A quantum key-based SSH communication method, device, and medium

Abstract

This invention relates to the field of information security technology and discloses a quantum key-based SSH communication method, device, and medium. It integrates quantum key distribution (QKD) technology into the SSH protocol handshake process, extending SSH protocol messages to negotiate the use of a quantum key-based key exchange algorithm. The communicating parties use the QKD device to generate and share a quantum key, which is then combined with a key generated by a traditional SSH key exchange algorithm to generate a final session key for subsequent encrypted communication. This addresses the security vulnerabilities of the traditional SSH protocol against quantum computer attacks, providing a more secure remote login and data transmission solution.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and more specifically to a quantum key-based SSH communication method, device, and medium. Background Technology

[0002] With the rapid development of information technology, cybersecurity has increasingly become a focus of attention for all sectors of society. Among numerous security protocols, the SSH (Secure Shell) protocol is widely used due to its security in providing remote login and data transmission.

[0003] Traditional SSH protocols primarily rely on asymmetric encryption algorithms (such as RSA and DSA) to ensure the security and integrity of data transmission. However, with the development of quantum computing technology, traditional encryption algorithms face unprecedented challenges. Quantum computers possess computing power surpassing that of classical computers, especially against traditional encryption algorithms based on factorization and discrete logarithm problems. Theoretically, they can be cracked very quickly, posing a serious threat to the security of existing SSH protocols.

[0004] In light of the aforementioned security risks, exploring a novel SSH communication method capable of resisting quantum computer attacks is of paramount importance. To this end, this invention proposes an SSH communication scheme based on Quantum Key Distribution (QKD) technology. Summary of the Invention

[0005] In view of this, the present invention provides a quantum key-based SSH communication method, device, and medium, aiming to solve the security vulnerabilities of the traditional SSH protocol in the face of quantum computer attacks. By applying quantum key distribution technology to the SSH protocol, a more secure remote login and data transmission solution is provided.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] A quantum key-based SSH communication method includes:

[0008] The client sends a client SSH protocol version message to the server, and the server, upon receiving the message, sends its own SSH protocol version message to the client.

[0009] After receiving the SSH protocol version message from the server, the client sends a key exchange initialization message to the server, and the server sends a key exchange initialization message to the client after receiving the message.

[0010] After initialization, the client sends a quantum key exchange request to the server. Upon receiving the quantum key exchange request, the server sends a quantum key exchange response to the client and calculates the server's SSH traditional protocol key negotiation session key and the server's QK quantum key.

[0011] After receiving the quantum key exchange response, the client calculates the new session key and sends a quantum key exchange end message to the server.

[0012] After receiving the quantum key exchange completion message, the server negotiates the session key via the server-side SSH traditional protocol key and calculates the new session key via the server-side QK quantum key.

[0013] Preferably, the client SSH protocol version message includes the SSH protocol, Quantum SSH, and client-defined information;

[0014] The server-side SSH protocol version message includes the SSH protocol, Quantum SSH, and server-customized information.

[0015] Preferably, the key exchange initialization message includes a key exchange algorithm, a host key algorithm, a client-to-server encryption algorithm, a server-to-client encryption algorithm, a client-to-server MAC algorithm, and a server-to-client MAC algorithm.

[0016] Preferably, the process includes the following steps before the client sends a quantum key exchange request to the server:

[0017] The client obtains quantum key extension information from the QKD device. The quantum key extension information includes the client's QK quantum key and the client's quantum key extension.

[0018] Preferably, the quantum key exchange request includes the client's SSH traditional protocol key and the client's quantum key extension.

[0019] Preferably, the server-side calculation includes the traditional SSH protocol key negotiation session key and the server-side QK quantum key, specifically including:

[0020] Client-based SSH traditional protocol key calculation and server-side SSH traditional protocol key negotiation session key;

[0021] Obtain server-side QK quantum keys using client-side quantum key extension on the same QKD device.

[0022] Preferably, the quantum key exchange response includes server-side SSH traditional protocol key exchange parameters and server-side quantum key extension.

[0023] Preferably, after receiving the quantum key exchange response, the client calculates the new session key including:

[0024] The server-side quantum key expansion is compared with the client-side quantum key expansion; if they are the same, the verification is successful.

[0025] Calculate the client-side SSH traditional protocol key negotiation session key based on the server-side SSH traditional protocol key exchange parameters;

[0026] A new session key is obtained by negotiating the session key using the traditional SSH protocol on the client and calculating the QK quantum key on the client.

[0027] A computer device includes a memory and a processor, wherein the memory stores a computer program executable on the processor, and when the processor executes the computer program, it implements a quantum key-based SSH communication method.

[0028] A computer-readable storage medium storing a computer program that, when executed by a processor, implements a quantum key-based SSH communication method.

[0029] As can be seen from the above technical solution, compared with the prior art, this invention discloses a quantum key-based SSH communication method, device, and medium. It integrates quantum key distribution (QKD) technology into the SSH protocol handshake process, and negotiates the use of a quantum key-based key exchange algorithm by extending the SSH protocol messages. The communicating parties use the QKD device to generate and share a quantum key, and combine it with the key generated by the traditional SSH key exchange algorithm to generate the final session key for subsequent encrypted communication. This solves the security vulnerabilities of the traditional SSH protocol against quantum computer attacks, providing a more secure remote login and data transmission solution. It is suitable for remote login and data transmission scenarios with high security requirements, such as network communications in government agencies, financial institutions, and the military. By using the quantum key-based SSH communication method, these organizations can ensure the security of their communication data against future quantum computer attacks. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0031] Figure 1 The present invention provides a flowchart of an SSH communication method based on quantum keys.

[0032] Figure 2 The interactive flowchart provided for this invention. Detailed Implementation

[0033] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] This invention discloses an SSH communication method based on quantum key distribution, such as... Figure 1 and Figure 2 As shown, both the client and server are connected to a common QKD device for obtaining QK quantum keys. The method includes:

[0035] 1) The client sends a client SSH protocol version message to the server. After receiving the message, the server confirms that the client SSH protocol version message is the Quantum version and then sends a server SSH protocol version message to the client. The client SSH protocol version message includes the SSH protocol, Quantum SSH, and client-defined information. The server SSH protocol version message includes the SSH protocol, Quantum SSH, and server-defined information.

[0036] 2) After receiving the SSH protocol version message from the server and confirming that it is the quantum version, the client sends a key exchange initialization message to the server. The message includes the key exchange algorithm, host key algorithm, client-to-server encryption algorithm, server-to-client encryption algorithm, client-to-server MAC algorithm, and server-to-client MAC algorithm.

[0037] The key exchange algorithm includes a quantum-based key negotiation algorithm extension, as shown in the following example:

[0038] qkd-diffie-hellman-group1-sha1 (Diffie-Hellman key exchange algorithm group1, quantum key extension)

[0039] qkd-diffie-hellman-group14-sha1 (Diffie-Hellman key exchange algorithm group14, quantum key extension)

[0040] qkd-diffie-hellman-group-exchange-sha1 (Diffie-Hellman key exchange algorithm, quantum key extension)

[0041] qkd-diffie-hellman-group-exchange-sha256 (Diffie-Hellman key exchange algorithm, quantum key extension)

[0042]

[0043] qkd-sm2-sm3 (Chinese national cryptographic SM2 key exchange algorithm, quantum key extension)

[0044] After receiving the message, the server sends a key exchange initialization message to the client. The key exchange initialization message is consistent with the content sent by the client.

[0045] For ease of understanding of the technical solution, in the following text, quantum key extension will be referred to as client-side quantum key extension on the client side and server-side quantum key extension on the server side.

[0046] 3) The client obtains quantum key extension information from the QKD device. The quantum key extension information includes the client's QK quantum key and the client's quantum key extension. The client's QK quantum key is stored locally. The client sends a quantum key exchange request to the server. The quantum key exchange request includes the client's SSH traditional protocol key and the client's quantum key extension.

[0047] After receiving the quantum key exchange request from the client, the server performs the following operations:

[0048] A) Send a quantum key exchange response. The message content includes the server-side SSH traditional protocol key exchange parameters and the server-side quantum key extension. The server-side quantum key extension is the same as that of the client and is used by the client for confirmation.

[0049] B) Client-based SSH traditional protocol key calculation and server-side SSH traditional protocol key negotiation session key;

[0050] C) Use the client-sent client-side quantum key extension to obtain the server-side QK quantum key on the same QKD device.

[0051] 4) After receiving the quantum key exchange response from the server, the client sends a quantum key exchange end message and calculates a new session key.

[0052] The quantum key exchange end message is optional. In some traditional algorithms (such as SM2-SM3), including this message adds quantum extensions. The quantum key exchange end message includes the client's quantum key extension.

[0053] After receiving the quantum key exchange response, the client calculates the new session key, including:

[0054] The server-side quantum key expansion is compared with the client-side quantum key expansion; if they are the same, the verification is successful.

[0055] Calculate the client-side SSH traditional protocol key negotiation session key based on the server-side SSH traditional protocol key exchange parameters;

[0056] A new session key is obtained by negotiating the session key using the traditional SSH protocol on the client and calculating the QK quantum key on the client.

[0057] 5) After receiving the quantum key exchange completion message, the server performs the same key operation:

[0058] A new session key is obtained by performing calculations using the server-side SSH traditional protocol key negotiation session key and the server-side QK quantum key.

[0059] In subsequent communications, the client and server use the same session key for encrypted communication based on the algorithm in the key exchange initialization message.

[0060] This invention adds QK quantum key negotiation to the entire negotiation process. The QK quantum key participates in the traditional SSH handshake interaction, and the traditional SSH handshake interaction participates in the final session key calculation stage, thus solving the security risks of the traditional SSH protocol when facing quantum computer attacks.

[0061] This embodiment provides a computer device, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor executes the computer program, it implements a quantum key-based SSH communication method.

[0062] This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements a quantum key-based SSH communication method.

[0063] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0064] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0065] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A quantum key-based SSH communication method, characterized in that, include: The client sends a client SSH protocol version message to the server, and the server, upon receiving the message, sends its own SSH protocol version message to the client. After receiving the SSH protocol version message from the server, the client sends a key exchange initialization message to the server, and the server sends a key exchange initialization message to the client after receiving the message. After initialization, the client sends a quantum key exchange request to the server. Upon receiving the quantum key exchange request, the server sends a quantum key exchange response to the client and calculates the server's SSH traditional protocol key negotiation session key and the server's QK quantum key. After receiving the quantum key exchange response, the client calculates the new session key and sends a quantum key exchange end message to the server. After receiving the quantum key exchange completion message, the server negotiates the session key using the server-side SSH traditional protocol key negotiation and calculates the new session key using the server-side QK quantum key. Before the client sends a quantum key exchange request to the server, it also includes: The client obtains quantum key extension information from the QKD device. The quantum key extension information includes the client's QK quantum key and the client's quantum key extension. The quantum key exchange request includes the client's SSH traditional protocol key and the client's quantum key extension; The server-side calculation includes the traditional SSH protocol key negotiation session key and the server-side QK quantum key, specifically: Client-based SSH traditional protocol key calculation and server-side SSH traditional protocol key negotiation session key; Obtain server-side QK quantum keys on the same QKD device through client-side quantum key expansion; The quantum key exchange response includes server-side SSH traditional protocol key exchange parameters and server-side quantum key extensions; After receiving the quantum key exchange response, the client calculates the new session key, including: The server-side quantum key expansion is compared with the client-side quantum key expansion; if they are the same, the verification is successful. Calculate the client-side SSH traditional protocol key negotiation session key based on the server-side SSH traditional protocol key exchange parameters; A new session key is obtained by negotiating the session key using the traditional SSH protocol on the client and calculating the QK quantum key on the client.

2. The SSH communication method based on quantum key distribution according to claim 1, characterized in that, The client SSH protocol version message includes the SSH protocol, Quantum SSH, and client-defined information; The server-side SSH protocol version message includes the SSH protocol, Quantum SSH, and server-customized information.

3. The SSH communication method based on quantum key distribution according to claim 1, characterized in that, The key exchange initialization message includes the key exchange algorithm, host key algorithm, client-to-server encryption algorithm, server-to-client encryption algorithm, client-to-server MAC algorithm, and server-to-client MAC algorithm.

4. A computer device, characterized in that, include: A memory and a processor, wherein the memory stores a computer program executable on the processor, and the processor, when executing the computer program, implements the method according to any one of claims 1 to 3.

5. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, implements the method described in any one of claims 1 to 3.

Images