Equipment for performing entity identification by adopting quantum random number and entity identification method thereof

Abstract

The invention relates to a quantum communication technology, and discloses equipment for performing entity identification by adopting a quantum random number and an entity identification method thereof. The entity identification method comprises the steps that a first verification sequence is generated, the first verification sequence is obtained based on a quantum random number sequence, and the quantum random number sequence is shared by a purchaser and a verifier through QKDN or QKR; and the first verification sequence is sent to a verification party, so that the entity identifies the pursuit party, and the verification party verifies the first verification sequence based on a second verification sequence generated by the quantum random number sequence. According to the method, the verification sequence is generated by using the quantum random number sequence to perform entity identification, so that the complexity of traditional encryption and decryption operation is avoided, the calculation time is remarkably shortened, the risk of being cracked is avoided, and the security and reliability of entity identification are enhanced.

Description

Technical Field

[0001] The present application relates to quantum communication technology, and in particular to a device and an entity authentication method using quantum random numbers. Background Art

[0002] In real-time communication systems, entity authentication plays a vital role as a basic security service. Its core purpose is to verify whether an entity is who it claims to be. Specifically, in a one-way authentication scenario, entity A plays the role of the claimant, and entity B is the verifier; in contrast, in a two-way authentication scenario, entity A and entity B are the claimant and verifier to each other. During the authentication process, both parties generate and exchange a standardized message, namely a token. One-way authentication involves at least the exchange of one token, while two-way authentication requires at least the exchange of two tokens. If the authentication mechanism is initiated by sending a challenge, an additional transfer is required.

[0003] At present, the entity authentication mechanisms mainly include the following methods: authentication mechanism using symmetric encryption algorithm, authentication mechanism based on digital signature technology and authentication mechanism using cryptographic verification function. The common feature of these mechanisms is that entity A and entity B share a key KAB, and encrypt and decrypt the specified data based on the key to verify the identity of the entity.

[0004] However, this entity authentication mechanism has certain limitations. On the one hand, encryption and decryption operations take a certain amount of time, which may affect the performance of the system; on the other hand, the encryption algorithm itself has the risk of being cracked, thus posing a potential threat to the security of the system. Summary of the invention

[0005] The present application aims to provide a device and entity authentication method using quantum random numbers. The method avoids the complexity of traditional encryption and decryption operations, thereby significantly reducing the calculation time. At the same time, it effectively eliminates the risk of being cracked and enhances security and reliability.

[0006] To solve the above technical problems, at least one embodiment of the present application provides an entity authentication method, applicable to a claiming party, comprising: generating a first verification sequence, wherein the first verification sequence is obtained based on a quantum random number sequence, and the quantum random number sequence is shared by the claiming party and the verifier via QKDN or QKR; sending the first verification sequence to the verifier, thereby entity authenticating the claiming party, wherein the verifier verifies the first verification sequence based on a second verification sequence generated by the quantum random number sequence.

[0007] At least one embodiment of the present application provides an entity authentication method, applicable to a verifier, comprising: obtaining a first verification sequence from a claiming party, wherein the first verification sequence is generated by the claiming party based on a quantum random number sequence, and the quantum random number sequence is shared by the claiming party and the verifier via QKDN or QKR; generating a second verification sequence to verify the first verification sequence, wherein the second verification sequence is obtained based on the quantum random number sequence.

[0008] At least one embodiment of the present application provides an entity authentication method, applicable to a claiming party, comprising: receiving a verification notification from a verifier, wherein the verification notification instructs the claiming party to obtain a quantum random number sequence from a QKDN or a QKR; generating a first verification sequence, wherein the first verification sequence is obtained based on the quantum random number sequence, and the quantum random number sequence is shared by the claiming party and the verifier via the QKDN or the QKR; sending the first verification sequence to the verifier, thereby entity authenticating the claiming party, wherein the verifier verifies the first verification sequence based on a second verification sequence generated by the quantum random number sequence.

[0009] At least one embodiment of the present application provides an entity authentication method, applicable to a verifier, comprising: sending a verification notification, wherein the verification notification instructs the claiming party to obtain a quantum random number sequence from a QKDN or a QKR; obtaining a first verification sequence from the claiming party, wherein the first verification sequence is generated by the claiming party based on the quantum random number sequence, and the quantum random number sequence is shared by the claiming party and the verifier via the QKDN or the QKR; generating a second verification sequence to verify the first verification sequence, wherein the second verification sequence is obtained based on the quantum random number sequence.

[0010] At least one embodiment of the present application provides an entity authentication method, applicable to a claiming party, comprising: generating a first check sequence, wherein the first check sequence is obtained based on a quantum random number sequence, and the quantum random number sequence is shared by the claiming party and the verification party via QKDN or QKR; sending the first check sequence to the verification party, thereby entity authenticating the claiming party, wherein the verification party verifies the first check sequence based on a second check sequence generated by the quantum random number sequence; receiving a third check sequence, thereby entity authenticating the verification party, wherein the claiming party verifies the third check sequence based on a fourth check sequence generated by the quantum random number sequence, and the third check sequence is obtained by the verification party based on the quantum random number sequence.

[0011] At least one embodiment of the present application provides an entity authentication method, applicable to a verifier, comprising: obtaining a first verification sequence from a claiming party, wherein the first verification sequence is generated by the claiming party based on a quantum random number sequence, and the quantum random number sequence is shared by the claiming party and the verifier via QKDN or QKR; generating a second verification sequence to verify the first verification sequence, wherein the second verification sequence is obtained based on the quantum random number sequence; sending a third verification sequence, thereby entity authenticating the verifier, wherein the claiming party verifies the third verification sequence based on a fourth verification sequence generated by the quantum random number sequence, and the third verification sequence is obtained by the verifier based on the quantum random number sequence.

[0012] At least one embodiment of the present application provides an entity authentication method, applicable to a claimant, comprising: receiving a verification notification from a verifier, wherein the verification notification instructs the claimant to obtain a quantum random number sequence from a QKDN or a QKR; generating a first verification sequence, wherein the first verification sequence is obtained based on a quantum random number sequence, and the quantum random number sequence is shared by the claimant and the verifier via the QKDN or the QKR; sending the first verification sequence to the verifier, thereby entity authenticating the claimant, wherein the verifier verifies the first verification sequence based on a second verification sequence generated by the quantum random number sequence; receiving a third verification sequence, thereby entity authenticating the verifier, wherein the claimant verifies the third verification sequence based on a fourth verification sequence generated by the quantum random number sequence, and the third verification sequence is obtained by the verifier based on the quantum random number sequence.

[0013] At least one embodiment of the present application provides an entity authentication method, applicable to a verifier, comprising: sending a verification notification, wherein the verification notification instructs the claiming party to obtain a quantum random number sequence from a QKDN or a QKR; obtaining a first verification sequence from the claiming party, wherein the first verification sequence is generated by the claiming party based on the quantum random number sequence, and the quantum random number sequence is shared by the claiming party and the verifier via the QKDN or the QKR; generating a second verification sequence to verify the first verification sequence, wherein the second verification sequence is obtained based on the quantum random number sequence; sending a third verification sequence, thereby entity authenticating the verifier, wherein the claiming party verifies the third verification sequence based on a fourth verification sequence generated by the quantum random number sequence, and the third verification sequence is obtained by the verifier based on the quantum random number sequence.

[0014] At least one embodiment of the present application provides a device for entity authentication using quantum random numbers, comprising: at least one processor; and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the above-mentioned entity authentication method.

[0015] At least one embodiment of the present application provides a computer-readable storage medium storing a computer program, wherein the computer program implements the above-mentioned entity authentication method when executed by a processor.

[0016] At least one embodiment of the present application provides a system for entity authentication using quantum random numbers, the system comprising: the above-mentioned device for entity authentication using quantum random numbers, wherein the device comprises a claiming party device and a verifying party device; a quantum key distribution network or QKR device, wherein the quantum key distribution network or QKR device is used to generate and distribute quantum random number sequences to ensure that the claiming party and the verifier share the same sequence.

[0017] Compared with the prior art, the implementation method of the present application is that in the present application, the claiming party generates a first verification sequence based on a quantum random number sequence and sends it to the verifying party. After receiving the first verification sequence, the verifying party generates a second verification sequence based on the quantum random number sequence shared by both parties, which is used to verify the first verification sequence, thereby completing the entity authentication of the claiming party. By using a quantum random number sequence to generate a verification sequence for entity authentication, the present application avoids the complexity of traditional encryption and decryption operations, significantly reduces the calculation time, effectively eliminates the risk of being cracked, and enhances the security and reliability of entity authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0019] Figure 1 It is a schematic diagram of the structure of a system for entity authentication using quantum random numbers provided in an embodiment of the present application; Figure 2 It is a schematic diagram of the structure of a device for entity authentication using quantum random numbers provided in an embodiment of the present application; Figure 3 is a flow chart of an entity identification method provided in an embodiment of the present application; Figure 4 It is a schematic diagram of a verification sequence involved in an entity identification method provided in an embodiment of the present application; Figure 5 It is a schematic diagram of a verification sequence interception method involved in an entity authentication method provided in another embodiment of the present application; Figure 6 It is a schematic diagram of a verification sequence interception method involved in an entity authentication method provided in another embodiment of the present application; Figure 7 is a flow chart of an entity identification method provided by another embodiment of the present application; Figure 8 is a flow chart of an entity identification method provided by another embodiment of the present application; Fig. 9 is a flow chart of an entity identification method provided by another embodiment of the present application; Fig.10 This is a flowchart of an entity identification method provided by another embodiment of the present application. DETAILED DESCRIPTION

[0020] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the present application, many technical details are proposed in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can also be implemented. The division of the following embodiments is for the convenience of description, and the specific implementation of the present application should not be construed as any limitation, and the various embodiments can be combined and referenced with each other under the premise of no contradiction.

[0021] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0022] In view of the technical problems that the encryption and decryption operations of the current entity authentication mechanism may affect the system performance, and the encryption algorithm is at risk of being cracked, thereby posing a potential threat to the security of the system, the embodiment of the present application provides a system that uses quantum random numbers for entity authentication, such as Figure 1As shown, the system includes: a quantum key distribution network (Quantum Key Distribution Network, QKDN) or a quantum key routing cipher (Quantum Key Route, QKR), the QKDN or QKR device is used to generate and distribute (or provide) a quantum random number sequence to ensure that the claimant and the verifier share the same sequence. In addition, QKDN or QKR generates or provides a quantum random number sequence with a high entropy value, and securely distributes the quantum random number sequence to the claimant device and the verifier device through a quantum channel.

[0023] Among them, QKDN distributes quantum random number sequences to devices that use quantum random numbers for entity authentication through the Key Management Terminal (KMT). Different quantum key distribution (QKD) local area networks are interconnected through the QKD backbone network, and different key management terminals maintain quantum keys through the Key Management Service (KMS). QKDN ensures the security of the entity authentication process by generating true random numbers to prevent it from being cracked. In addition, QKDN can achieve end-to-end key distribution in multi-user scenarios, which is suitable for key distribution of multi-user devices in the domain, providing reliable and secure protection for entity authentication. By distributing keys through quantum channels, QKDN improves the efficiency of key distribution, especially in multi-user environments, and can effectively support large-scale, distributed key distribution needs.

[0024] Among them, QKR can directly distribute quantum random number sequences to devices that use quantum random numbers for entity authentication. The QKR is connected to QKD through quantum key management (QKM), and can provide business applications with secure, flexible, and highly available quantum key production and distribution management services, meeting the key protection and key lifecycle management requirements of various cryptographic applications. It can realize the integration and docking of satellite and optical fiber quantum key distribution networks, provide security isolation functions between different business networks, and provide users with a variety of key service modes.

[0025] A device that uses quantum random numbers for entity authentication, wherein the device includes a claimant device and a verifier device. The claimant device and the verifier device are respectively connected to different QKR device nodes, and the different QKR device nodes are paired through a dynamic end-to-end key method. By sharing a key pool and the same offset value, they can negotiate to share the same quantum random number sequence; or, the claimant device and the verifier device are respectively connected to different KMT nodes in QKDN, and different KMT device nodes use the key management service mode to complete the pairing using a session mechanism, and provide the claimant device to the verifier device through a key application interface The same quantum random number sequence is provided, and a key consistency check callback method is used to ensure that the quantum random number sequences of both parties are exactly the same. At the same time, a communication connection is established between the claimant device and the verifier device. The claimant device and the verifier device not only support identity authentication and pairing to ensure the legitimacy of the communicating parties, but also can calculate the summary value of the quantum random number sequence and compare the summary values ​​of both parties to ensure the consistency and integrity of the data.

[0026] Among them, the device that uses quantum random numbers for entity authentication, such as Figure 2 As shown, it includes: at least one processor; and a memory connected to the at least one processor in communication, wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the entity authentication method provided by the embodiment of the present application (this article will be elaborated in detail later and will not be repeated here), the entity authentication method includes one-way authentication and two-way authentication, the one-way authentication includes one transfer and two transfers, and the two-way authentication includes two transfers and three transfers.

[0027] Among them, the memory and the processor are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories together. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art, so this article will not further describe them. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor is transmitted on a wireless medium through an antenna, and further, the antenna also receives data and transmits the data to the processor. The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. The memory can be used to store data used by the processor when performing operations.

[0028] At the same time, an embodiment of the present application also provides a computer-readable storage medium, which can be built into a device that uses quantum random numbers for entity authentication, and is used to store a computer program, wherein the computer program, when executed by a processor, implements the entity authentication method provided by an embodiment of the present application (this article will explain in detail later and will not be repeated here). The entity authentication method includes one-way authentication and two-way authentication. The one-way authentication includes one transmission and two transmissions, and the two-way authentication includes two transmissions and three transmissions.

[0029] Those skilled in the art can understand that all or part of the steps in the above embodiments or the following embodiments can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0030] Through the above-mentioned method of the present application, a system using quantum random numbers for entity authentication and a device using quantum random numbers for entity authentication are established, thereby enabling entity authentication based on quantum random numbers to be carried out based on the system or device, thereby avoiding the complexity of traditional encryption and decryption operations, significantly reducing the calculation time, effectively eliminating the risk of being cracked, and enhancing the security and reliability of entity authentication.

[0031] In the above-mentioned software and hardware operating environment, in view of the technical problems that the encryption and decryption operations in the current entity authentication mechanism may affect the system performance and the encryption algorithm has the risk of being cracked, the embodiment of the present application provides an entity authentication method, which includes one-way authentication and two-way authentication, the one-way authentication includes one transfer and two transfers, and the two-way authentication includes two transfers and three transfers, which are executed by the processor of the device that uses quantum random numbers for entity authentication, and the entity authentication is performed by using the quantum random number sequence to generate the verification sequence, thereby avoiding the complexity of traditional encryption and decryption operations, eliminating the risk of being cracked, and improving the performance and security of the system. In order to facilitate the understanding of the entity authentication method provided by the embodiment of the present application, the following will be based on the one-way authentication one-time transfer, and combined with its different implementation processes, to explain the one-way authentication two transfers, two transfers and three transfers.

[0032] The first part is one-way authentication. The following will explain the one-way authentication of the claiming device and the verifying device in turn.

[0033] For example, the device that uses quantum random numbers for entity authentication is a claiming party device (referred to as "claiming party"). In some embodiments, the entity authentication method involves a one-way authentication transmission. In this case, the flow chart is as follows: Figure 3 As shown, the following steps are included.

[0034] Step 301: Generate a first verification sequence, wherein the first verification sequence is obtained based on a quantum random number sequence, and the quantum random number sequence is shared by the claiming party and the verifying party via QKDN or QKR.

[0035] Step 304: Send the first verification sequence to the verifier, so as to entity authenticate the claimant, wherein the verifier verifies the first verification sequence based on the second verification sequence generated by the quantum random number sequence.

[0036] Through the above-mentioned method of the present application, in the one-way authentication one-time transfer authentication mechanism, the claiming party initiates this process and is authenticated by the verifying party, that is, the claiming party generates a first verification sequence based on the quantum random number sequence and sends it to the verifying party. After receiving the first verification sequence, the verifier generates a second verification sequence based on the quantum random number sequence shared by both parties, which is used to verify the first verification sequence, thereby completing the one-way entity authentication of the claiming party. In view of the problems that encryption and decryption operations in traditional entity authentication mechanisms may affect system performance and encryption algorithms are easily cracked, the one-way authentication one-time transfer authentication mechanism uses the high entropy and uniqueness of quantum random number sequences to achieve lightweight authentication without encryption operations, solving the problem that traditional entity authentication relies on encryption algorithms, resulting in high computational overhead and easy prediction of pseudo-random numbers, thereby improving the security and performance of the system. To facilitate those skilled in the art to better understand Figure 3 The entity identification method shown in the figure will be further described below.

[0037] In step 301, a first verification sequence is generated. This can be achieved by obtaining a quantum random number sequence from QKDN or QKR; and intercepting a number of data segments of a specified length from the quantum random number sequence according to a preset interception rule as the first verification sequence.

[0038] In some examples, a quantum random number sequence can be obtained from QKDN or QKR. The specific process is as follows: the claimant applies for an identity from QKDN or QKR, and sends the identity to the verifier, wherein the verifier generates a verification profile based on the identity, and shares the verification profile with the claimant, and the verification profile includes at least a preset interception rule, the identity of the claimant, and the identity of the claimant; the identity of the claimant is submitted to QKDN or QKR to obtain a quantum random number sequence, wherein QKDN or QKR pairs the identity of the claimant with the identity of the claimant, generates a quantum random number sequence if the pairing is successful, and distributes the quantum random number sequence to the claimant and the verifier through a quantum channel.

[0039] That is to say: first, the claimant applies for the identity identifier IDA from QKDN or QKR, and at the same time applies for the identity identifier IDB of the verifier. After obtaining IDA, the claimant applies to the verifier for identity authentication configuration based on the identifier. The verifier generates a verification configuration file in JSON format based on the claimant's identity identifier and the verifier's identity identifier, and sends it to the claimant offline or by mail. The claimant then logs in to the background system, imports the configuration file and stores it in the system hard disk. The verification configuration file should at least contain the preset interception rules, the claimant's identity identifier IDA and the claimant's identity identifier IDB.

[0040] Secondly, after the claimant obtains the claimant's identity ID B, the IDB is uploaded through the distribution application interface of QKDN or QKR, and the QKDN or QKR device completes the pairing of the claimant and the verifier. After the pairing is successful, the claimant applies for the quantum random number sequence distributed through QKDN or QKR through negotiation with the verifier. After QKDN or QKR generates the quantum random number sequence, it distributes the same random number content with a length of K bytes to the claimant and the verifier through the quantum channel in a callback manner, where K is a positive integer. At this point, the claimant and the verifier have obtained the same quantum random number sequence that is shared only by both parties. This application achieves end-to-end security through identity identification and verification profiles to ensure that both parties can securely obtain and synchronize quantum random numbers.

[0041] Finally, after the claimant and the verifier obtain the quantum random number sequence through the quantum channel, it also includes requesting QKDN or QKR to perform a consistency check, wherein QKDN or QKR performs a consistency check on the summary value of the quantum random number sequence through a consistency check interface, and if the consistency check passes, the claimant and the verifier are notified to save the quantum random number sequence and the summary value.

[0042] After receiving the quantum random number sequence, the claimant calls the consistency verification interface of QKDN or QKR and requests the QKDN or QKR device to calculate the summary value of the quantum random number sequence. Subsequently, QKDN or QKR notifies the verifier to call the same consistency verification interface through a callback method to verify the quantum random number sequence of the verifier. After the QKDN or QKR device completes the verification of the quantum random number series of the claimant and the verifier, it notifies both parties that the summary values ​​of the quantum random number sequences are completely consistent, and returns the summary values ​​to the claimant and the verifier. At this point, the claimant and the verifier have completed the negotiation process of the same binary quantum random number sequence. At the same time, the claimant and the verifier respectively save the value of the distributed quantum random number sequence and its summary value in the memory. In this way, the present application uses the summary value comparison of the quantum random number sequence to ensure the integrity of the data and prevent the quantum random number from being tampered with or interfered with by noise during the distribution process.

[0043] In some examples, several data segments of a specified length are intercepted from a quantum random number sequence according to a preset interception rule as a first verification sequence. This can be achieved in the following manner: the preset interception rule includes a first interception rule, a second interception rule and a third interception rule; according to the first interception rule, a first random number segment of a first length is sequentially intercepted from the quantum random number sequence as a first verification sequence; or according to the second interception rule, a second random number segment of a second length and a second random number segment of a third length are sequentially intercepted from the quantum random number sequence, and a fourth random number segment is obtained by performing an XOR operation on the second random number segment and the timestamp, and the second random number segment and the fourth random number segment are spliced ​​as the first verification sequence; or according to the third interception rule, a quantum random number sequence block belonging to itself in the quantum random number sequence is obtained, and a fifth random number segment of a fifth length is sequentially intercepted from the quantum random number sequence block as the first verification sequence, wherein the quantum random number sequence is divided into multiple blocks and respectively allocated to the claimant and the verifier. It should be noted that the preset interception rule includes at least the cursor starting position and the intercepted sequence length. For the claimant, the following three methods can be used to generate the first verification sequence.

[0044] Method 1: Direct interception method (first interception rule). Figure 4 and Figure 5 As shown, from the index starting position of the quantum random number sequence (such as Figure 4 Starting from O), random number segments E1 with a length of K are sequentially intercepted and used as the verification sequence.

[0045] Method 2: Combine the interception method with the timestamp (second interception rule). Figure 4 and Figure 6As shown, starting from the cursor start position of the quantum random number sequence, a random number segment X1 with a length of K and a random number segment Y1 with a length of M are obtained in sequence; the random number segment Y1 is XORed with the binary sequence corresponding to the current time of the claimant to obtain the sequence Z1; then the random number segment X1 and the sequence Z1 are concatenated to form the verification sequence E1. By introducing the timestamp, the uniqueness of the verification sequence is further ensured.

[0046] In view of the fact that the claimant and the verifier share the same quantum random number sequence in method 1 and method 2, they intercept random numbers of fixed length in sequence as identity identifiers and put them into the messages sent to the other party. However, there is a problem in this way. The claimant may send two or more messages to the verifier in succession. For example, at a certain moment, the claimant sends a message to the verifier. When the claimant does not receive feedback from the verifier, the claimant generates and sends another message to the verifier. This may cause the claimant and the verifier to intercept and use the same random number, which not only causes confusion in identity identifiers, but also the receiver cannot determine whether the message is sent by the real other party or a replay attack sent by the attacker. In order to avoid the above problems, method 3 can be used.

[0047] Method three, quantum random number sequence block interception method (third interception rule). After the claimant and the verifier generate the same quantum random number sequence, the random number sequence is divided into blocks according to the specified size, for example, 1024B is a block, so that the quantum random number sequence is divided into multiple blocks and labeled, and then these quantum random number sequence blocks are allocated to the claimant and the verifier, requiring that a quantum random number sequence block can only be allocated to the claimant or the verifier, and cannot be allocated to the claimant and the verifier at the same time. Therefore, the claimant intercepts and uses quantum random numbers from the random number block with the smallest label belonging to itself in sequence. When all the quantum random numbers in the quantum random number sequence block are used, the next random number block belonging to the claimant is used. Similarly, after the verifier receives the message sent by the claimant, it makes a judgment based on the quantum random number in the quantum random number sequence block belonging to the claimant. The process of the verifier sending and the claimant receiving is the same as the above process. Through method three, the risk of identification confusion and replay attack caused by the claimant and the verifier sending the same quantum random number sequence is avoided.

[0048] It is also necessary to explain how to distribute the quantum random number sequence blocks to the claimant and the verifier. At the same time, the claimant and the verifier need to know which ones are theirs and which ones are the other party's. Possible solutions include but are not limited to the following methods.

[0049] 1. Designated method. This method requires a central management node to perform unified management and allocation, and inform the claimant and the verifier of the results through some kind of management signaling.

[0050] 2. Autonomous. This method does not require a central management node, and is generated by the claimant and the verifier through negotiation. For example, at the beginning, or when a new quantum random number sequence block is enabled, the claimant selects the first quantum random number from the quantum random number sequence block and sends it to the verifier. After receiving the message, the verifier defines the quantum random number sequence block as a data block subordinate to the claimant, and intercepts the second quantum random number of the quantum random number sequence block to the claimant, indicating that the two parties have reached a consensus. Subsequently, the claimant can use the quantum random number sequence block as its subordinate quantum random number sequence block when sending messages again; if a collision occurs, that is, the claimant and the verifier both enable the same quantum random number sequence block at the same time and send it to the other party at the same time, the claimant finds that the other party has selected the same quantum random number sequence block after receiving the quantum random number sent by the verifier, and then randomly delays for a period of time and initiates again, and the verifier is the same, until one party determines that the other party first occupies the quantum random number sequence block.

[0051] In the above three methods, the length and the starting position of the index are written in advance into the verification configuration file shared by both parties. After each random number segment is intercepted, the cursor position is synchronously moved down by the same distance as the intercepted length, thereby ensuring that the verification sequence sent each time is only used once, avoiding security risks caused by repeated use.

[0052] In step 304, the first verification sequence is sent to the verifier. This can be achieved by sending the first verification sequence to the verifier via an application layer request, wherein the request contains a field for identifying the verification of the first verification sequence, and the value of the field is the data after the first verification sequence is processed. Optionally, in some embodiments, the first verification sequence is sent to the verifier via an HTTP request, wherein the HTTP request header Key value is Authorization and the value content is the compressed first verification sequence.

[0053] Since the verification sequence is binary data, the claimant uses the Base64 algorithm to encode the first verification sequence and converts it into a string form (recorded as tokenA). Subsequently, the claimant uses tokenA as a token and puts it into the HTTP request header to be sent to the verifier. Specifically, the Key in the HTTP request header is "Authorization" and the corresponding Value is the tokenA string. The claimant sends the data to the verifier's IP address in the form of an HTTP packet, where the Header request header of the HTTP packet contains authentication information, and the Body part carries business-related verification information and business content.

[0054] At this point, through the above steps, the claiming party has completed the generation of the verification sequence and provided the verification sequence to the verifier to verify the one-way authentication of the claiming party. This application uses the high entropy and uniqueness of the quantum random number sequence to achieve lightweight authentication without encryption operations, and achieves end-to-end security based on identity identification and verification profiles. When generating the verification sequence, a standardized process of interception rules is preset to ensure the consistency of both parties, and a composite token is further generated through timestamp XOR to verify the timeliness. Finally, the application layer protocol is used for standardized transmission, effectively reducing the deployment cost. Through the above process, lightweight authentication without encryption operations is achieved, which solves the problem that traditional entity authentication relies on encryption algorithms, resulting in high computational overhead and pseudo-random numbers that are easy to predict.

[0055] With the one-time authentication mechanism of one-way authentication clear, the two-time authentication mechanism of one-way authentication is explained next. In the two-time authentication method of one-way authentication, the verifier B initiates this process and authenticates the claimant A, that is, the verifier sends a notification to instruct the claimant to obtain the quantum random number sequence, and then the claimant generates a first verification sequence based on the quantum random number sequence and sends it to the verifier. After receiving the first verification sequence, the verifier generates a second verification sequence based on the quantum random number sequence shared by both parties, which is used to verify the first verification sequence, thereby completing the one-way entity authentication of the claimant. Figure 7 As shown, the one-way authentication and two-transfer process of transfer mode 2 is implemented through the following steps.

[0056] Step 701: Receive a verification notification from a verifier, wherein the verification notification instructs the claimant to obtain a quantum random number sequence from a QKDN or a QKR.

[0057] Step 704: Generate a first verification sequence, wherein the first verification sequence is obtained based on a quantum random number sequence, and the quantum random number sequence is shared by the claiming party and the verifying party via QKDN or QKR.

[0058] Step 707: Send the first verification sequence to the verifier, so as to entity authenticate the claimant, wherein the verifier verifies the first verification sequence based on the second verification sequence generated by the quantum random number sequence.

[0059] Through the above-mentioned method of the present application, the two-pass authentication mechanism of one-way authentication is: the claiming party obtains the verification notification sent by the verifier, wherein the verification notification is used to instruct the claiming party to obtain the quantum random number sequence from QKDN or QKR; after obtaining the verification notification instruction, the claiming party obtains the quantum random number sequence from QKDN or QKR. In this way, through two passes, the security of the system is increased, while maintaining the high entropy and uniqueness of the quantum random number sequence, further reducing the risk of being cracked.

[0060] Similarly, for example, a device that uses a quantum random number sequence for entity authentication is a verification device (referred to as a "verifier"). In some embodiments, the entity authentication method is: a one-way authentication pass. In this case, the flow chart is as follows: Figure 8 As shown, the following steps are included.

[0061] Step 801: Obtain a first verification sequence from a claimant, wherein the first verification sequence is generated by the claimant based on a quantum random number sequence, and the quantum random number sequence is shared by the claimant and the verifier via QKDN or QKR.

[0062] Step 804: Generate a second verification sequence to verify the first verification sequence, wherein the second verification sequence is obtained based on the quantum random number sequence.

[0063] Through the above-mentioned method of the present application, a one-way authentication one-time transfer authentication mechanism is provided: after receiving the first verification sequence generated by the claiming party based on the quantum random number sequence, the verifier generates a second verification sequence based on the quantum random number sequence shared by both parties, thereby verifying the first verification sequence, thereby completing the entity authentication of the claiming party. In this way, lightweight authentication without encryption operation is achieved through the high entropy and uniqueness of the quantum random number sequence, solving the problem of high computational overhead caused by traditional entity authentication relying on encryption algorithms.

[0064] In step 801, a first verification sequence is obtained from the claimant. This can be achieved in the following way: the claimant obtains a protocol packet sent by the claimant, which is an HTTP request sent through the TCP protocol, and the verifier obtains tokenA from the request header, whose key value is the value corresponding to Authorization, which is the compressed verification sequence. The verification sequence can be obtained by decompressing tokenA using the Base64 algorithm, and the verification sequence is binary data.

[0065] In step 804, a second verification sequence is generated to verify the first verification sequence. This can be done in the following manner: a number of data segments of a specified length are intercepted from the quantum random number sequence as the second verification sequence according to a preset interception rule, and the first verification sequence is verified based on the second verification sequence, wherein the preset interception rule is determined based on a verification configuration file, and the verification configuration file is generated according to the authentication configuration of the claiming party. The above-mentioned verification configuration file, the preset interception rule, and the cursor starting position and intercepted sequence length included in the preset interception rule have been described in steps 301 and 304, and will not be repeated here.

[0066] For intercepting a number of data segments of a specified length from a quantum random number sequence as a second verification sequence according to a preset interception rule, the following steps can be performed: the preset interception rule includes a first interception rule, a second interception rule and a third interception rule; according to the first interception rule, intercepting a sixth random number segment of a first length from the quantum random number sequence, and comparing whether the sixth random number segment is the same as the first verification sequence; or, according to the second interception rule, intercepting a seventh random number segment of a second length and an eighth random number segment of a third length from the quantum random number sequence in sequence; when the seventh random number segment is the same as the first verification sequence, XORing the eighth random number segment with the first verification sequence to obtain a time sequence, and comparing whether the difference between the time sequence and the current time does not exceed a threshold; or according to the third interception rule, obtaining a quantum random number sequence block belonging to the quantum random number sequence itself, sequentially intercepting a ninth random number segment of a fifth length from the quantum random number sequence block, and comparing whether the ninth random number segment is the same as the first verification sequence, wherein the quantum random number sequence is divided into multiple blocks and respectively allocated to the claiming party and the verifying party.

[0067] According to the first interception rule, the verifier directly intercepts the second verification sequence from the quantum random number sequence, which is specifically implemented as follows: the verifier starts from the index start position of the quantum random number sequence, intercepts the random number segment E2 with a length of K, uses it as the second verification sequence, and compares it with the first verification sequence sent by the claimant. If the two are the same, the authentication of the claimant is completed.

[0068] According to the second interception rule, the verifier starts from the index start position of the quantum random number sequence and sequentially obtains a random number segment X2 of length K and a random number segment Y2 of length M. The random number segment Y2 is XORed with the last M bits of the first verification sequence to obtain a sequence Z2 (i.e., a binary sequence corresponding to the current time of the claimant). The verifier first compares whether the random number segment X2 is the same as the first K bits of the first verification sequence; if they are the same, it continues to compare whether the difference between the sequence Z2 and the current time of the verifier is less than a preset threshold. If the conditions are met, the identification of the claimant is completed.

[0069] According to the third interception rule, after receiving the message from the claimant, the verifier makes a judgment based on the quantum random number in the quantum random number sequence block belonging to the claimant. In the subsequent process of using the quantum random number sequence, the verifier intercepts and uses the quantum random number from the quantum random number sequence block with the smallest number belonging to itself.

[0070] The selection of the first interception rule, the second interception rule or the third interception rule depends on the capabilities and environment of the claiming party and the verifying party, and the interception length of the above sequence and the starting position of the index are written in advance into the verification configuration file shared by both parties, that is, the interception rules of the claiming party and the verifying party should be exactly the same. In addition, in the above three methods of generating the verification sequence, after each random number segment is intercepted, the position of the cursor is synchronously moved down by the same distance as the interception length, so that it can be ensured that the verification sequence sent each time is used only once, and there is no risk of being cracked.

[0071] Through the above-mentioned method of the present application, a one-way authentication one-time transfer authentication mechanism is provided: the verifier performs one-way entity authentication on the claimant. In this authentication mechanism, the claimant initiates this process and is authenticated by the verifier. Both parties realize lightweight authentication without encryption operations through the high entropy and uniqueness of the quantum random number sequence, which solves the problem that traditional entity authentication relies on encryption algorithms, resulting in high computational overhead and easy prediction of pseudo-random numbers.

[0072] With the one-pass authentication mechanism of one-way authentication clear, the two-pass authentication mechanism of one-way authentication is then explained. For the verifier, the entity authentication method: two passes of one-way authentication, including: sending a verification notification, wherein the verification notification instructs the claiming party to obtain a quantum random number sequence from QKDN or QKR; obtaining a first verification sequence from the claiming party, wherein the first verification sequence is generated by the claiming party based on the quantum random number sequence, and the quantum random number sequence is shared by the claiming party and the verifier via QKDN or QKR; generating a second verification sequence to verify the first verification sequence, wherein the second verification sequence is obtained based on the quantum random number sequence.

[0073] Through the above-mentioned method of the present application, the two-pass authentication mechanism of one-way authentication is: the claiming party obtains the verification notification sent by the verifier, wherein the verification notification is used to instruct the claiming party to obtain the quantum random number sequence from QKDN or QKR; after obtaining the verification notification instruction, the claiming party obtains the quantum random number sequence from QKDN or QKR. In this way, through two passes, the security of the system is increased, while maintaining the high entropy and uniqueness of the quantum random number sequence, further reducing the risk of being cracked.

[0074] The second part is about two-way authentication. The following will explain the two-way authentication of the claiming device and the verifying device in turn.

[0075] For example, the device that uses quantum random number sequence for entity authentication is the claiming party device (referred to as "claiming party"). In some embodiments, the entity authentication method is two passes of two-way authentication. At this time, the flow chart is as follows: Fig. 9 As shown, the following steps are included.

[0076] Step 901: Generate a first verification sequence, wherein the first verification sequence is obtained based on a quantum random number sequence, and the quantum random number sequence is shared by the claiming party and the verifying party via QKDN or QKR.

[0077] Step 904: Send the first verification sequence to the verifier, so as to entity authenticate the claimant, wherein the verifier verifies the first verification sequence based on the second verification sequence generated by the quantum random number sequence.

[0078] Step 907: Receive a third verification sequence, thereby entity-authenticating the verifier, wherein the claiming party verifies the third verification sequence based on a fourth verification sequence generated by the quantum random number sequence, and the third verification sequence is obtained by the verifier based on the quantum random number sequence.

[0079] Through the above-mentioned method of the present application, the entity authentication method: two passes of two-way authentication, after the verifier performs entity authentication on the claimant, the claimant will generate a verification sequence for the verifier and perform entity authentication. This two-way authentication mechanism further improves the effectiveness of authentication and ensures reliable authentication of the identities of both parties. The following will be explained in combination with its different implementation processes.

[0080] In addition, the description of the corresponding features in steps 901, 904 and 907 has been similarly recorded in the aforementioned embodiment, and will not be repeated here one by one. With the two-pass authentication mechanism of two-way authentication clear, the three-pass authentication mechanism of two-way authentication is then described, including: receiving a verification notification from the verifier, wherein the verification notification instructs the claimant to obtain a quantum random number sequence from QKDN or QKR; generating a first check sequence, wherein the first check sequence is obtained based on the quantum random number sequence, and the quantum random number sequence is shared by the claimant and the verifier via QKDN or QKR; sending the first check sequence to the verifier, thereby physically authenticating the claimant, wherein the verifier verifies the first check sequence based on the second check sequence generated by the quantum random number sequence; receiving a third check sequence, thereby physically authenticating the verifier, wherein the claimant verifies the third check sequence based on the fourth check sequence generated by the quantum random number sequence, and the third check sequence is obtained by the verifier based on the quantum random number sequence.

[0081] Similarly, for example, a device that uses quantum random numbers for entity authentication is a verifier device (referred to as "verifier"). In some embodiments, the entity authentication method is two passes of two-way authentication. In this case, the flow chart is as follows: Fig.10 As shown, the following steps are included.

[0082] Step 1001: Obtain a first verification sequence from a claimant, wherein the first verification sequence is generated by the claimant based on a quantum random number sequence, and the quantum random number sequence is shared by the claimant and the verifier via QKDN or QKR.

[0083] Step 1004: Generate a second verification sequence to verify the first verification sequence, wherein the second verification sequence is obtained based on the quantum random number sequence.

[0084] Step 1007: Send a third verification sequence to authenticate the entity, wherein the claiming party verifies the third verification sequence based on a fourth verification sequence generated by the quantum random number sequence, and the third verification sequence is obtained by the verifier based on the quantum random number sequence.

[0085] Through the above-mentioned method of the present application, the entity authentication method: two passes of two-way authentication, after the verifier performs entity authentication on the claimant, the claimant will generate a verification sequence for the verifier and perform entity authentication. This two-way authentication mechanism further improves the effectiveness of authentication and ensures reliable authentication of the identities of both parties. The following will be explained in combination with its different implementation processes.

[0086] Specifically, the description of the corresponding features of steps 1001, 1004 and 1007 has been recorded in the aforementioned embodiment, and will not be repeated here. With the two-pass authentication mechanism of two-way authentication clear, the three-pass authentication mechanism of two-way authentication is then described, including: sending a verification notification, wherein the verification notification instructs the claiming party to obtain a quantum random number sequence from QKDN or QKR; obtaining a first check sequence from the claiming party, wherein the first check sequence is generated by the claiming party based on the quantum random number sequence, and the quantum random number sequence is shared by the claiming party and the verifier through QKDN or QKR; generating a second check sequence to verify the first check sequence, wherein the second check sequence is obtained based on the quantum random number sequence; sending a third check sequence, thereby entity authentication of the verifier, wherein the claiming party verifies the third check sequence based on a fourth check sequence generated by the quantum random number sequence, and the third check sequence is obtained by the verifier based on the quantum random number sequence.

[0087] In summary, the entity authentication method of the claiming party and the verification party of this application can be further combined with serial numbers, timestamps, and random numbers to generate a mixed verification sequence, so as to support delayed attacks. Through the above embodiments of this application, one-way authentication or two-way authentication is performed, which has the advantage that encryption and decryption operations are not required, which reduces the time for encryption and decryption calculations; and the random number sent each time is only used once, so there is no risk of being cracked; the random number sequence has the characteristics of serial numbers, random numbers, and identifiers at the same time.

[0088] The step division of the above methods is only for clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this application; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this application.

[0089] Those skilled in the art will appreciate that the above-mentioned embodiments are specific examples for implementing the present application, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. An entity identification method, applicable to a claiming party, characterized in that: include: Generate a first verification sequence, wherein the first verification sequence is obtained based on a quantum random number sequence, and the quantum random number sequence is shared by the claiming party and the verifying party via QKDN or QKR; The first verification sequence is sent to the verifier so that the verifier entity authenticates the claimant, wherein the verifier verifies the first verification sequence based on a second verification sequence generated by the quantum random number sequence.

2. The entity identification method according to claim 1, characterized in that: Generating a first verification sequence includes: Obtain the quantum random number sequence from the QKDN or the QKR; According to a preset interception rule, a number of data segments of a specified length are intercepted from the quantum random number sequence as the first verification sequence.

3. The entity identification method according to claim 2, characterized in that: Acquiring the quantum random number sequence from the QKDN or the QKR comprises: Apply for an identity from the QKDN or the QKR; Sending the identity identifier to the authenticator, wherein the authenticator generates an authentication profile based on the identity identifier, and shares the authentication profile with the claimant, wherein the authentication profile at least includes the preset interception rule, the identity identifier of the claimant, and the identity identifier of the claimant; The identity of the claiming party is submitted to the QKDN or the QKR to obtain the quantum random number sequence, wherein the QKDN or the QKR pairs the identity of the claiming party with the identity of the claiming party, generates the quantum random number sequence when the pairing is successful, and distributes the quantum random number sequence to the claiming party and the verifier through a quantum channel.

4. The entity identification method according to claim 3, characterized in that: After obtaining the quantum random number sequence through the quantum channel, the following step is further included: Requesting the QKDN or the QKR to perform a consistency check, wherein the QKDN or the QKR performs a consistency check on the summary value of the quantum random number sequence through a consistency check interface, and if the consistency check passes, notifying the claimant and the verifier to save the quantum random number sequence and the summary value.

5. The entity identification method according to claim 2, characterized in that: The preset interception rules include a first interception rule, a second interception rule and a third interception rule. According to the preset interception rules, intercepting a number of data segments of a specified length from the quantum random number sequence as the first verification sequence includes: According to the first truncation rule, sequentially truncate first random number segments of a first length from the quantum random number sequence as the first verification sequence; or, According to the second truncation rule, sequentially truncate a second random number segment of a second length and a second random number segment of a third length from the quantum random number sequence, perform an XOR operation on the second random number segment and a timestamp to obtain a fourth random number segment, and concatenate the second random number segment and the fourth random number segment as the first check sequence; or, According to the third truncation rule, a quantum random number sequence block belonging to itself in the quantum random number sequence is obtained, and a fifth random number segment of a fifth length is sequentially truncated from the quantum random number sequence block as the first verification sequence, wherein the quantum random number sequence is divided into multiple blocks and respectively allocated to the claimant and the verifier.

6. The entity identification method according to claim 1, characterized in that: Before generating the first verification sequence, the method further includes: A verification notification is received from the verifier, wherein the verification notification instructs the claimant to obtain the quantum random number sequence from the QKDN or the QKR.

7. The entity identification method according to claim 1, characterized in that: Sending the first verification sequence to the verification party includes: The first verification sequence is sent to the verifier through an application layer request, wherein the application layer request includes a field for identifying verification of the first verification sequence, and the value of the field is data after processing the first verification sequence.

8. The entity identification method according to claim 7, characterized in that: Sending the first verification sequence to the verification party through an application layer request includes: The first verification sequence is sent to the verifier through an HTTP request, wherein in the request header of the HTTP request, the Key value is Authorization and the value content is the compressed first verification sequence.

9. The entity identification method according to claim 1, characterized in that: After sending the first verification sequence to the verification party, the method further includes: A third verification sequence is received, thereby entity-authenticating the verifier, wherein the claimant verifies the third verification sequence based on a fourth verification sequence generated by the quantum random number sequence, and the third verification sequence is obtained by the verifier based on the quantum random number sequence.

10. An entity authentication method, applicable to a verification party, characterized in that: include: Acquire a first verification sequence from the claiming party, wherein the first verification sequence is generated by the claiming party based on a quantum random number sequence, and the quantum random number sequence is shared by the claiming party and the verifier via QKDN or QKR; A second verification sequence is generated to verify the first verification sequence, wherein the second verification sequence is obtained based on the quantum random number sequence.

11. A device for entity authentication using quantum random numbers, characterized in that: include: at least one processor; as well as, A memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor so that the at least one processor can perform the entity identification method according to any one of claims 1 to 9 and / or the entity identification method according to claim 10.

12. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the entity identification method according to any one of claims 1 to 9 and / or the entity identification method according to claim 10 is implemented.

Images