Anti-quantum computing communication implementation method and system and computer equipment

Abstract

The invention discloses an anti-quantum computing communication implementation method and system and computer equipment. The method comprises the steps that a PQC channel is established with a front-end server, the PQC channel outputs a first master key through a post-quantum algorithm, the first master key derives a second master key, and the second master key is sent to a target server; sending the first key negotiation information to a front-end server; receiving second key negotiation information sent from the front-end server, decrypting the second key negotiation information by using a second master key, and calculating to obtain a session key; and the client realizes encrypted communication with the target server by using the session key. Compared with the prior art, the method has the advantages that the PQC channel protected by the post-quantum algorithm is firstly established between the client and the front-end server, and then the security channel is used for protecting a plurality of classical security channels established between the client and different target servers, so that the attack of a quantum computer can be effectively resisted.

Description

Technical Field

[0001] The present invention relates to the field of quantum computing technology, and in particular to a communication implementation method, system and computer device that are resistant to quantum computing. Background Art

[0002] In today's digital society, protecting the security of communication data is extremely important because it involves personal privacy, corporate secrets, national security and other aspects. In the digital age, almost all operations, transactions and communications rely on the network. If the communication data is not secure, it may lead to privacy leakage, financial loss, identity theft, corporate reputation damage and other serious consequences. Therefore, ensuring the confidentiality, integrity, availability and identity authentication of communication data is the basis for building a secure digital environment.

[0003] Due to the emergence of quantum computers, classical algorithms are no longer secure, and communication data protected by classical algorithms will also be threatened by quantum computers. Summary of the invention

[0004] The purpose of the present invention is to provide a communication implementation method, system and computer device that are resistant to quantum computing to solve the technical problems in the prior art, which can effectively resist the attacks of quantum computers.

[0005] In a first aspect, the present invention provides a method for implementing quantum computing-resistant communication, which is applied to a client so that the client accesses a target server through a front-end server, and the method includes:

[0006] A PQC channel is established with the front-end server. The PQC channel uses a post-quantum algorithm to output a first master key. The first master key is used to derive a second master key, and the second master key is sent to the target server.

[0007] Sending first key negotiation information to the front-end server, the first key negotiation information is encrypted by the second master key, the first key negotiation information is sent to the target server via the front-end server, and when the first key negotiation information is decrypted by the target server, the second key negotiation information is sent by the target server to the front-end server;

[0008] receiving the second key negotiation information sent from the front-end server, decrypting the second key negotiation information using the second master key, and calculating a session key according to the first key negotiation message and the second key negotiation information, the session key also being generated by the target server according to the first key negotiation message and the second key negotiation information;

[0009] The client uses the session key to achieve encrypted communication with the target server.

[0010] In the above method for implementing quantum-resistant communication, preferably, the client includes an APP application layer and an APP transport layer, wherein:

[0011] The APP transport layer establishes a PQC channel with the front-end server and negotiates to obtain the first master key, which is then sent to the APP application layer.

[0012] The APP application layer receives the first master key, and performs key derivation on the first master key to obtain the second master key. The APP application layer encrypts the first key negotiation information using the second master key, and the first key negotiation information is sent to the front-end server via the APP transport layer.

[0013] The APP transport layer receives the second key negotiation information sent by the front-end server, and then sends it to the APP application layer. The APP application layer uses the second master key to decrypt the second key negotiation information, and calculates the session key based on the first key negotiation message and the second key negotiation information.

[0014] In the above method for implementing quantum computing-resistant communication, preferably,

[0015] The APP application layer encrypts the original data using the session key to obtain the first communication data, and the APP application layer sends the first communication data to the APP transport layer;

[0016] The APP transport layer encrypts the first communication data using the first master key to obtain the second communication data, and the APP transport layer sends the second communication data to the front-end server;

[0017] The second communication data is decrypted by the front-end server using the first master key to obtain the first communication data;

[0018] The first communication data is decrypted by the target server using the session key to obtain the original data.

[0019] In the above method for implementing quantum computing-resistant communication, preferably, the server and the front-end server establish a PQC channel including:

[0020] Sending a first random number, a supported protocol version, and a supported post-quantum algorithm type to a front-end server;

[0021] Receive a second random number, a first post-quantum algorithm public key, a selected protocol version, and a selected post-quantum algorithm sent by a front-end server;

[0022] Use the first post-quantum algorithm public key to encapsulate the pre-key and the ciphertext of the pre-key, retain the pre-key, use the first random number, the second random number and the pre-key to derive the first master key, and then send the ciphertext to the front-end server;

[0023] Use the built-in second post-quantum algorithm private key to sign the information sent by both parties and the client identity information to obtain the client signature, and send it to the front-end server;

[0024] Obtain the server signature sent from the front-end server. The server signature is obtained by the front-end server using the built-in second post-quantum algorithm private key to sign the information sent between the client and the front-end server and the client identity information after the front-end server verifies the client signature.

[0025] Use the built-in second post-quantum algorithm public key to verify the server signature, thereby confirming the identity of the front-end server.

[0026] As described above, a method for implementing communication that is resistant to quantum computing is provided, wherein preferably, the first post-quantum algorithm is a post-quantum cryptographic encapsulation algorithm, and the second post-quantum algorithm is a post-quantum cryptographic signature algorithm.

[0027] As described above, a method for implementing quantum computing-resistant communication is provided, wherein preferably, the session key is generated by a classical algorithm, and the classical algorithm includes SM1, SM2, SM3, SM4, SM7, SM9 or ZUC algorithm.

[0028] In a second aspect, the present invention provides a communication system, including a client, a front-end server, a password management platform and a target server, wherein the client has an APP application layer and an APP transport layer connected by a signal, wherein:

[0029] The APP transport layer establishes a PQC channel with the front-end server and negotiates to obtain the first master key, which is sent to the APP application layer and the password management platform respectively;

[0030] The APP application layer receives the first master key, and derives the first master key to obtain the second master key. The APP application layer encrypts the first key negotiation information using the second master key. The first key negotiation information is sent to the target server after passing through the APP transport layer and the front-end server in sequence.

[0031] The password management platform derives the first master key to obtain a second master key, and the second master key is sent to the target server;

[0032] The target server decrypts the first key negotiation information using the second master key, and encrypts the second key negotiation information using the second master key. The second key negotiation information is sent to the APP application layer after passing through the front-end server and the APP transport layer in sequence.

[0033] The APP application layer uses the second master key to decrypt the second key negotiation information, and calculates the session key according to the first key negotiation message and the second key negotiation information. The session key is also generated by the first key negotiation message and the second key negotiation information.

[0034] The client uses the session key to achieve encrypted communication with the target server.

[0035] A communication system as above, wherein preferably,

[0036] The APP application layer encrypts the original data using the session key to obtain the first communication data, and the APP application layer sends the first communication data to the APP transport layer;

[0037] The APP transport layer encrypts the first communication data using the first master key to obtain the second communication data, and the APP transport layer sends the second communication data to the front-end server;

[0038] The second communication data is decrypted by the front-end server using the first master key to obtain the first communication data;

[0039] The first communication data is decrypted by the target server using the session key to obtain the original data.

[0040] In a third aspect, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the aforementioned method is implemented when the processor executes the computer program.

[0041] In a fourth aspect, the present invention provides a computer-readable storage medium storing the aforementioned method.

[0042] Compared with the prior art, the present invention first establishes a PQC channel protected by a post-quantum algorithm between the client and the front-end server, and then uses this secure channel to protect multiple classical secure channels established between the client and different target servers, thereby realizing a protection chain in which the PQC algorithm protects the classical algorithm, and the classical algorithm protects the communication data. An attacker must break the PQC algorithm plus the classical algorithm to obtain the original data, thereby effectively resisting attacks from quantum computers. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a flowchart of a method for implementing quantum computing-resistant communication provided by an embodiment of the present invention;

[0044] Figure 2 It is a schematic diagram of the implementation steps of the communication implementation method for anti-quantum computing provided by an embodiment of the present invention;

[0045] Figure 3 It is a flowchart of a method for implementing a PQC channel provided in an embodiment of the present invention;

[0046] Figure 4 It is a schematic diagram of the implementation steps of the PQC channel provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, but should not be construed as limiting the present invention.

[0048] Reference Figure 1 as well as Figure 2 As shown, an embodiment of the present invention provides a communication implementation method for anti-quantum computing, which is applied to a client so that the client accesses a target server through a front-end server. The method includes:

[0049] Step S101: Establish a PQC channel with the front-end server. The PQC channel uses a post-quantum algorithm to output a first master key. The first master key is used to derive a second master key, and the second master key is sent to the target server.

[0050] The PQC channel is built based on the post-quantum algorithm (PQC) and is used to provide subsequent identity authentication and data protection. The PQC channel generates the first master key, which is used to protect data in subsequent data exchanges. The post-quantum algorithm can provide protection against quantum computer attacks and ensure the security of the information exchange process.

[0051] The PQC channel has a long validity period, and multiple session key negotiations can be performed within its validity period. The advantage of this two-phase negotiation is that the identity authentication and key negotiation process of both parties can be divided into two parts, and the complex work is completed by the PQC channel with a long validity period. In this way, even if the two parties need to communicate multiple times, they only need to complete the PQC channel once, which can save time for both parties.

[0052] The first master key is used to derive the second master key, and the derivation process usually uses a key derivation function (KDF), such as HKDF (HMAC-based Key Derivation Function).

[0053] In a feasible implementation, the front-end server also obtains the first master key through key negotiation, and the first master key is sent to the password management platform. The password management platform uses a key derivation function (such as HKDF) to derive the first master key, generate a second master key, and send it to the target server. After receiving the second master key, the target server uses the key to perform subsequent encryption and decryption operations to ensure the secure transmission and storage of data.

[0054] Step S102: Send the first key negotiation information to the front-end server, the first key negotiation information is encrypted by the second master key, the first key negotiation information is sent to the target server via the front-end server, when the first key negotiation information is decrypted by the target server, the second key negotiation information is sent by the target server to the front-end server.

[0055] After receiving the encrypted first key negotiation information, the target server uses the second master key to decrypt the first key information. At the same time, the target server uses the second master key to encrypt the second key negotiation information. The second key negotiation information is sent to the client after passing through the front-end server in turn.

[0056] Step S103: Receive the second key negotiation information sent from the front-end server, use the second master key to decrypt the second key negotiation information, and calculate the session key based on the first key negotiation message and the second key negotiation information. The session key is also generated by the target server based on the first key negotiation message and the second key negotiation information.

[0057] Step S104: The client uses the session key to achieve encrypted communication with the target server.

[0058] The present invention first establishes a PQC channel protected by a post-quantum algorithm between the client and the front-end server, and then uses this secure channel to protect multiple classical secure channels established between the client and different target servers. In the long connection (long duration, not frequently established) scenario during the communication process, the time-consuming PQC algorithm is used, and in the short connection (short duration, may be frequently established) scenario, the time-consuming classical national secret algorithm is used, and the long connection is used to protect the establishment process of the short connection. Thus, the protection chain of the PQC algorithm protecting the classical algorithm and the classical algorithm protecting the communication data is realized. The attacker must break the PQC algorithm and the classical algorithm to get the original data, so as to effectively resist the attack of quantum computers.

[0059] If the client wants to communicate with other target servers, the first master key remains unchanged, but the client uses the first master key to re-derive a third master key. The client uses this third master key to encrypt the first key negotiation information. The password management platform also uses the first master key to re-derive a third master key and sends it to the target server. The target server uses this third master key to decrypt the first key negotiation information, and then uses the third master key to encrypt the second key negotiation information. After the second key negotiation information is sent to the client, the client uses the third master key to decrypt the second key negotiation information and calculates a new session key based on the key negotiation information of both parties. The client and other target servers use this new session key to achieve encrypted communication.

[0060] In the embodiment provided by the present invention, the client includes an APP application layer and an APP transport layer, wherein:

[0061] The APP transport layer establishes a PQC channel with the front-end server, negotiates to obtain the first master key, and the first master key is sent to the APP application layer. The APP application layer can use the first master key to encrypt and decrypt the data of the application layer to ensure the security of the APP application layer data.

[0062] In a feasible implementation, the front-end server also obtains the first master key through key negotiation, and the first master key is sent to the password management platform. The password management platform uses a key derivation function (such as HKDF) to derive the first master key, generate a second master key, and send it to the target server. After receiving the second master key, the target server uses the key to perform subsequent encryption and decryption operations to ensure the secure transmission and storage of data.

[0063] The APP application layer receives the first master key and derives the second master key from the first master key. The APP application layer encrypts the first key negotiation information using the second master key, and the first key negotiation information is sent to the front-end server via the APP transport layer.

[0064] After receiving the encrypted first key negotiation information, the target server uses the second master key to decrypt the first key information. At the same time, the target server uses the second master key to encrypt the second key negotiation information. The second key negotiation information is sent to the APP transport layer after passing through the front-end server in turn.

[0065] The APP transport layer receives the second key negotiation information sent by the front-end server, and then sends it to the APP application layer. The APP application layer uses the second master key to decrypt the second key negotiation information, and calculates the session key based on the first key negotiation message and the second key negotiation information. The client uses the session key to achieve encrypted communication with the target server.

[0066] Furthermore, the APP application layer encrypts the original data using the session key to obtain the first communication data, so as to ensure the security and efficiency of the data during the encryption and decryption process of the APP application layer. The APP application layer sends the first communication data to the APP transport layer.

[0067] The APP transport layer encrypts the first communication data with the first master key to obtain the second communication data, which is used to ensure the security and efficiency of the data during the encryption and decryption process of the APP transport layer. The APP transport layer sends the second communication data to the front-end server.

[0068] The second communication data is decrypted by the front-end server using the first master key to obtain the first communication data. This step ensures the security of the data during transmission and prevents it from being attacked or stolen by a middleman.

[0069] The first communication data is decrypted by the target server using the session key to obtain the original data. This step ensures the security and integrity of the data on the target server.

[0070] In the embodiments provided by the present invention, reference is made to Figure 3 as well as Figure 4 As shown, the server establishes a PQC channel with the front-end server including:

[0071] Step S1011: Send a first random number, a supported protocol version, and a supported post-quantum algorithm type to a front-end server; receive a second random number, a first post-quantum algorithm public key, a selected protocol version, and a selected post-quantum algorithm sent by the front-end server.

[0072] Specifically, the first random number is used in the subsequent key generation and verification process. Preferably, the first random number is a quantum random number, which is a random number generated based on the principle of quantum mechanics and is unpredictable and aperiodic to ensure security and reliability during the communication process.

[0073] The protocol version sent by the APP transport layer determines the specifications and rules framework that the two parties follow in subsequent communications. The protocol version defines the rules and steps that must be followed during the communication process, including how to establish a connection, how to exchange information, and how to handle errors. The type of algorithm is related to subsequent security-related operations such as encryption and signing to establish the initial parameters of communication.

[0074] After the front-end server receives the information from the APP transport layer, it starts to filter from the set of protocol versions and algorithm types provided by the APP transport layer, and determines a suitable option based on its own system configuration, pre-set security policies, and support capabilities for various protocols and algorithms. After determining the choice, the front-end server will clearly inform the APP transport layer which specific protocol version and algorithm type has been selected, so that the APP transport layer knows that subsequent communications will proceed accordingly.

[0075] In addition, the front-end server will also generate and transmit a second random number to the APP transport layer. The second random number is similar to the first random number sent by the APP transport layer and is also used for subsequent operations such as generating the first master key. Preferably, the second random number is also a quantum random number. By providing random numbers by both parties, the randomness and confidentiality of key generation are further enhanced.

[0076] By exchanging random numbers and confirming the protocol version and algorithm, the APP transport layer and the front-end server confirm that they use the same communication rules and security measures, thereby establishing a secure communication channel.

[0077] In the embodiment provided by the present invention, the post-quantum algorithm includes a first post-quantum algorithm and a second post-quantum algorithm. In a feasible implementation, the first post-quantum algorithm is a post-quantum cryptographic encapsulation algorithm. The first post-quantum cryptographic encapsulation algorithm is exemplarily a Kyber algorithm. The Kyber algorithm is a lattice-based public key encryption scheme used for key encapsulation and other operations. The front-end server sends the Kyber public key to the APP transport layer for subsequent key encapsulation and decryption operations to build a secure communication key system for both parties. The second post-quantum algorithm is a post-quantum cryptographic signature algorithm. The second post-quantum cryptographic signature algorithm is exemplarily a Dilithium algorithm. The Dilithium algorithm is a lattice-based digital signature scheme used for identity authentication and other operations.

[0078] The session key is generated by a classic algorithm, including SM1, SM2, SM3, SM4, SM7, SM9, or ZUC algorithm.

[0079] Step S1012: Use the first post-quantum algorithm public key to encapsulate the pre-key and the ciphertext of the pre-key, retain the pre-key, use the first random number, the second random number and the pre-key to derive the first master key, and then send the ciphertext to the front-end server.

[0080] The APP transport layer uses the Kyber public key sent by the front-end server to perform key encapsulation operations. In this process, a specific key encapsulation algorithm is used in combination with relevant parameters to generate a pre-key and the corresponding ciphertext form (i.e. Cipher).

[0081] The pre-key is usually a randomly generated random number, preferably a quantum random number, which is used for subsequent session encryption. Encrypting it into a Cipher is to ensure that it is not leaked during transmission to the front-end server and to ensure its confidentiality. Subsequently, the APP transport layer will send the Cipher to the front-end server.

[0082] After receiving the Cipher, the front-end server uses its own Kyber private key to decrypt it. Since there is a specific mathematical correspondence between the Kyber public key and the private key, only the matching private key can correctly decrypt the ciphertext generated by the corresponding public key. Through this decryption process, the front-end server can successfully obtain the plaintext content of the pre-key.

[0083] After the ciphertext is decrypted by the front-end server, the front-end server now has the necessary elements to generate the first master key, namely the first random number, the second random number and the pre-key. The front-end server uses the same algorithm to derive the first master key by combining the first random number, the second random number and the pre-key.

[0084] Step S1013: Use the built-in second post-quantum algorithm private key to sign the information sent by both parties and the client identity information to obtain the client signature, and send it to the front-end server.

[0085] Specifically, the client signature is obtained by the APP transport layer using the built-in Dilithium private key to sign the information sent by both parties and the client identity information. After the front-end server receives the client signature, it verifies the signature with the built-in Dilithium public key to determine the identity of the other party. Through the private key-based signature method, the APP transport layer proves the legitimacy of its identity to the front-end server. Only the party with the corresponding Dilithium private key can generate the correct signature, and the front-end server can verify it through the corresponding Dilithium public key. If the verification is successful, it means that the APP transport layer currently communicating with it is legal and has the corresponding private key, thereby confirming the identity of the APP transport layer and laying the foundation for subsequent secure and reliable communication; if the verification fails, it may mean that there is a security risk, such as encountering a man-in-the-middle attack, and the communication will be interrupted.

[0086] Step S1014: Obtain the server signature sent from the front-end server. The server signature is obtained after the front-end server verifies the client signature. The front-end server uses the built-in second post-quantum algorithm private key to sign the information sent between the client and the front-end server and the client identity information, and uses the built-in second post-quantum algorithm public key to verify the server signature, thereby confirming the identity of the front-end server.

[0087] Specifically, the server signature is obtained by the front-end server using the built-in Dilithium private key to sign the information sent by both parties and the server identity information. After the APP transport layer receives the client signature, it verifies the signature with the built-in Dilithium public key to determine the identity of the other party. Through the private key-based signature method, the front-end server proves the legitimacy of its identity to the APP transport layer. Only the party with the corresponding Dilithium private key can generate the correct signature. The APP transport layer can verify it through the corresponding Dilithium public key. If the verification is successful, it means that the front-end server currently communicating with it is legal and has the corresponding private key, thereby confirming the identity of the front-end server and laying the foundation for subsequent secure and reliable communication; if the verification fails, it may mean that there is a security risk, such as encountering a man-in-the-middle attack, and the communication will be interrupted.

[0088] After the key verification step, the APP transport layer and the front-end server have determined a consistent, secure and reliable first master key. On this basis, the APP transport layer and the front-end server can use this first master key for subsequent communication encryption.

[0089] In a second aspect, the present invention provides a communication system, referring to Figure 1 As shown, it includes a client, a front-end server, a password management platform and a target server. The client has an APP application layer and an APP transport layer connected by signals, wherein:

[0090] The APP transport layer establishes a PQC channel with the front-end server and negotiates to obtain the first master key, which is then sent to the APP application layer and the password management platform respectively.

[0091] The APP application layer receives the first master key and derives the second master key from the first master key. The APP application layer uses the second master key to encrypt the first key negotiation information. The first key negotiation information passes through the APP transport layer and the front-end server in turn and is sent to the target server.

[0092] The password management platform derives the first master key to obtain a second master key, and the second master key is sent to the target server.

[0093] The target server uses the second master key to decrypt the first key negotiation information, and at the same time, the target server uses the second master key to encrypt the second key negotiation information. The second key negotiation information passes through the front-end server and the APP transmission layer in turn and is sent to the APP application layer.

[0094] The APP application layer uses the second master key to decrypt the second key negotiation information, and calculates the session key based on the first key negotiation message and the second key negotiation information. The session key is also generated by the target server based on the first key negotiation message and the second key negotiation information.

[0095] The client uses the session key to achieve encrypted communication with the target server.

[0096] Furthermore, the APP application layer encrypts the original data using the session key to obtain the first communication data, and the APP application layer sends the first communication data to the APP transport layer.

[0097] The APP transport layer encrypts the first communication data using the first master key to obtain the second communication data, and the APP transport layer sends the second communication data to the front-end server.

[0098] The second communication data is decrypted by the front-end server using the first master key to obtain the first communication data.

[0099] The first communication data is decrypted by the target server using the session key to obtain the original data.

[0100] In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to implement the steps in any one of the above method embodiments.

[0101] Specifically, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0102] Specifically, in this embodiment, the processor may be configured to implement the following steps through a computer program:

[0103] Step S101: Establish a PQC channel with a front-end server. The PQC channel uses a post-quantum algorithm to output a first master key. The first master key is used to derive a second master key, and the second master key is sent to a target server.

[0104] Step S102: Send the first key negotiation information to the front-end server, the first key negotiation information is encrypted by the second master key, the first key negotiation information is sent to the target server via the front-end server, when the first key negotiation information is decrypted by the target server, the second key negotiation information is sent by the target server to the front-end server.

[0105] Step S103: Receive the second key negotiation information sent from the front-end server, use the second master key to decrypt the second key negotiation information, and calculate the session key based on the first key negotiation message and the second key negotiation information. The session key is also generated by the target server based on the first key negotiation message and the second key negotiation information.

[0106] Step S104: The client uses the session key to achieve encrypted communication with the target server.

[0107] In a fourth aspect, an embodiment of the present invention further provides a storage medium, in which a computer program is stored, wherein the computer program is configured to implement the steps of any of the above method embodiments when run.

[0108] Specifically, in this embodiment, the above storage medium may be configured to store a computer program for implementing the following steps:

[0109] Step S101: Establish a PQC channel with a front-end server. The PQC channel uses a post-quantum algorithm to output a first master key. The first master key is used to derive a second master key, and the second master key is sent to a target server.

[0110] Step S102: Send the first key negotiation information to the front-end server, the first key negotiation information is encrypted by the second master key, the first key negotiation information is sent to the target server via the front-end server, when the first key negotiation information is decrypted by the target server, the second key negotiation information is sent by the target server to the front-end server.

[0111] Step S103: Receive the second key negotiation information sent from the front-end server, use the second master key to decrypt the second key negotiation information, and calculate the session key based on the first key negotiation message and the second key negotiation information. The session key is also generated by the target server based on the first key negotiation message and the second key negotiation information.

[0112] Step S104: The client uses the session key to achieve encrypted communication with the target server.

[0113] The above describes in detail the structure, features and effects of the present invention based on the embodiments shown in the drawings. The above is only a preferred embodiment of the present invention, but the present invention is not limited to the scope of implementation shown in the drawings. Any changes made according to the concept of the present invention, or modifications to equivalent embodiments with equivalent changes, which still do not exceed the spirit covered by the description and drawings, should be within the protection scope of the present invention.

Claims

1. A method for implementing quantum computing-resistant communication, characterized in that: Applied to a client so that the client accesses a target server through a front-end server, the method comprises: Establishing a PQC channel with a front-end server, wherein the PQC channel outputs a first master key using a post-quantum algorithm, wherein a second master key is derived from the first master key, and the second master key is sent to the target server; Sending first key negotiation information to the front-end server, the first key negotiation information being encrypted by the second master key, the first key negotiation information being sent to the target server via the front-end server, and after the first key negotiation information is decrypted by the target server, the second key negotiation information being sent by the target server to the front-end server; receiving the second key negotiation information sent from the front-end server, decrypting the second key negotiation information using the second master key, and calculating a session key according to the first key negotiation message and the second key negotiation information, wherein the session key is also generated by the target server according to the first key negotiation message and the second key negotiation information; The client uses the session key to achieve encrypted communication with the target server.

2. The method according to claim 1, characterized in that The client includes an APP application layer and an APP transport layer, wherein: The APP transport layer establishes a PQC channel with the front-end server, negotiates to obtain a first master key, and the first master key is sent to the APP application layer; The APP application layer receives the first master key, and performs key derivation on the first master key to obtain the second master key, the APP application layer encrypts first key negotiation information using the second master key, and the first key negotiation information is sent to the front-end server via the APP transport layer; The APP transport layer receives the second key negotiation information sent by the front-end server, and then sends it to the APP application layer. The APP application layer uses the second master key to decrypt the second key negotiation information, and calculates the session key based on the first key negotiation message and the second key negotiation information.

3. The method according to claim 2, characterized in that: The APP application layer encrypts the original data using the session key to obtain first communication data, and the APP application layer sends the first communication data to the APP transport layer; The APP transport layer encrypts the first communication data using the first master key to obtain second communication data, and the APP transport layer sends the second communication data to the front-end server; The second communication data is decrypted by the front-end server using the first master key to obtain the first communication data; The first communication data is decrypted by the target server using the session key to obtain original data.

4. The method according to claim 1, characterized in that: The server establishes a PQC channel with the front-end server including: Sending a first random number, a supported protocol version, and a supported post-quantum algorithm type to the front-end server; Receiving a second random number, a first post-quantum algorithm public key, a selected protocol version, and a selected post-quantum algorithm sent by the front-end server; Using the first post-quantum algorithm public key to encapsulate a prekey and a ciphertext of the prekey, retaining the prekey, using the first random number, the second random number and the prekey to derive a first master key, and then sending the ciphertext to the front-end server; The information sent by both parties and the client identity information are signed using the built-in second post-quantum algorithm private key to obtain a client signature, and sent to the front-end server; Obtaining a server signature sent from the front-end server, wherein the server signature is obtained by the front-end server using a built-in second post-quantum algorithm private key to sign information sent between the client and the front-end server and the client identity information after the front-end server verifies the client signature; The server signature is verified using the built-in second post-quantum algorithm public key to confirm the identity of the front-end server.

5. The method according to claim 4, characterized in that: The first post-quantum algorithm is a post-quantum cryptographic encapsulation algorithm, and the second post-quantum algorithm is a post-quantum cryptographic signature algorithm.

6. The method according to claim 4, characterized in that: The session key is generated by a classic algorithm, which includes SM1, SM2, SM3, SM4, SM7, SM9 or ZUC algorithm.

7. A communication system, characterized in that: It includes a client, a front-end server, a password management platform and a target server. The client has an APP application layer and an APP transport layer connected by signals, wherein: The APP transport layer establishes a PQC channel with the front-end server, and negotiates to obtain a first master key, which is sent to the APP application layer and the password management platform respectively; The APP application layer receives the first master key, and performs key derivation on the first master key to obtain a second master key. The APP application layer encrypts the first key negotiation information using the second master key. The first key negotiation information passes through the APP transport layer and the front-end server in sequence and is sent to the target server. The password management platform derives the first master key to obtain the second master key, and the second master key is sent to the target server; The target server decrypts the first key negotiation information using the second master key, and encrypts the second key negotiation information using the second master key. The second key negotiation information is sent to the APP application layer after passing through the front-end server and the APP transport layer in sequence. The APP application layer uses the second master key to decrypt the second key negotiation information, and calculates the session key according to the first key negotiation message and the second key negotiation information. The session key is also generated by the target server according to the first key negotiation message and the second key negotiation information. The client uses the session key to achieve encrypted communication with the target server.

8. The communication system according to claim 1, characterized in that: The APP application layer encrypts the original data using the session key to obtain first communication data, and the APP application layer sends the first communication data to the APP transport layer; The APP transport layer encrypts the first communication data using the first master key to obtain second communication data, and the APP transport layer sends the second communication data to the front-end server; The second communication data is decrypted by the front-end server using the first master key to obtain the first communication data; The first communication data is decrypted by the target server using the session key to obtain original data.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores the method for executing any one of claims 1 to 6.

Images