A communication implementation method, system and computer device resistant to quantum computing

Abstract

The present invention discloses a method, system, and computer device for implementing quantum computing-resistant communication. The method comprises: establishing a PQC channel with a front-end server, wherein the PQC channel outputs a first master key using a post-quantum algorithm, wherein the first master key is used to derive a second master key, and the second master key is sent to a target server; sending first key negotiation information to the front-end server; receiving second key negotiation information sent from the front-end server, decrypting the second key negotiation information using the second master key, and calculating a session key; and a client utilizing the session key to achieve encrypted communication with the target server. Compared to the prior art, the present invention first establishes a PQC channel protected by a post-quantum algorithm between the client and the front-end server, and then uses this secure channel to protect multiple classical secure channels established between the client and different target servers, thereby effectively resisting attacks from quantum computers.

Description

Technical Field

[0001] The present invention relates to the field of quantum computing technology, and in particular to a communication implementation method, system and computer device that are resistant to quantum computing. Background Art

[0002] In today's digital society, protecting the security of communication data is crucial, as it touches upon personal privacy, corporate secrets, and national security. In this digital age, nearly all operations, transactions, and communications rely on networks. If communication data is not secure, it can lead to serious consequences such as privacy breaches, financial losses, identity theft, and damage to corporate reputation. Therefore, ensuring the confidentiality, integrity, availability, and identity authentication of communication data is fundamental to building a secure digital environment.

[0003] Due to the emergence of quantum computers, classical algorithms are no longer secure, and communication data protected by classical algorithms will also be threatened by quantum computers. Summary of the Invention

[0004] The purpose of the present invention is to provide a communication implementation method, system and computer device that are resistant to quantum computing to solve the technical problems in the prior art, which can effectively resist the attacks of quantum computers.

[0005] In a first aspect, the present invention provides a method for implementing quantum computing-resistant communication, which is applied to a client to enable the client to access a target server through a front-end server. The method includes:

[0006] Establish a PQC channel with the front-end server. The PQC channel uses the post-quantum algorithm to output the first master key. The first master key is used to derive the second master key, which is sent to the target server.

[0007] Sending first key agreement information to the front-end server, where the first key agreement information is encrypted by the second master key, and sending the first key agreement information to the target server via the front-end server. After the first key agreement information is decrypted by the target server, the target server sends second key agreement information to the front-end server.

[0008] receiving the second key negotiation information sent from the front-end server, decrypting the second key negotiation information using the second master key, and calculating a session key based on the first key negotiation information and the second key negotiation information, where the session key is also generated by the target server based on the first key negotiation information and the second key negotiation information;

[0009] The client uses the session key to achieve encrypted communication with the target server.

[0010] In the above method for implementing quantum-resistant communication, preferably, the client includes an APP application layer and an APP transport layer, wherein:

[0011] The APP transport layer establishes a PQC channel with the front-end server and negotiates to obtain the first master key, which is then sent to the APP application layer.

[0012] The APP application layer receives the first master key and derives the second master key from the first master key. The APP application layer encrypts the first key negotiation information using the second master key. The first key negotiation information is sent to the front-end server via the APP transport layer.

[0013] The APP transport layer receives the second key negotiation information sent by the front-end server and then sends it to the APP application layer. The APP application layer uses the second master key to decrypt the second key negotiation information and calculates the session key based on the first key negotiation information and the second key negotiation information.

[0014] In the above method for implementing quantum computing-resistant communication, preferably,

[0015] The APP application layer encrypts the original data using the session key to obtain first communication data, and the APP application layer sends the first communication data to the APP transport layer;

[0016] The APP transport layer encrypts the first communication data using the first master key to obtain the second communication data, and the APP transport layer sends the second communication data to the front-end server;

[0017] The second communication data is decrypted by the front-end server using the first master key to obtain the first communication data;

[0018] The first communication data is decrypted by the target server using the session key to obtain the original data.

[0019] In the above method for implementing quantum computing-resistant communication, preferably, the client and the front-end server establish a PQC channel including:

[0020] Sending the first random number, the supported protocol version, and the supported post-quantum algorithm type to the front-end server;

[0021] Receive a second random number, a first post-quantum algorithm public key, a selected protocol version, and a selected post-quantum algorithm sent by a front-end server;

[0022] Use the first post-quantum algorithm public key to encapsulate the pre-key and the ciphertext of the pre-key, retain the pre-key, use the first random number, the second random number and the pre-key to derive the first master key, and then send the ciphertext to the front-end server;

[0023] Use the built-in second post-quantum algorithm private key to sign the information sent by both parties and the client identity information to obtain the client signature and send it to the front-end server;

[0024] Obtain the server-side signature sent from the front-end server. The server-side signature is obtained by the front-end server using the built-in second post-quantum algorithm private key to sign the information sent between the client and the front-end server and the client's identity information after the front-end server verifies the client's signature;

[0025] Use the built-in second post-quantum algorithm public key to verify the server signature, thereby confirming the identity of the front-end server.

[0026] As described above, a method for implementing quantum computing-resistant communication, wherein preferably, the first post-quantum algorithm is a post-quantum cryptographic encapsulation algorithm, and the second post-quantum algorithm is a post-quantum cryptographic signature algorithm.

[0027] As described above, a method for implementing quantum computing-resistant communication is described, wherein preferably, the session key is generated by a classical algorithm, and the classical algorithm includes SM1, SM2, SM3, SM4, SM7, SM9 or ZUC algorithm.

[0028] In a second aspect, the present invention provides a communication system including a client, a front-end server, a password management platform, and a target server, wherein the client has an APP application layer and an APP transport layer connected by a signal, wherein:

[0029] The APP transport layer establishes a PQC channel with the front-end server and negotiates to obtain the first master key, which is then sent to the APP application layer and the password management platform respectively;

[0030] The APP application layer receives the first master key and derives the second master key from the first master key. The APP application layer encrypts the first key negotiation information using the second master key. The first key negotiation information passes through the APP transport layer and the front-end server in sequence and is then sent to the target server.

[0031] The password management platform derives the first master key to obtain a second master key, and the second master key is sent to the target server;

[0032] The target server decrypts the first key negotiation information using the second master key, and encrypts the second key negotiation information using the second master key. The second key negotiation information passes through the front-end server and the APP transport layer in sequence and is sent to the APP application layer.

[0033] The APP application layer uses the second master key to decrypt the second key negotiation information, and calculates the session key based on the first key negotiation information and the second key negotiation information. The session key is also generated by the first key negotiation information and the second key negotiation information.

[0034] The client uses the session key to achieve encrypted communication with the target server.

[0035] A communication system as above, wherein preferably,

[0036] The APP application layer encrypts the original data using the session key to obtain first communication data, and the APP application layer sends the first communication data to the APP transport layer;

[0037] The APP transport layer encrypts the first communication data using the first master key to obtain the second communication data, and the APP transport layer sends the second communication data to the front-end server;

[0038] The second communication data is decrypted by the front-end server using the first master key to obtain the first communication data;

[0039] The first communication data is decrypted by the target server using the session key to obtain the original data.

[0040] In a third aspect, the present invention provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the aforementioned method when executing the computer program.

[0041] In a fourth aspect, the present invention provides a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the aforementioned method when run.

[0042] Compared with the existing technology, the present invention first establishes a PQC channel protected by the post-quantum algorithm between the client and the front-end server, and then uses this secure channel to protect multiple classical secure channels established between the client and different target servers, thereby realizing a protection chain in which the PQC algorithm protects the classical algorithm, and the classical algorithm protects the communication data. An attacker must break through the PQC algorithm plus the classical algorithm to obtain the original data, thereby effectively resisting the attack of quantum computers. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is a flowchart of a method for implementing quantum computing-resistant communication provided by an embodiment of the present invention;

[0044] Figure 2 Schematic diagram of the implementation steps of the method for implementing quantum computing-resistant communication provided by an embodiment of the present invention;

[0045] Figure 3This is a flowchart of a method for implementing a PQC channel provided by an embodiment of the present invention;

[0046] Figure 4 It is a schematic diagram of the implementation steps of the PQC channel provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and are not to be construed as limiting the present invention.

[0048] Reference Figure 1 as well as Figure 2 As shown, an embodiment of the present invention provides a method for implementing quantum computing-resistant communication, which is applied to a client to enable the client to access a target server through a front-end server. The method includes:

[0049] Step S101: Establish a PQC channel with the front-end server. The PQC channel uses a post-quantum algorithm to output a first master key. The first master key is used to derive a second master key, and the second master key is sent to the target server.

[0050] The PQC channel is built based on the post-quantum algorithm (PQC) and is used to provide subsequent identity authentication and data protection. The PQC channel generates the first master key, which is used to protect data in subsequent data exchanges. The post-quantum algorithm can provide protection against quantum computer attacks and ensure the security of the information exchange process.

[0051] The PQC channel has a long validity period, allowing for multiple session key negotiations within it. The advantage of this two-phase negotiation is that it splits the authentication and key negotiation process into two parts, with the more complex tasks handled by the longer-lived PQC channel. This allows both parties to complete only one PQC channel, even if they need to communicate multiple times.

[0052] The first master key is used to derive the second master key. The derivation process usually uses a key derivation function (KDF), such as HKDF (HMAC-based Key Derivation Function).

[0053] In one feasible implementation, the front-end server also obtains a first master key through key negotiation. This first master key is then sent to the password management platform. The password management platform derives the first master key using a key derivation function (such as HKDF) to generate a second master key, which is then sent to the target server. After receiving the second master key, the target server uses it for subsequent encryption and decryption operations, ensuring secure data transmission and storage.

[0054] Step S102: Send the first key negotiation information to the front-end server, the first key negotiation information is encrypted by the second master key, the first key negotiation information is sent to the target server via the front-end server, when the first key negotiation information is decrypted by the target server, the second key negotiation information is sent to the front-end server by the target server.

[0055] After receiving the encrypted first key negotiation information, the target server uses the second master key to decrypt the first key information. At the same time, the target server uses the second master key to encrypt the second key negotiation information. The second key negotiation information is sent to the client after passing through the front-end server in turn.

[0056] Step S103: Receive the second key negotiation information sent from the front-end server, use the second master key to decrypt the second key negotiation information, and calculate the session key based on the first key negotiation information and the second key negotiation information. The session key is also generated by the target server based on the first key negotiation information and the second key negotiation information.

[0057] Step S104: The client uses the session key to implement encrypted communication with the target server.

[0058] The present invention first establishes a PQC channel protected by a post-quantum algorithm between the client and the front-end server. This secure channel is then used to protect multiple classical secure channels established between the client and different target servers. During long communication connections (long duration, infrequent establishment), the time-consuming PQC algorithm is used, while during short communication connections (short duration, frequent establishment), the less time-consuming classical national encryption algorithm is used. Long connections are then used to protect the establishment of short connections. This creates a protection chain where the PQC algorithm protects the classical algorithm, and the classical algorithm protects the communication data. Attackers must break both the PQC and classical algorithms to obtain the original data, effectively resisting attacks from quantum computers.

[0059] If the client wants to communicate with another target server, the first master key remains unchanged. Instead, the client uses the first master key to derive a third master key. The client uses this third master key to encrypt the first key agreement message. The password management platform also uses the first master key to derive a third master key and sends it to the target server. The target server uses the third master key to decrypt the first key agreement message and then encrypts the second key agreement message with the third master key. After the second key agreement message is sent to the client, the client uses the third master key to decrypt the second key agreement message and calculates a new session key based on the key agreement information of both parties. The client and the target server use this new session key to achieve encrypted communication.

[0060] In the embodiment provided by the present invention, the client includes an APP application layer and an APP transport layer, wherein:

[0061] The App transport layer establishes a PQC channel with the front-end server and negotiates a first master key, which is then sent to the App application layer. The App application layer can use the first master key to encrypt and decrypt application layer data, ensuring the security of the App application layer data.

[0062] In one feasible implementation, the front-end server also obtains a first master key through key negotiation. This first master key is then sent to the password management platform. The password management platform derives the first master key using a key derivation function (such as HKDF) to generate a second master key, which is then sent to the target server. After receiving the second master key, the target server uses it for subsequent encryption and decryption operations, ensuring secure data transmission and storage.

[0063] The APP application layer receives the first master key and derives the second master key from the first master key. The APP application layer uses the second master key to encrypt the first key negotiation information, and the first key negotiation information is sent to the front-end server via the APP transport layer.

[0064] After receiving the encrypted first key negotiation information, the target server uses the second master key to decrypt the first key information. At the same time, the target server uses the second master key to encrypt the second key negotiation information. The second key negotiation information is sent to the APP transport layer after passing through the front-end server in turn.

[0065] The APP transport layer receives the second key negotiation information sent by the front-end server and then sends it to the APP application layer. The APP application layer uses the second master key to decrypt the second key negotiation information, and calculates the session key based on the first key negotiation information and the second key negotiation information. The client uses the session key to achieve encrypted communication with the target server.

[0066] Furthermore, the APP application layer uses the session key to encrypt the original data to obtain the first communication data, which is used to ensure the security and efficiency of the data during the encryption and decryption process of the APP application layer. The APP application layer sends the first communication data to the APP transport layer.

[0067] The APP transport layer uses the first master key to encrypt the first communication data to obtain the second communication data, which is used to ensure the security and efficiency of the data during the encryption and decryption process of the APP transport layer. The APP transport layer sends the second communication data to the front-end server.

[0068] The second communication data is decrypted by the front-end server using the first master key to obtain the first communication data. This step ensures the security of the data during transmission and prevents it from being attacked or stolen by a middleman.

[0069] The first communication data is decrypted by the target server using the session key to obtain the original data. This step ensures the security and integrity of the data on the target server.

[0070] In the embodiments provided by the present invention, reference is made to Figure 3 as well as Figure 4 As shown, the establishment of a PQC channel between the client and the front-end server includes:

[0071] Step S1011: Send a first random number, a supported protocol version, and a supported post-quantum algorithm type to the front-end server; receive a second random number, a first post-quantum algorithm public key, a selected protocol version, and a selected post-quantum algorithm sent by the front-end server.

[0072] Specifically, the first random number is used in the subsequent key generation and verification process. Preferably, the first random number is a quantum random number. Quantum random numbers (QRNG) are random numbers generated based on the principles of quantum mechanics, which are unpredictable and aperiodic, to ensure security and reliability during the communication process.

[0073] The protocol version sent by the app's transport layer determines the specifications and rules framework for subsequent communications between the two parties. The protocol version defines the rules and procedures that must be followed during communication, including how to establish a connection, exchange information, and handle errors. The algorithm type, on the other hand, determines subsequent security-related operations such as encryption and signing, establishing the initial parameters for communication.

[0074] After the front-end server receives the information from the APP transport layer, it begins to filter from the set of protocol versions and algorithm types provided by the APP transport layer, and determines a suitable option based on its own system configuration, pre-set security policies, and support capabilities for various protocols and algorithms. After determining the selection, the front-end server will clearly inform the APP transport layer which specific protocol version and algorithm type has been selected, so that the APP transport layer knows that subsequent communications will proceed accordingly.

[0075] In addition, the front-end server also generates and transmits a second random number to the app transport layer. This second random number, similar to the first random number sent by the app transport layer, is also used for subsequent operations such as generating the first master key. Preferably, the second random number is also a quantum random number. By having both parties provide random numbers, the randomness and confidentiality of key generation are further enhanced.

[0076] By exchanging random numbers and confirming the protocol version and algorithm, the APP transport layer and the front-end server confirm that they use the same communication rules and security measures, thereby establishing a secure communication channel.

[0077] In the embodiments provided herein, the post-quantum algorithm includes a first post-quantum algorithm and a second post-quantum algorithm. In one feasible implementation, the first post-quantum algorithm is a post-quantum cryptographic encapsulation algorithm, exemplarily the Kyber algorithm. The Kyber algorithm is a lattice-based public key encryption scheme used for operations such as key encapsulation. The front-end server sends the Kyber public key to the app transport layer for subsequent key encapsulation and decryption operations, thereby establishing a secure communication key system between the two parties. The second post-quantum algorithm is a post-quantum cryptographic signature algorithm, exemplarily the Dilithium algorithm. The Dilithium algorithm is a lattice-based digital signature scheme used for operations such as identity authentication.

[0078] The session key is generated using a classic algorithm, including SM1, SM2, SM3, SM4, SM7, SM9, or ZUC.

[0079] Step S1012: Use the first post-quantum algorithm public key to encapsulate the pre-key and the ciphertext of the pre-key, retain the pre-key, use the first random number, the second random number and the pre-key to derive the first master key, and then send the ciphertext to the front-end server.

[0080] The APP transport layer uses the Kyber public key sent by the front-end server to perform key encapsulation operations. During this process, a specific key encapsulation algorithm is used in combination with relevant parameters to generate a pre-key and the corresponding ciphertext form (i.e., Cipher).

[0081] The prekey is typically a randomly generated number, preferably a quantum random number, used for subsequent session encryption. Encrypting it into a cipher ensures confidentiality during transmission to the front-end server. The app's transport layer then sends the cipher to the front-end server.

[0082] After receiving the Cipher, the front-end server decrypts it using its own Kyber private key. Due to the specific mathematical correspondence between Kyber public and private keys, only the matching private key can correctly decrypt the ciphertext generated by the corresponding public key. Through this decryption process, the front-end server can successfully obtain the plaintext content of the pre-key.

[0083] After the ciphertext is decrypted by the front-end server, the front-end server now has the necessary elements to generate the first master key, namely the first random number, the second random number and the pre-key. The front-end server uses the same algorithm to combine the first random number, the second random number and the pre-key to derive the first master key.

[0084] Step S1013: Use the built-in second post-quantum algorithm private key to sign the information sent by both parties and the client identity information to obtain the client signature, and send it to the front-end server.

[0085] Specifically, the client signature is obtained by the APP transport layer using the built-in Dilithium private key to sign the information sent by both parties and the client identity information. After the front-end server receives the client signature, it verifies the signature with the built-in Dilithium public key to determine the identity of the other party. Through the private key-based signature method, the APP transport layer proves the legitimacy of its identity to the front-end server. Only the party with the corresponding Dilithium private key can generate the correct signature, and the front-end server can verify it through the corresponding Dilithium public key. If the verification is successful, it means that the APP transport layer currently communicating with it is legal and has the corresponding private key, thereby confirming the identity of the APP transport layer and laying the foundation for subsequent secure and reliable communication. If the verification fails, it may mean that there is a security risk, such as encountering a man-in-the-middle attack, and the communication will be interrupted.

[0086] Step S1014: Obtain the server signature sent from the front-end server. The server signature is obtained after the front-end server verifies the client signature. The front-end server uses the built-in second post-quantum algorithm private key to sign the information sent between the client and the front-end server and the client identity information, and uses the built-in second post-quantum algorithm public key to verify the server signature, thereby confirming the identity of the front-end server.

[0087] Specifically, the server signature is obtained by the front-end server using the built-in Dilithium private key to sign the information sent by both parties and the server identity information. After the APP transport layer receives the client signature, it uses the built-in Dilithium public key to verify the signature to determine the identity of the other party. Through the private key-based signature method, the front-end server proves the legitimacy of its identity to the APP transport layer. Only the party with the corresponding Dilithium private key can generate the correct signature, and the APP transport layer can verify it through the corresponding Dilithium public key. If the verification is successful, it means that the front-end server currently communicating with it is legal and has the corresponding private key, thereby confirming the identity of the front-end server and laying the foundation for subsequent secure and reliable communication. If the verification fails, it may mean that there is a security risk, such as encountering a man-in-the-middle attack, and the communication will be interrupted.

[0088] After the key verification step, the APP transport layer and the front-end server have determined a consistent, secure and reliable first master key. On this basis, the APP transport layer and the front-end server can use this first master key for subsequent communication encryption.

[0089] In a second aspect, the present invention provides a communication system, referring to Figure 1 As shown, it includes a client, a front-end server, a password management platform, and a target server. The client has an APP application layer and an APP transport layer for signal connection, where:

[0090] The APP transport layer establishes a PQC channel with the front-end server and negotiates to obtain the first master key, which is then sent to the APP application layer and the password management platform respectively.

[0091] The APP application layer receives the first master key and derives the second master key from the first master key. The APP application layer uses the second master key to encrypt the first key negotiation information. The first key negotiation information passes through the APP transport layer and the front-end server in turn and is sent to the target server.

[0092] The password management platform derives the first master key to obtain a second master key, and the second master key is sent to the target server.

[0093] The target server uses the second master key to decrypt the first key negotiation information, and at the same time, the target server uses the second master key to encrypt the second key negotiation information. The second key negotiation information passes through the front-end server and the APP transport layer in turn and is sent to the APP application layer.

[0094] The APP application layer uses the second master key to decrypt the second key negotiation information, and calculates the session key based on the first key negotiation information and the second key negotiation information. The session key is also generated by the target server based on the first key negotiation information and the second key negotiation information.

[0095] The client uses the session key to achieve encrypted communication with the target server.

[0096] Furthermore, the APP application layer encrypts the original data using the session key to obtain first communication data, and the APP application layer sends the first communication data to the APP transport layer.

[0097] The APP transport layer encrypts the first communication data using the first master key to obtain the second communication data, and the APP transport layer sends the second communication data to the front-end server.

[0098] The second communication data is decrypted by the front-end server using the first master key to obtain the first communication data.

[0099] The first communication data is decrypted by the target server using the session key to obtain the original data.

[0100] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to implement the steps in any one of the above method embodiments.

[0101] Specifically, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0102] Specifically, in this embodiment, the processor may be configured to implement the following steps through a computer program:

[0103] Step S101: A PQC channel is established with a front-end server. The PQC channel uses a post-quantum algorithm to output a first master key. The first master key is used to derive a second master key, which is sent to a target server.

[0104] Step S102: Send the first key negotiation information to the front-end server, the first key negotiation information is encrypted by the second master key, the first key negotiation information is sent to the target server via the front-end server, when the first key negotiation information is decrypted by the target server, the second key negotiation information is sent to the front-end server by the target server.

[0105] Step S103: Receive the second key negotiation information sent from the front-end server, use the second master key to decrypt the second key negotiation information, and calculate the session key based on the first key negotiation information and the second key negotiation information. The session key is also generated by the target server based on the first key negotiation information and the second key negotiation information.

[0106] Step S104: The client uses the session key to implement encrypted communication with the target server.

[0107] In a fourth aspect, an embodiment of the present invention further provides a storage medium, in which a computer program is stored, wherein the computer program is configured to implement the steps of any of the above method embodiments when run.

[0108] Specifically, in this embodiment, the above-mentioned storage medium may be configured to store a computer program for implementing the following steps:

[0109] Step S101: A PQC channel is established with a front-end server. The PQC channel uses a post-quantum algorithm to output a first master key. The first master key is used to derive a second master key, which is sent to a target server.

[0110] Step S102: Send the first key negotiation information to the front-end server, the first key negotiation information is encrypted by the second master key, the first key negotiation information is sent to the target server via the front-end server, when the first key negotiation information is decrypted by the target server, the second key negotiation information is sent to the front-end server by the target server.

[0111] Step S103: Receive the second key negotiation information sent from the front-end server, use the second master key to decrypt the second key negotiation information, and calculate the session key based on the first key negotiation information and the second key negotiation information. The session key is also generated by the target server based on the first key negotiation information and the second key negotiation information.

[0112] Step S104: The client uses the session key to implement encrypted communication with the target server.

[0113] The above describes in detail the structure, features and effects of the present invention based on the embodiments shown in the drawings. The above is only a preferred embodiment of the present invention, but the scope of implementation of the present invention is not limited to what is shown in the drawings. Any changes made in accordance with the concept of the present invention, or modifications to equivalent embodiments with equivalent changes, which do not exceed the spirit covered by the description and drawings, should be within the scope of protection of the present invention.

Claims

1. A method for implementing quantum computing-resistant communication, characterized in that: Applied to a client, so that the client accesses a target server through a front-end server, the method includes: Establishing a PQC channel with a front-end server, wherein the PQC channel outputs a first master key using a post-quantum algorithm, the first master key is used to derive a second master key, and the second master key is sent to the target server; Sending first key agreement information to the front-end server, where the first key agreement information is encrypted by the second master key, and the first key agreement information is sent to the target server via the front-end server. After the first key agreement information is decrypted by the target server, the target server sends second key agreement information to the front-end server. receiving the second key agreement information sent from the front-end server, decrypting the second key agreement information using the second master key, and calculating a session key based on the first key agreement information and the second key agreement information, where the session key is also generated by the target server based on the first key agreement information and the second key agreement information; The client uses the session key to achieve encrypted communication with the target server.

2. The method according to claim 1, characterized in that The client includes an APP application layer and an APP transport layer, wherein: The APP transport layer establishes a PQC channel with the front-end server, negotiates to obtain a first master key, and the first master key is sent to the APP application layer; The APP application layer receives the first master key and performs key derivation on the first master key to obtain the second master key. The APP application layer encrypts first key agreement information using the second master key. The first key agreement information is sent to the front-end server via the APP transport layer. The APP transport layer receives the second key negotiation information sent by the front-end server, and then sends it to the APP application layer. The APP application layer uses the second master key to decrypt the second key negotiation information, and calculates the session key based on the first key negotiation information and the second key negotiation information.

3. The method according to claim 2, wherein: The APP application layer encrypts the original data using the session key to obtain first communication data, and the APP application layer sends the first communication data to the APP transport layer; The APP transport layer encrypts the first communication data using the first master key to obtain second communication data, and the APP transport layer sends the second communication data to the front-end server; The second communication data is decrypted by the front-end server using the first master key to obtain the first communication data; The first communication data is decrypted by the target server using the session key to obtain original data.

4. The method according to claim 1, wherein: The establishment of a PQC channel between the client and the front-end server includes: Sending a first random number, a supported protocol version, and a supported post-quantum algorithm type to the front-end server; Receiving a second random number, a first post-quantum algorithm public key, a selected protocol version, and a selected post-quantum algorithm sent by the front-end server; Encapsulating a prekey and a ciphertext of the prekey using the first post-quantum algorithm public key, retaining the prekey, deriving a first master key using the first random number, the second random number, and the prekey, and then sending the ciphertext to the front-end server; The information sent by both parties and the client identity information are signed using the built-in second post-quantum algorithm private key to obtain a client signature, and sent to the front-end server; Obtaining a server-side signature sent from the front-end server, where the server-side signature is obtained by the front-end server using a built-in second post-quantum algorithm private key to sign information sent between the client and the front-end server and the client identity information after the front-end server verifies the client signature; The server signature is verified using the built-in second post-quantum algorithm public key to confirm the identity of the front-end server.

5. The method according to claim 4, characterized in that: The first post-quantum algorithm is a post-quantum cryptographic encapsulation algorithm, and the second post-quantum algorithm is a post-quantum cryptographic signature algorithm.

6. The method according to claim 4, characterized in that: The session key is generated by a classic algorithm, which includes SM1, SM2, SM3, SM4, SM7, SM9 or ZUC algorithm.

7. A communication system, characterized in that: It includes a client, a front-end server, a password management platform and a target server. The client has an APP application layer and an APP transport layer connected by signals, wherein: The APP transport layer establishes a PQC channel with the front-end server and negotiates to obtain a first master key, which is sent to the APP application layer and the password management platform respectively; The APP application layer receives the first master key and derives the first master key to obtain a second master key. The APP application layer encrypts the first key negotiation information using the second master key. The first key negotiation information passes through the APP transport layer and the front-end server in sequence and is then sent to the target server. The password management platform derives the first master key to obtain the second master key, and the second master key is sent to the target server; The target server decrypts the first key negotiation information using the second master key, and encrypts the second key negotiation information using the second master key. The second key negotiation information passes through the front-end server and the APP transport layer in sequence and is sent to the APP application layer. The APP application layer uses the second master key to decrypt the second key negotiation information, and calculates the session key based on the first key negotiation information and the second key negotiation information. The session key is also generated by the target server based on the first key negotiation information and the second key negotiation information. The client uses the session key to achieve encrypted communication with the target server.

8. The communication system according to claim 7, wherein: The APP application layer encrypts the original data using the session key to obtain first communication data, and the APP application layer sends the first communication data to the APP transport layer; The APP transport layer encrypts the first communication data using the first master key to obtain second communication data, and the APP transport layer sends the second communication data to the front-end server; The second communication data is decrypted by the front-end server using the first master key to obtain the first communication data; The first communication data is decrypted by the target server using the session key to obtain original data.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 6 when executed.

Images