the second end verifies the cryptographic operation result according to a verification configuration strategy to obtain a verification result; and receiving the verification result sent by the second end.

[0095] Some embodiments of the present application provide a method for migrating a quantum-resistant cryptographic algorithm, which is applied to a second end, comprising: receiving a cryptographic operation result sent by a first end, wherein the cryptographic operation result is obtained by the first end performing a cryptographic operation on target data according to an operation configuration strategy; wherein the operation configuration strategy includes at least one of a traditional cryptographic operation and a quantum-resistant cryptographic operation, and the cryptographic operation result includes at least one of a traditional operation result and a quantum-resistant operation result; verifying the cryptographic operation result according to a verification configuration strategy to obtain a verification result, and sending the verification result to the first end.

[0096] Please refer to Figure 7 , Figure 7 The block diagram of the composition of the device for quantum cryptographic algorithm migration provided by some embodiments of the present application is shown. It should be understood that the device for quantum cryptographic algorithm migration corresponds to the above method embodiment and can perform each step involved in the above method embodiment. The specific functions of the device for quantum cryptographic algorithm migration can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0097] Figure 7The device for resisting quantum cryptographic algorithm migration includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the device for resisting quantum cryptographic algorithm migration. The device for resisting quantum cryptographic algorithm migration is applied to a first end, including: an operation module 710, used to perform cryptographic operation on target data according to an operation configuration strategy, and obtain a cryptographic operation result, wherein the operation configuration strategy includes at least one of a traditional cryptographic operation and an anti-quantum cryptographic operation, and the cryptographic operation result includes at least one of a traditional operation result and an anti-quantum operation result; a sending module 720, used to send the cryptographic operation result to a second end, so that the second end verifies the cryptographic operation result according to a verification configuration strategy to obtain a verification result; a receiving module 730, used to receive the verification result sent by the second end.

[0098] Please refer to Figure 8 , Figure 8 The block diagram of the composition of the device for quantum cryptographic algorithm migration provided by some embodiments of the present application is shown. It should be understood that the device for quantum cryptographic algorithm migration corresponds to the above method embodiment and can perform each step involved in the above method embodiment. The specific functions of the device for quantum cryptographic algorithm migration can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0099] Figure 8 The device for resisting quantum cryptographic algorithm migration includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the device for resisting quantum cryptographic algorithm migration. The device for resisting quantum cryptographic algorithm migration is applied to the second end, including: a receiving module 810, used to receive a cryptographic operation result sent by the first end, wherein the cryptographic operation result is obtained by the first end performing a cryptographic operation on target data according to an operation configuration strategy; wherein the operation configuration strategy includes at least one of a traditional cryptographic operation and an anti-quantum cryptographic operation, and the cryptographic operation result includes at least one of a traditional operation result and an anti-quantum operation result; a verification module 820, used to verify the cryptographic operation result according to the verification configuration strategy, obtain a verification result, and send the verification result to the first end.

[0100] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned system, and will not be described in detail here.

[0101] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the operations of the method corresponding to any of the above methods provided in the above embodiments.

[0102] Some embodiments of the present application further provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0103] like Fig. 9 As shown, some embodiments of the present application provide an electronic device 900, which includes: a memory 910, a processor 920, and a computer program stored in the memory 910 and executable on the processor 920, wherein the processor 920 can implement a method as described in any of the above embodiments when reading the program from the memory 910 through a bus 930 and executing the program.

[0104] Processor 920 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 920 can be a microprocessor.

[0105] The memory 910 may be used to store instructions executed by the processor 920 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 920 of the disclosed embodiment may be used to execute instructions in the memory 910 to implement the method shown above. The memory 910 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0106] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0107] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0108] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A system for resisting quantum cryptographic algorithm migration, characterized in that: include: A first end is used to perform cryptographic operation on target data according to an operation configuration strategy to obtain a cryptographic operation result, wherein the operation configuration strategy includes at least one of a traditional cryptographic operation and a quantum-resistant cryptographic operation, and the cryptographic operation result includes at least one of a traditional operation result and a quantum-resistant operation result; The second end is used to verify the cryptographic operation result according to the verification configuration policy, obtain a verification result, and send the verification result to the first end.

2. The system according to claim 1, characterized in that The first end is an operator initiating end, and the second end is an operation receiving end; the cryptographic operation includes: encryption operation and digital signature.

3. The system according to claim 1 or 2, characterized in that: The first end includes: a traditional cryptographic module and a quantum-resistant cryptographic module connected to the same interface; The traditional cryptographic module is used to perform the traditional cryptographic operation on the target data to obtain the traditional operation result, and send the traditional operation result to the business system, so that the business system sends the traditional operation result to the second end; The anti-quantum cryptographic module is used to perform the anti-quantum cryptographic operation on the target data to obtain the anti-quantum operation result.

4. The system according to claim 1 or 2, characterized in that: When the operation configuration strategy includes the anti-quantum cryptographic operation, The first end is used to perform the anti-quantum cryptographic operation on the target data to obtain the anti-quantum operation result, and generate an index value corresponding to the anti-quantum operation result; The second end is used to store the index value and the anti-quantum operation result.

5. The system according to claim 4, characterized in that The verification configuration strategy includes verifying the anti-quantum operation result, the second end is used to: Read the anti-quantum operation result through the index value; The anti-quantum computing result is verified to obtain the verification result.

6. The system according to claim 1 or 2, characterized in that: When the operation configuration strategy includes the traditional cryptographic operation and the anti-quantum cryptographic operation, the verification configuration strategy includes: if the traditional operation result or the anti-quantum operation result passes the verification, the verification result is a successful verification; or, if both the traditional operation result and the anti-quantum operation result pass the verification, the verification result is a successful verification.

7. The system according to claim 1 or 2, characterized in that: The verification configuration policy is deployed inside the second end, or deployed in a password support layer connected to the second end.

8. A method for resisting quantum cryptographic algorithm migration, characterized in that: Applied to the first end, including: Performing cryptographic operations on target data according to an operation configuration strategy to obtain a cryptographic operation result, wherein the operation configuration strategy includes at least one of a traditional cryptographic operation and a quantum-resistant cryptographic operation, and the cryptographic operation result includes at least one of a traditional operation result and a quantum-resistant operation result; Sending the cryptographic operation result to the second end so that the second end can verify the cryptographic operation result according to the verification configuration policy to obtain a verification result; Receive the verification result sent by the second end.

9. A method for resisting quantum cryptographic algorithm migration, characterized in that: Applied to the second end, including: Receiving a cryptographic operation result sent by the first end, wherein the cryptographic operation result is obtained by the first end performing a cryptographic operation on the target data according to the operation configuration strategy; wherein the operation configuration strategy includes at least one of a traditional cryptographic operation and a quantum-resistant cryptographic operation, and the cryptographic operation result includes at least one of a traditional operation result and a quantum-resistant operation result; The cryptographic operation result is verified according to the verification configuration policy to obtain a verification result, and the verification result is sent to the first end.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program executes the method according to any one of claims 8 to 9 when executed by a processor.

11. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the computer program executes the method according to any one of claims 8 to 9 when being run by the processor.

12. A computer program product, characterized in that The computer program product comprises a computer program, wherein the computer program executes the method according to any one of claims 8 to 9 when executed by a processor.

Images