Authentication encryption communication method and system, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an authentication encryption communication method and system, electronic equipment and a storage medium. The method comprises the following steps: sending first handshake information to a server; receiving second handshake information sent by the server; based on a set key encapsulation algorithm, encapsulating the first shared key by using the temporary public key to obtain a first ciphertext, and sending the first ciphertext to a server, so that the server performs decryption operation to obtain the first shared key; packaging the server long-term public key based on a set key packaging algorithm to obtain a second ciphertext and a second shared key corresponding to the second ciphertext, and sending the second ciphertext to the server to enable the server to perform decryption operation to obtain the second shared key; and performing identity authentication and key derivation based on the first shared key and the second shared key to obtain a plurality of independent keys, and performing encrypted communication with a server based on the plurality of independent keys. The scheme is low in communication overhead and relatively high in security.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an authenticated encryption communication method, system, electronic device and storage medium. Background Art

[0002] Information security technology The Transport Layer Cryptography Protocol (TLCP) protocol uses a method of separating encryption certificates and signature certificates, performs key negotiation and digital signatures through algorithms such as SM2 and RSA, and uses symmetric cryptographic algorithms to ensure data confidentiality and integrity. However, the emergence of quantum computers poses a serious threat to the existing cryptographic system. Specifically, the Shor algorithm running on quantum computers can crack the discrete logarithm and large integer factorization problems in polynomial time, and the Grover algorithm running on quantum computers accelerates exhaustive attacks, resulting in public key cryptographic algorithms no longer being secure, and the security strength of symmetric cryptographic algorithms is halved, threatening the security of digital communication systems. At present, in theory, the post-quantum signature scheme can be used to replace the related traditional public key cryptographic operations in TLCP. However, when performing encrypted communication based on the post-quantum signature scheme, a signature needs to be generated and transmitted for each communication, and the signature value is usually long, resulting in a large communication overhead.

[0003] Therefore, there is an urgent need to provide an encrypted communication method with low communication overhead and higher security. Summary of the invention

[0004] Multiple aspects of the present application provide an authenticated encryption communication method, system, electronic device and storage medium with low communication overhead and high security.

[0005] In a first aspect, an embodiment of the present application provides an authenticated encryption communication method, which is applied to a client, and the method includes: Sending a first handshake message to the server, wherein the first handshake message includes an algorithm list, wherein the algorithm list includes a key encapsulation algorithm supported by the client and a signature algorithm for verifying a long-term public key; receiving second handshake information sent by the server, wherein the second handshake information includes a target algorithm selected by the server from the algorithm list, a server long-term public key, and a temporary public key generated based on the target algorithm; Based on the set key encapsulation algorithm, encapsulate the first shared key using the temporary public key to obtain a first ciphertext, and send the first ciphertext to the server, so that the server performs a decryption operation on the first ciphertext based on a temporary private key corresponding to the temporary public key to obtain the first shared key; encapsulating the server long-term public key based on a set key encapsulation algorithm to obtain a second ciphertext and a second shared key corresponding to the second ciphertext, and sending the second ciphertext to the server, so that the server performs a decryption operation on the second ciphertext based on a server long-term private key corresponding to the server long-term public key to obtain the second shared key; Identity authentication and key derivation are performed based on the first shared key and the second shared key to obtain multiple independent keys, and encrypted communication is performed with the server based on the multiple independent keys.

[0006] In a second aspect, an embodiment of the present application provides an authenticated encryption communication method, which is applied to a server, and the method includes: Receive first handshake information sent by the client, where the first handshake information includes an algorithm list, where the algorithm list includes a key encapsulation algorithm supported by the client and a signature algorithm for verifying a long-term public key; Sending second handshake information to the client based on the first handshake information, where the second handshake information includes a target algorithm selected by the server from the algorithm list, a server long-term public key, and a temporary public key generated based on the target algorithm; receiving a first ciphertext sent by the client, and performing a decryption operation on the first ciphertext based on a temporary private key corresponding to the temporary public key to obtain a first shared key, wherein the first ciphertext is obtained by the client encapsulating the first shared key using the temporary public key based on a set key encapsulation algorithm; receiving a second ciphertext sent by the client, and performing a decryption operation on the second ciphertext based on a server long-term private key corresponding to the server long-term public key to obtain a second shared key, wherein the second ciphertext is obtained by encapsulating the server long-term public key by the client based on a set key encapsulation algorithm; Identity authentication and key derivation are performed based on the first shared key and the second shared key to obtain multiple independent keys, and encrypted communication is performed with the client based on the multiple independent keys.

[0007] In a third aspect, an embodiment of the present application provides an encryption communication device, applied to a client, the device comprising: A sending module, configured to send first handshake information to a server, wherein the first handshake information includes an algorithm list, wherein the algorithm list includes a key encapsulation algorithm supported by the client and a signature algorithm for verifying a long-term public key; A receiving module, configured to receive second handshake information sent by the server, wherein the second handshake information includes a target algorithm selected by the server from the algorithm list, a server long-term public key, and a temporary public key generated based on the target algorithm; A first encapsulation module is configured to encapsulate the first shared key using the temporary public key based on a set key encapsulation algorithm to obtain a first ciphertext, and send the first ciphertext to the server, so that the server performs a decryption operation on the first ciphertext based on a temporary private key corresponding to the temporary public key to obtain the first shared key; A second encapsulation module is used to encapsulate the server long-term public key based on a set key encapsulation algorithm to obtain a second ciphertext and a second shared key corresponding to the second ciphertext, and send the second ciphertext to the server, so that the server performs a decryption operation on the second ciphertext based on a server long-term private key corresponding to the server long-term public key to obtain the second shared key; an authentication module, configured to perform identity authentication based on the first shared key and the second shared key; An encryption communication module is used to derive a key based on the first shared key and the second shared key to obtain multiple independent keys, and perform encryption communication with the server based on the multiple independent keys.

[0008] In a fourth aspect, an embodiment of the present application provides an encryption communication device, which is applied to a server, and the device includes: A receiving module, configured to receive first handshake information sent by a client, wherein the first handshake information includes an algorithm list, wherein the algorithm list includes a key encapsulation algorithm supported by the client and a signature algorithm for verifying a long-term public key; A sending module, configured to send second handshake information to the client based on the first handshake information, wherein the second handshake information includes a target algorithm selected by the server from the algorithm list, a server long-term public key, and a temporary public key generated based on the target algorithm; a first decryption module, configured to receive a first ciphertext sent by the client, and perform a decryption operation on the first ciphertext based on a temporary private key corresponding to the temporary public key to obtain a first shared key, wherein the first ciphertext is obtained by the client encapsulating the first shared key using the temporary public key based on a set key encapsulation algorithm; a second decryption module, configured to receive a second ciphertext sent by the client, and decrypt the second ciphertext based on a server long-term private key corresponding to the server long-term public key to obtain a second shared key, wherein the second ciphertext is obtained by encapsulating the server long-term public key by the client based on a set key encapsulation algorithm; an authentication module, configured to perform identity authentication based on the first shared key and the second shared key; An encryption communication module is used to derive a key based on the first shared key and the second shared key to obtain multiple independent keys, and perform encryption communication with the server based on the multiple independent keys.

[0009] In the fifth aspect, an embodiment of the present application further provides an electronic device, comprising: a memory, a processor, and a communication interface; wherein an executable code is stored on the memory, and when the executable code is executed by the processor, the processor executes the method described in the first aspect or the second aspect above.

[0010] In the sixth aspect, an embodiment of the present application also provides a non-temporary machine-readable storage medium, on which executable code is stored. When the executable code is executed by a processor of an electronic device, the processor executes the method described in the first or second aspect above.

[0011] In a seventh aspect, an embodiment of the present application further provides a computer program product, comprising: a computer program, which, when executed by a processor of an electronic device, enables the processor to execute the method described in the first or second aspect above.

[0012] In an embodiment of the present application, by sending a first handshake message to the server and receiving a second handshake message fed back by the server based on the first handshake message, the target algorithm selected by the server from the algorithm list, the server's long-term public key, and the temporary public key generated based on the target algorithm can be obtained, and then the first shared key is encapsulated using the temporary public key based on the set key encapsulation algorithm to obtain the first ciphertext, and the server's long-term public key is encapsulated based on the set key encapsulation algorithm to obtain the second ciphertext and the second shared key corresponding to the second ciphertext. At this time, the client obtains the first shared key and the second shared key. Afterwards, the client sends the first shared key and the second shared key to the server, and the server can perform a decryption operation on the first ciphertext based on the temporary private key corresponding to the temporary public key to obtain the first shared key, and perform a decryption operation on the second ciphertext using the server's long-term private key corresponding to the server's long-term public key to obtain the second shared key. At this time, the server obtains the first shared key and the second shared key. Afterwards, identity authentication and key derivation are performed based on the first shared key and the second shared key to obtain multiple independent keys, and encrypted communication is performed with the server based on multiple independent keys, with low communication overhead and high security. Specifically: First, the client sends a list of algorithms, and the server selects the supported algorithms from them. This design allows the protocol to support multiple encryption algorithms, adapt to different security requirements and environments, and facilitate future upgrades to more secure algorithms.

[0013] Second, by using the first shared key generated by the temporary public key and the temporary private key, even if the server's long-term private key is leaked in the future, the attacker cannot decrypt the previous communication content. This is because the temporary key is only valid in the current session and is discarded after the session ends, ensuring forward security.

[0014] Third, by using the server's long-term public key and signature algorithm, the client can verify the server's identity and prevent man-in-the-middle attacks (MITM). The encapsulation and verification of the server's long-term public key ensures the credibility of both parties in the communication.

[0015] Fourth, by using the Key Encapsulation Mechanism (KEM) to encapsulate the temporary public key and the server's long-term public key, the security of the key exchange process is ensured, and KEM is more efficient, especially when processing a large number of concurrent connections, it can reduce computing overhead.

[0016] Fifth, multiple independent keys are derived from the first shared key and the second shared key through key derivation, which enhances security. In this process, by using two independent shared keys (the first shared key and the second shared key) for key derivation, even if one of the keys is leaked, the other key can still protect the security of communication. In addition, each key can be used for different purposes (such as encryption, authentication, etc.), avoiding the risk of abuse of a single key. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 A flowchart of an authentication and encryption communication method provided in an embodiment of the present application; Figure 2 An application diagram of an authentication and encryption communication method provided in an embodiment of the present application; Figure 3 A schematic diagram of another application of an authentication and encryption communication method provided in an embodiment of the present application; Figure 4 Another flow chart of an authentication and encryption communication method provided in an embodiment of the present application; Figure 5 A schematic diagram of the structure of an authentication and encryption communication device provided in an embodiment of the present application; Figure 6 Another structural diagram of an authentication and encryption communication device provided in an embodiment of the present application; Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0019] Information security technology Transport Layer Cryptography Protocol (TLCP) adopts the method of separating encryption certificates and signature certificates, performs key negotiation and digital signature through algorithms such as SM2 and RSA, and uses symmetric cryptographic algorithms to ensure the confidentiality and integrity of data. However, the emergence of quantum computers poses a serious threat to the existing cryptographic system. Specifically, the Shor algorithm running on quantum computers can crack the discrete logarithm and large integer decomposition problems in polynomial time, and the Grover algorithm running on quantum computers accelerates exhaustive attacks, resulting in public key cryptographic algorithms no longer being safe, and the security strength of symmetric cryptographic algorithms is halved, threatening the security of digital communication systems. At present, in theory, the post-quantum signature scheme can be used to replace the relevant traditional public key cryptographic operations in TLCP. However, when encrypted communication is performed based on the post-quantum signature scheme, a signature needs to be generated and transmitted for each communication, and the signature value is usually long, resulting in a large communication overhead. Therefore, it is urgent to provide an authenticated encryption communication method with low communication overhead and higher security. In view of this, the embodiment of the present application provides an authenticated encryption communication method.

[0020] Figure 1 A flowchart of an authentication encryption communication method provided in an embodiment of the present application, the method is applied to a client, such as Figure 1 As shown, the method includes: 101. Send a first handshake message to a server, where the first handshake message includes an algorithm list, where the algorithm list includes a key encapsulation algorithm supported by the client and a signature algorithm for verifying a long-term public key.

[0021] 102. Receive second handshake information sent by the server, where the second handshake information includes a target algorithm selected by the server from the algorithm list, a server long-term public key, and a temporary public key generated based on the target algorithm.

[0022] 103. Based on the set key encapsulation algorithm, use the temporary public key to encapsulate the first shared key to obtain a first ciphertext, and send the first ciphertext to the server, so that the server decrypts the first ciphertext based on a temporary private key corresponding to the temporary public key to obtain the first shared key.

[0023] 104. Encapsulate the server's long-term public key based on the set key encapsulation algorithm to obtain a second ciphertext and a second shared key corresponding to the second ciphertext, and send the second ciphertext to the server, so that the server decrypts the second ciphertext based on the server's long-term private key corresponding to the server's long-term public key to obtain the second shared key.

[0024] 105. Perform identity authentication and derive keys based on the first shared key and the second shared key to obtain multiple independent keys, and perform encrypted communication with the server based on the multiple independent keys.

[0025] The first handshake information also includes a first random number, and the second handshake information also includes a second random number. It should be understood that by allowing the client and the server to generate random numbers respectively during encrypted communication between the client and the server, the random numbers can be used as the unique identifier of the current session, so that attackers cannot impersonate the client or server by intercepting and replaying old messages, because the random numbers for each session are different. In addition, the first random number and the second random number are used in the key derivation process to ensure that the key generated for each session is unique. Even if the same client and server establish connections multiple times, the generated keys will be different due to different random numbers, thereby enhancing security.

[0026] For ease of understanding, the following Figure 2 The following is a specific example of this solution (mainly divided into two stages): 1. Post-quantum key exchange stage: The client generates a first handshake message ClientHello, which includes a first random number r c (whose length is 0-256 bits) and an algorithm list, which contains the key encapsulation algorithms supported by the client (such as the key generation algorithm , Encapsulation Algorithm and decapsulation algorithms In this process, the key derivation process is initialized. Specifically, the client derives the key through the key derivation function (HMAC-based Extract-and-Expand Key Derivation Function, referred to as HKDF). Specifically, the HKDF.Extract function is first called to generate an initial key material ES using an initial value (usually all zeros). Then, the client uses the HKDF.Expand function to derive the derived key dES from ES for subsequent key derivation. In addition, it should be noted that Figure 2 In and Different algorithm instantiations can be selected.

[0027] After receiving the first handshake message ClientHello, the server generates a second handshake message ServerHello and sends the second handshake message to the client. The second handshake message includes: a second random number r s (whose length is 0-256 bits), and the target algorithm selected in the above algorithm list.

[0028] As an optional implementation, the target algorithm is selected based on the following: 1. Security first: The server will usually give priority to algorithms with higher security. For example, it will give priority to post-quantum secure Kyber-512 instead of traditional ECDH.

[0029] 2. Compatibility: The server will select an algorithm that is supported by both the client and the server. If the client does not support the server's preferred algorithm, the server will select the next supported algorithm in turn.

[0030] 3. Performance considerations: In some cases, the server may select an algorithm based on performance requirements. For example, in a resource-constrained environment, an algorithm with less computational effort may be selected.

[0031] The server sends the server certificate (ServerCertificate) to the client, which contains the server's long-term public key pk s . And, the server uses the KEM algorithm (such as ) Generate a temporary key pair, including (temporary public key pk e , temporary private key sk e ), and sends a message ServerKeyExchange to the client to exchange key materials, which contains the temporary public key pk eAfter that, the server sends a ServerHelloDone message, indicating that ServerHello is finished.

[0032] Afterwards, the client sets the key encapsulation algorithm based on the Key Encapsulation Mechanism (KEM) algorithm. Use temporary public key pk e For the first shared key ss e Encapsulate and get the first ciphertext ct e , and sends a message ServerKeyExchange to the server to exchange key materials. The message contains the first ciphertext ct e .

[0033] The server receives the first ciphertext ct e After that, based on the temporary public key pk e The corresponding temporary private key sk e Using decapsulation algorithm For the first ciphertext ct e Perform decryption operation to obtain the first shared key ss e At this point, both the client and the server obtain a temporary shared key (the first shared key ss e ).

[0034] 2. KEM-based identity authentication stage: The client sets the key encapsulation algorithm For the server's long-term public key pk s Encapsulate and get the second ciphertext ct s And the second ciphertext ct s The corresponding second shared key ss s , and sends a message ClientKemCiphertext to the server for recording the ciphertext, which contains the second ciphertext ct s .

[0035] The server receives the second ciphertext ct s After that, based on the server's long-term public key pk s The corresponding server long-term private key sk s Using decapsulation algorithm For the second ciphertext ct s Perform decryption operation to obtain the second shared key ss s At this point, both the client and the server obtain a shared key for implicit identity authentication (the first shared key ss e ).

[0036] Afterwards, key derivation is performed based on the first shared key and the second shared key to obtain multiple independent keys, such as Figure 2 The first phase key CHTS, the second phase key SHTS, the third phase key CATS and the fourth phase key SATS in the system. After that, identity authentication is performed based on the message generated by the first phase key and the second phase key; after the identity authentication is verified, encrypted communication is performed with the server using the third phase key and the fourth phase key.

[0037] In specific implementation, the client uses the first-stage key CHTS to generate a completion message CF, which contains the MAC value of the ClientHello to ClientKemCiphertext message, and then sends a ClientFinished message. After that, the server verifies the CF. If it is correct, it continues with the subsequent operation. If it is incorrect, it terminates the connection with the client.

[0038] The client continues to derive the third phase key (CATS) for encrypting subsequent application data.

[0039] The server uses the second-stage key SHTS to generate a completion message SF, which contains the MAC value of the ClientHello to ClientFinished messages. At this time, the ServerFinished message is sent. If the client verifies that it is correct, it will continue with the subsequent operations. If it is incorrect, it will terminate the connection with the server.

[0040] The server continues to derive the fourth phase key SATS for encrypting subsequent application data.

[0041] The key derivation process is described in detail below: 1. Early Key (ES): Use HKDF.Extract to generate ES from the initial value.

[0042] ES plays an important role in the PSK mode and 0-RTT mode of TLS 1.3. Here it is only used to keep consistent with the key derivation process of TLS 1.3.

[0043] 2. Handshake Key (HS): Use HKDF.Extract from dES, first shared key ss e , and the second shared key ss s Generate HS (Handshake Secret).

[0044] 3. Traffic key: Generate the Client Handshake Traffic Key (CHTS) and Server Handshake Traffic Key (SHTS) from HS using HKDF.Expand.

[0045] Generate dHS (Derived Handshake Secret) from HS using HKDF.Expand.

[0046] 4. Master Key (MS): Generate MS (Master Secret) from dHS using HKDF.Extract.

[0047] 5. Complete the key: Generate client completion key fk from MS using HKDF.Expand c and the server completes the key fk s .

[0048] for Figure 2 The stage1-stage4 in the code is divided into four stages, as follows: Phase 1: The client sends ClientHello to ClientKeyExchange.

[0049] Phase 2: Server verifies ClientFinished and sends ServerFinished.

[0050] Phase 3: The client verifies ServerFinished and generates an application traffic key.

[0051] Phase 4: The client and server complete the handshake and enter the application data transmission phase.

[0052] Based on the above, the authentication and encryption communication method provided in the embodiment of the present application can obtain the target algorithm selected by the server from the algorithm list, the server's long-term public key, and the temporary public key generated based on the target algorithm by sending a first handshake message to the server and receiving a second handshake message fed back by the server based on the first handshake message, and then encapsulate the temporary public key based on the set key encapsulation algorithm to obtain the first ciphertext and the first shared key corresponding to the first ciphertext, and encapsulate the server's long-term public key based on the set key encapsulation algorithm to obtain the second ciphertext and the second shared key corresponding to the second ciphertext. At this time, the client obtains the first shared key and the second shared key. Afterwards, the client sends the first shared key and the second shared key to the server, and the server can perform a decryption operation on the first ciphertext based on the temporary private key corresponding to the temporary public key to obtain the first shared key, and perform a decryption operation on the second ciphertext through the server's long-term private key corresponding to the server's long-term public key to obtain the second shared key. At this time, the server obtains the first shared key and the second shared key. Afterwards, key derivation is performed based on the first shared key and the second shared key to obtain multiple independent keys, and encrypted communication is performed with the server based on multiple independent keys, with low communication overhead and high security. Specifically: First, the client sends a list of algorithms, and the server selects the supported algorithms from them. This design allows the protocol to support multiple encryption algorithms, adapt to different security requirements and environments, and facilitate future upgrades to more secure algorithms.

[0053] Second, by using the first shared key generated by the temporary public key and the temporary private key, even if the server's long-term private key is leaked in the future, the attacker cannot decrypt the previous communication content. This is because the temporary key is only valid in the current session and is discarded after the session ends, ensuring forward security.

[0054] Third, by using the server's long-term public key and signature algorithm, the client can verify the server's identity and prevent man-in-the-middle attacks (MITM). The encapsulation and verification of the server's long-term public key ensures the credibility of both parties in the communication.

[0055] Fourth, by using KEM to encapsulate temporary public keys and server long-term public keys, the security of the key exchange process is ensured, and KEM is more efficient, especially when processing a large number of concurrent connections, it can reduce computing overhead.

[0056] Fifth, multiple independent keys are derived from the first shared key and the second shared key through key derivation, which enhances security. In this process, by using two independent shared keys (the first shared key and the second shared key) for key derivation, even if one of the keys is leaked, the other key can still protect the security of communication. In addition, each key can be used for different purposes (such as encryption, authentication, etc.), avoiding the risk of abuse of a single key.

[0057] In an embodiment of the present application, in addition to the one-way authentication process (i.e., authentication on the server side) described in the above scheme, two-way authentication (i.e., two-way authentication between the client and the server) can also be performed. Specifically, after sending the first handshake information to the server, the method also includes: if a two-way authentication request sent by the server is received, the client's long-term public key is sent to the server; a third ciphertext sent by the server is received, and the third ciphertext is obtained by the server encapsulating the client's long-term public key based on a third key encapsulation algorithm; based on the client's long-term private key corresponding to the client's long-term public key, the third ciphertext is decrypted to obtain a third shared key; based on the first shared key and the second shared key, a key is derived to obtain multiple independent keys, including: based on the first shared key, the second shared key and the third shared key, a key is derived to obtain multiple independent keys.

[0058] For ease of understanding, the following Figure 3 Let's give a specific example: The client generates a first handshake message ClientHello, which includes a first random number r c (whose length is 0-256 bits) and an algorithm list, which contains the key encapsulation algorithms supported by the client (such as the key generation algorithm , Encapsulation Algorithm and decapsulation algorithms In this process, the key derivation process is initialized. Specifically, the client derives the key through the key derivation function (HMAC-based Extract-and-Expand Key Derivation Function, referred to as HKDF). Specifically, the HKDF.Extract function is first called to generate an initial key material ES using the initial value (usually all zeros). Then, the client uses the HKDF.Expand function to derive the derived key dES from ES for subsequent key derivation. In addition.

[0059] After receiving the first handshake message ClientHello, the server generates a second handshake message ServerHello and sends the second handshake message to the client. The second handshake message includes: a second random number r s (whose length is 0-256 bits), and the target algorithm selected in the above algorithm list.

[0060] As an optional implementation, the target algorithm is selected based on the following: 1. Security first: The server will usually give priority to algorithms with higher security. For example, it will give priority to post-quantum secure Kyber-512 instead of traditional ECDH.

[0061] 2. Compatibility: The server will select an algorithm that is supported by both the client and the server. If the client does not support the server's preferred algorithm, the server will select the next supported algorithm in turn.

[0062] 3. Performance considerations: In some cases, the server may select an algorithm based on performance requirements. For example, in a resource-constrained environment, an algorithm with less computational effort may be selected.

[0063] The server sends the server certificate (ServerCertificate) to the client, which contains the server's long-term public key pk s . And, the server uses the KEM algorithm (such as ) Generate a temporary key pair, including (temporary public key pk e , temporary private key sk e ), and sends a key material exchange message ServerKeyExchange to the client, which contains the temporary public key pk e , and sends a CertificateRequest message to the client, requesting the client to provide a certificate to enable two-way authentication. After that, the server sends a ServerHelloDone message, indicating that ServerHello is over.

[0064] Afterwards, the client sends a ClientCertificate message, which contains the client's long-term public key pk c .

[0065] The client is based on the Key Encapsulation Mechanism (KEM) algorithm, that is, setting the key encapsulation algorithm Use temporary public key pk e For the first shared key ss e Encapsulate and get the first ciphertext ct e, and sends a message ServerKeyExchange to the server to exchange key materials. The message contains the first ciphertext ct e .

[0066] The server receives the first ciphertext ct e After that, based on the temporary public key pk e The corresponding temporary private key sk e Using decapsulation algorithm For the first ciphertext ct e Perform decryption operation to obtain the first shared key ss e At this point, both the client and the server obtain a temporary shared key (the first shared key ss e ).

[0067] The client sets the key encapsulation algorithm For the server's long-term public key pk s Encapsulate and get the second ciphertext ct s And the second ciphertext ct s The corresponding second shared key ss s , and sends a message ClientKemCiphertext to the server for recording the ciphertext, which contains the second ciphertext ct s .

[0068] The server receives the second ciphertext ct s After that, based on the server's long-term public key pk s The corresponding server long-term private key sk s Using decapsulation algorithm For the second ciphertext ct s Perform decryption operation to obtain the second shared key ss s At this point, both the client and the server obtain a shared key for implicit identity authentication (the first shared key ss e ).

[0069] The server sets the key encapsulation algorithm For the client's long-term public key pk c Encapsulate and get the third ciphertext ct c And the third ciphertext ct c The corresponding third shared key ss c , and sends a message ServerKemCiphertext to the client for recording the ciphertext, which contains the third ciphertext ct c .

[0070] The client receives the third ciphertext ct c After that, based on the client's long-term public key pkc The corresponding client long-term private key sk c Using decapsulation algorithm For the third ciphertext ct c Perform decryption operation to obtain the third shared key ss c .

[0071] Afterwards, based on the first shared key ss e , second shared key ss s and the third shared key ss c Perform key derivation to obtain multiple independent keys, such as Figure 3 The first stage key CHTS, the second stage key SHTS, the third stage key CATS and the fourth stage key SATS.

[0072] In specific implementation, the client uses the first-stage key CHTS to generate a completion message CF, which contains the MAC value of the ClientHello to ClientKemCiphertext message, and then sends a ClientFinished message. After that, the server verifies the CF. If it is correct, it continues with the subsequent operation. If it is incorrect, it terminates the connection with the client.

[0073] The client continues to derive the third phase key (CATS) for encrypting subsequent application data.

[0074] The server uses the second-stage key SHTS to generate a completion message SF, which contains the MAC value of the ClientHello to ClientFinished messages. At this time, the ServerFinished message is sent. If the client verifies that it is correct, it will continue with the subsequent operations. If it is incorrect, it will terminate the connection with the server.

[0075] The server continues to derive the fourth phase key SATS for encrypting subsequent application data.

[0076] The key derivation process is described in detail below: 1. Early Key (ES): Use HKDF.Extract to generate ES from the initial value.

[0077] ES plays an important role in the PSK mode and 0-RTT mode of TLS 1.3. Here it is only used to keep consistent with the key derivation process of TLS 1.3.

[0078] 2. Handshake Key (HS): Use HKDF.Extract from dES, first shared key ss e , second shared key ss sand the third shared key ss c Generate HS (Handshake Secret).

[0079] 3. Traffic key: Generate the Client Handshake Traffic Key (CHTS) and Server Handshake Traffic Key (SHTS) from HS using HKDF.Expand.

[0080] Generate dHS (Derived Handshake Secret) from HS using HKDF.Expand.

[0081] 4. Master Key (MS): Generate MS (Master Secret) from dHS using HKDF.Extract.

[0082] 5. Complete the key: Generate client completion key fk from MS using HKDF.Expand c and the server completes the key fk s .

[0083] for Figure 3 The stage1-stage4 in the code is divided into four stages, as follows: Phase 1: The client sends ClientHello to ClientKeyExchange.

[0084] Phase 2: Server verifies ClientFinished and sends ServerFinished.

[0085] Phase 3: The client verifies ServerFinished and generates an application traffic key.

[0086] Phase 4: The client and server complete the handshake and enter the application data transmission phase.

[0087] By using a two-way authentication method, the security of communication between the client and the server can be further improved. Specifically, it should be understood that in two-way authentication, the client also provides a certificate, and the server verifies the client's identity, thereby preventing man-in-the-middle attacks. In this mode, both the client and the server verify the identity of each other to ensure the authenticity of both parties in communication.

[0088] Figure 4 Another flow chart of an authentication encryption communication method provided in an embodiment of the present application, the method is applied to a server, such as Figure 4 As shown, the method includes: 401. Receive first handshake information sent by a client, where the first handshake information includes an algorithm list, and the algorithm list includes a key encapsulation algorithm supported by the client and a signature algorithm for verifying a long-term public key.

[0089] 402. Send second handshake information to the client based on the first handshake information, where the second handshake information includes a target algorithm selected by the server from the algorithm list, a server long-term public key, and a temporary public key generated based on the target algorithm.

[0090] 403. Receive a first ciphertext sent by the client, and decrypt the first ciphertext based on a temporary private key corresponding to the temporary public key to obtain a first shared key, where the first ciphertext is obtained by encapsulating the first shared key using the temporary public key based on a set key encapsulation algorithm.

[0091] 404. Receive a second ciphertext sent by the client, and decrypt the second ciphertext based on the server's long-term private key corresponding to the server's long-term public key to obtain a second shared key. The second ciphertext is obtained by encapsulating the server's long-term public key by the client based on a set key encapsulation algorithm.

[0092] 405. Perform identity authentication and derive keys based on the first shared key and the second shared key to obtain multiple independent keys, and perform encrypted communication with the client based on the multiple independent keys.

[0093] In an optional embodiment, after receiving the first handshake information sent by the client, the method further includes: Send a two-way authentication request to the client; Receive the client's long-term public key sent by the client based on the two-way authentication request; Encapsulating the client's long-term public key based on a third key encapsulation algorithm to obtain a third ciphertext, and sending the third ciphertext to the client, so that the client decrypts the third ciphertext based on a client's long-term private key corresponding to the client's long-term public key to obtain a third shared key; Key derivation is performed based on the first shared key and the second shared key to obtain multiple independent keys, including: Key derivation is performed based on the first shared key, the second shared key, and the third shared key to obtain multiple independent keys.

[0094] In an optional embodiment, the multiple independent keys include: a first stage key, a second stage key, a third stage key and a fourth stage key; after obtaining the multiple independent keys, the method also includes: performing identity authentication based on a message generated by the first stage key and the second stage key; after the identity authentication is verified, performing encrypted communication with the server through the third stage key and the fourth stage key.

[0095] Figure 4 The method shown can execute the steps in the aforementioned embodiments. For detailed execution process and technical effects, please refer to the description in the aforementioned embodiments, which will not be repeated here.

[0096] Figure 5 A schematic diagram of the structure of an encryption communication device provided in an embodiment of the present application, the device is applied to a client, such as Figure 5 As shown, the device comprises: The sending module 51 is used to send first handshake information to the server, where the first handshake information includes an algorithm list, and the algorithm list includes a key encapsulation algorithm supported by the client and a signature algorithm for verifying a long-term public key.

[0097] The receiving module 52 is configured to receive second handshake information sent by the server, wherein the second handshake information includes a target algorithm selected by the server from the algorithm list, a server long-term public key, and a temporary public key generated based on the target algorithm.

[0098] The first encapsulation module 53 is used to encapsulate the first shared key using the temporary public key based on the set key encapsulation algorithm to obtain a first ciphertext, and send the first ciphertext to the server so that the server decrypts the first ciphertext based on a temporary private key corresponding to the temporary public key to obtain the first shared key.

[0099] The second encapsulation module 54 is used to encapsulate the server's long-term public key based on the set key encapsulation algorithm to obtain a second ciphertext and a second shared key corresponding to the second ciphertext, and send the second ciphertext to the server so that the server decrypts the second ciphertext based on the server's long-term private key corresponding to the server's long-term public key to obtain the second shared key.

[0100] The authentication module 55 is configured to perform identity authentication based on the first shared key and the second shared key.

[0101] The encryption communication module 56 is used to derive a key based on the first shared key and the second shared key to obtain multiple independent keys, and perform encryption communication with the server based on the multiple independent keys.

[0102] Optionally, the device also includes: a decryption module, which is used to send the client's long-term public key to the server if a two-way authentication request sent by the server is received; receive a third ciphertext sent by the server, and the third ciphertext is obtained by the server after encapsulating the client's long-term public key based on a third key encapsulation algorithm; decrypt the third ciphertext based on the client's long-term private key corresponding to the client's long-term public key to obtain a third shared key; the encryption communication module 56 is specifically used to: derive keys based on the first shared key, the second shared key and the third shared key to obtain multiple independent keys.

[0103] Optionally, the multiple independent keys include: a first stage key, a second stage key, a third stage key and a fourth stage key, and the device also includes: an authentication module, used to perform identity authentication based on the message generated by the first stage key and the second stage key; after the identity authentication is verified, encrypted communication is performed with the server through the third stage key and the fourth stage key.

[0104] Figure 5 The device shown can execute the steps in the aforementioned embodiments. For detailed execution process and technical effects, please refer to the description in the aforementioned embodiments, which will not be repeated here.

[0105] Figure 6 Another structural diagram of an encryption communication device provided in an embodiment of the present application, the device is applied to a server, such as Figure 6 As shown, the device comprises: The receiving module 61 is configured to receive first handshake information sent by a client, wherein the first handshake information includes an algorithm list, wherein the algorithm list includes a key encapsulation algorithm supported by the client and a signature algorithm for verifying a long-term public key.

[0106] The sending module 62 is used to send second handshake information to the client based on the first handshake information, where the second handshake information includes a target algorithm selected by the server from the algorithm list, a server long-term public key, and a temporary public key generated based on the target algorithm.

[0107] The first decryption module 63 is used to receive the first ciphertext sent by the client, and decrypt the first ciphertext based on the temporary private key corresponding to the temporary public key to obtain a first shared key. The first ciphertext is obtained by the client using the temporary public key to encapsulate the first shared key based on a set key encapsulation algorithm.

[0108] The second decryption module 64 is used to receive the second ciphertext sent by the client, and decrypt the second ciphertext based on the server long-term private key corresponding to the server long-term public key to obtain a second shared key. The second ciphertext is obtained by the client encapsulating the server long-term public key based on the set key encapsulation algorithm.

[0109] The authentication module 65 is configured to perform identity authentication based on the first shared key and the second shared key.

[0110] The encryption communication module 66 is used to derive a key based on the first shared key and the second shared key to obtain multiple independent keys, and perform encryption communication with the server based on the multiple independent keys.

[0111] Optionally, the device also includes: a decryption module, used to send a two-way authentication request to the client; receive a client long-term public key sent by the client based on the two-way authentication request; encapsulate the client long-term public key based on a third key encapsulation algorithm to obtain a third ciphertext, and send the third ciphertext to the client, so that the client decrypts the third ciphertext based on the client long-term private key corresponding to the client long-term public key to obtain a third shared key; the encryption communication module 66 is specifically used to: perform key derivation based on the first shared key, the second shared key and the third shared key to obtain multiple independent keys.

[0112] Optionally, the multiple independent keys include: a first stage key, a second stage key, a third stage key and a fourth stage key, and the device also includes: an authentication module, used to perform identity authentication based on the message generated by the first stage key and the second stage key; after the identity authentication is verified, encrypted communication is performed with the server through the third stage key and the fourth stage key.

[0113] Figure 6 The device shown can execute the steps in the aforementioned embodiments. For detailed execution process and technical effects, please refer to the description in the aforementioned embodiments, which will not be repeated here.

[0114] Based on the above, the embodiment of the present application is equivalent to proposing a post-quantum TLCP protocol based on KEM identity authentication-the KEMTLCP protocol. The basic protocol of the KEMTLCP protocol is a one-way authentication protocol (server identity authentication), and optional client identity authentication is called a two-way identity authentication protocol. The characteristics of the KEMTLCP protocol are: no dual certificates are required, only a single certificate is required, which is called a KEM certificate. The public key stored in the KEM certificate is the KEM public key. The KEMTLCP protocol uses a key encapsulation mechanism to complete key negotiation and identity authentication, and no longer relies on the inefficient and expensive post-quantum signature mechanism for identity authentication.

[0115] The present application also provides an electronic device, such as Figure 7 As shown, the electronic device may include: a processor 71, a memory 72, and a communication interface 73. The memory 72 stores executable codes, and when the executable codes are executed by the processor 71, the processor 71 implements the encryption communication method in the above-mentioned embodiment.

[0116] In addition, an embodiment of the present application provides a non-temporary machine-readable storage medium, on which executable code is stored. When the executable code is executed by a processor of an electronic device, the processor can at least implement the encryption communication method provided in the aforementioned embodiment.

[0117] An embodiment of the present application provides a computer program product, which includes: a computer program, when the computer program is executed by a processor of an electronic device, the processor executes the encryption communication method provided in the above-mentioned embodiment.

[0118] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0119] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0120] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0121] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0122] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0123] Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0124] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0125] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0126] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. An authenticated encryption communication method, characterized in that: Applied to a client, the method comprises: Sending a first handshake message to the server, wherein the first handshake message includes an algorithm list, wherein the algorithm list includes a key encapsulation algorithm supported by the client and a signature algorithm for verifying a long-term public key; receiving second handshake information sent by the server, wherein the second handshake information includes a target algorithm selected by the server from the algorithm list, a server long-term public key, and a temporary public key generated based on the target algorithm; Based on the set key encapsulation algorithm, encapsulate the first shared key using the temporary public key to obtain a first ciphertext, and send the first ciphertext to the server, so that the server performs a decryption operation on the first ciphertext based on a temporary private key corresponding to the temporary public key to obtain the first shared key; encapsulating the server long-term public key based on a set key encapsulation algorithm to obtain a second ciphertext and a second shared key corresponding to the second ciphertext, and sending the second ciphertext to the server, so that the server performs a decryption operation on the second ciphertext based on a server long-term private key corresponding to the server long-term public key to obtain the second shared key; Identity authentication and key derivation are performed based on the first shared key and the second shared key to obtain multiple independent keys, and encrypted communication is performed with the server based on the multiple independent keys.

2. The method according to claim 1, characterized in that After sending the first handshake information to the server, the method further includes: If a two-way authentication request is received from the server, the client's long-term public key is sent to the server; Receiving a third ciphertext sent by the server, where the third ciphertext is obtained by encapsulating the client's long-term public key by the server based on a third key encapsulation algorithm; Decrypting the third ciphertext based on the client long-term private key corresponding to the client long-term public key to obtain a third shared key; The key derivation based on the first shared key and the second shared key to obtain multiple independent keys includes: Key derivation is performed based on the first shared key, the second shared key, and the third shared key to obtain multiple independent keys.

3. The method according to claim 1 or 2, characterized in that: The multiple independent keys include: a first-stage key, a second-stage key, a third-stage key, and a fourth-stage key; and performing encrypted communication with the server based on the multiple independent keys includes: Performing identity authentication based on a message generated by the first-stage key and the second-stage key; After the identity authentication is verified, encrypted communication is performed with the server using the third-stage key and the fourth-stage key.

4. An authenticated encryption communication method, characterized in that: Applied to a server, the method comprises: Receive first handshake information sent by the client, where the first handshake information includes an algorithm list, where the algorithm list includes a key encapsulation algorithm supported by the client and a signature algorithm for verifying a long-term public key; Sending second handshake information to the client based on the first handshake information, where the second handshake information includes a target algorithm selected by the server from the algorithm list, a server long-term public key, and a temporary public key generated based on the target algorithm; Receive a first ciphertext sent by the client, and decrypt the first ciphertext based on a temporary private key corresponding to the temporary public key to obtain a first shared key, wherein the first ciphertext is obtained by encapsulating the first shared key by the client using the temporary public key based on a set key encapsulation algorithm; receiving a second ciphertext sent by the client, and performing a decryption operation on the second ciphertext based on a server long-term private key corresponding to the server long-term public key to obtain a second shared key, wherein the second ciphertext is obtained by encapsulating the server long-term public key by the client based on a set key encapsulation algorithm; Identity authentication and key derivation are performed based on the first shared key and the second shared key to obtain multiple independent keys, and encrypted communication is performed with the client based on the multiple independent keys.

5. The method according to claim 4, characterized in that After receiving the first handshake information sent by the client, the method further includes: Sending a two-way authentication request to the client; Receiving a client long-term public key sent by the client based on the two-way authentication request; Encapsulating the client long-term public key based on a third key encapsulation algorithm to obtain a third ciphertext, and sending the third ciphertext to the client, so that the client decrypts the third ciphertext based on a client long-term private key corresponding to the client long-term public key to obtain a third shared key; The key derivation based on the first shared key and the second shared key to obtain multiple independent keys includes: Key derivation is performed based on the first shared key, the second shared key, and the third shared key to obtain multiple independent keys.

6. The method according to claim 4 or 5, characterized in that: The multiple independent keys include: a first-stage key, a second-stage key, a third-stage key, and a fourth-stage key; and the encrypted communication with the server based on the multiple independent keys includes: Performing identity authentication based on a message generated by the first-stage key and the second-stage key; After the identity authentication is verified, encrypted communication is performed with the server using the third-stage key and the fourth-stage key.

7. An authenticated encryption communication device, characterized in that: Applied to a client, the device comprises: A sending module, configured to send first handshake information to a server, wherein the first handshake information includes an algorithm list, wherein the algorithm list includes a key encapsulation algorithm supported by the client and a signature algorithm for verifying a long-term public key; A receiving module, configured to receive second handshake information sent by the server, wherein the second handshake information includes a target algorithm selected by the server from the algorithm list, a server long-term public key, and a temporary public key generated based on the target algorithm; A first encapsulation module is configured to encapsulate the first shared key using the temporary public key based on a set key encapsulation algorithm to obtain a first ciphertext, and send the first ciphertext to the server, so that the server performs a decryption operation on the first ciphertext based on a temporary private key corresponding to the temporary public key to obtain the first shared key; A second encapsulation module is used to encapsulate the server long-term public key based on a set key encapsulation algorithm to obtain a second ciphertext and a second shared key corresponding to the second ciphertext, and send the second ciphertext to the server, so that the server performs a decryption operation on the second ciphertext based on a server long-term private key corresponding to the server long-term public key to obtain the second shared key; an authentication module, configured to perform identity authentication based on the first shared key and the second shared key; An encryption communication module is used to derive a key based on the first shared key and the second shared key to obtain multiple independent keys, and perform encryption communication with the server based on the multiple independent keys.

8. An electronic device, characterized in that: include: A memory, a processor, and a communication interface; wherein the memory stores executable code, and when the executable code is executed by the processor, the processor executes the authenticated encryption communication method as described in any one of claims 1 to 3, or any one of claims 4 to 6.

9. A non-transitory machine-readable storage medium, characterized in that: The non-transitory machine-readable storage medium stores executable code, and when the executable code is executed by a processor of an electronic device, the processor executes the authenticated encryption communication method as described in any one of claims 1 to 3, or any one of claims 4 to 6.

10. A computer program product, characterized in that include: A computer program, when executed by a processor of an electronic device, causes the processor to execute the authenticated encryption communication method according to any one of claims 1 to 3, or any one of claims 4 to 6.

Images