Digital certificate processing method and device for quantum-resistant cryptographic algorithm

Abstract

The present application discloses a digital certificate processing method and device for quantum-resistant cryptographic algorithms. The security authentication device method includes: receiving a digital certificate to be stored sent by a host computer, the digital certificate to be stored is generated based on a quantum-resistant cryptographic algorithm; establishing a lightweight certificate file for excluding public key data, the lightweight certificate file including a file header and a file body; writing an identifier of the public key data in the digital certificate to be stored into the file header, the identifier including a public key file mark and a public key offset of the public key in the digital certificate; writing the data before and after the public key data in the digital certificate to be stored into the file body, and storing the lightweight certificate file of the written data. Therefore, by adopting the embodiment of the present application, the storage cost can be reduced, while expanding the functional extension and application scope of the device.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a digital certificate processing method and device for quantum-resistant cryptographic algorithms. Background Art

[0002] Security authentication devices are widely used in finance, government affairs, the Internet of Things, and other fields. These devices are used to perform highly secure identity authentication. Their core features include physical isolation, cryptographic computing capabilities, and attack resistance. These security capabilities rely on the physical security characteristics of security chips.

[0003] In related technologies, security authentication devices typically store complete public and private key data when storing certificates. However, with the introduction of quantum-resistant cryptographic algorithms, the length of public keys and signatures in certificates has increased significantly, leading to an increase in the size of certificate files. For example, an X.509 certificate embedded with a Dilithium5 public key and signature can reach 8KB, while traditional ECC certificates are typically only around 1KB. This not only increases storage costs but also limits the functionality and application scope of the device. Summary of the Invention

[0004] The embodiments of this application provide a method and apparatus for processing digital certificates for quantum-resistant cryptographic algorithms. To provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is provided below. This summary is not intended to be a comprehensive review, identify key or important elements, or delineate the scope of protection for these embodiments. Its sole purpose is to present some concepts in a simplified form, serving as a prelude to the detailed description that follows.

[0005] In a first aspect, an embodiment of the present application provides a digital certificate processing method for a quantum-resistant cryptographic algorithm, which is applied to a security authentication device. The method includes:

[0006] Receive the digital certificate to be stored sent by the host computer, where the digital certificate to be stored is generated based on a quantum-resistant cryptographic algorithm;

[0007] Create a lightweight certificate file for excluding public key data, the lightweight certificate file includes a file header and a file body;

[0008] The identifier of the public key data in the digital certificate to be stored is written into the file header, the identifier including the public key file mark and the public key offset of the public key in the digital certificate, and the data before and after the public key data in the digital certificate to be stored are written into the file body to store a lightweight certificate file that stores the written data.

[0009] Optionally, write the identifier of the public key data in the digital certificate to be stored into the file header, including:

[0010] Retrieving a public key file tag associated with the digital certificate to be stored from the internal memory;

[0011] Determine the starting and ending positions of the public key data in the digital certificate to be stored. The starting and ending positions include the public key offset, which is the starting byte position of the public key data starting from 0;

[0012] Write the file type, public key file tag, and public key offset of the lightweight certificate file into the file header.

[0013] Optionally, the following steps are performed to determine data before and after the public key data in the digital certificate to be stored, including:

[0014] Determine the public key length of the public key data according to the start and end positions;

[0015] Obtain all bytes of data preceding the public key offset in the digital certificate to be stored as data preceding the public key data in the digital certificate to be stored;

[0016] Add the public key offset and the public key length to get the target position;

[0017] The data of the byte at the target position and the data of all bytes after the target position are used as the data after the public key data in the digital certificate to be stored.

[0018] Optionally, determining the start and end locations of the public key data in the digital certificate to be stored includes:

[0019] Obtain the certificate format of the digital certificate to be stored;

[0020] Based on the certificate format, parse the digital certificate to be stored and obtain the certificate data structure;

[0021] According to the certificate data structure, analyze the starting and ending positions of the public key data.

[0022] Optionally, determining the start and end locations of the public key data in the digital certificate to be stored includes:

[0023] Reading a public key data byte string associated with the digital certificate to be stored from the internal memory based on a public key file tag associated with the digital certificate to be stored;

[0024] In the digital certificate to be stored, search from front to back for a string that is identical to the byte string of the public key data;

[0025] If a string identical to the public key data byte string is found, the position of the first byte of the string identical to the public key data byte string is used as the public key offset;

[0026] Based on the public key offset, the starting and ending positions of the public key data in the digital certificate to be stored are determined.

[0027] Optionally, the method further includes:

[0028] In response to a digital certificate reading instruction sent by the host computer, determining whether the digital certificate reading instruction instructs the security authentication device to restore the digital certificate;

[0029] If not, directly return the pre-stored digital certificate;

[0030] If yes, read the first file header of the pre-stored digital certificate;

[0031] When the file type in the first file header indicates that the pre-stored digital certificate is a file type of a lightweight certificate file, obtaining the first public key file mark in the first file header;

[0032] Reading the first public key data stored internally according to the first public key file mark;

[0033] Extracting a first public key offset in a first file header and a first file body of a pre-stored digital certificate;

[0034] In the first file body, determining the location of the first public key offset;

[0035] Output all bytes of data before the first public key offset in the first file body;

[0036] Outputting first public key data;

[0037] Output the data of the bytes at the position of the first public key offset in the first file body and the data of all bytes after the position of the first public key offset.

[0038] Optionally, the method further includes:

[0039] In a case where the file type in the first file header indicates that the pre-stored digital certificate is not a file type of a lightweight certificate file, the pre-stored digital certificate is returned.

[0040] In a second aspect, an embodiment of the present application provides a digital certificate processing method for a quantum-resistant cryptographic algorithm, which is applied to a host computer and includes:

[0041] Based on the model or function of the security authentication device, determine whether the security authentication device supports the digital certificate restoration function;

[0042] If yes, generate a digital certificate reading instruction instructing the security authentication device to restore the digital certificate, and send the instruction to the security authentication device to obtain the restored digital certificate from the security authentication device;

[0043] If not, obtaining a pre-stored digital certificate from a security authentication device;

[0044] Read the second file header of the pre-stored digital certificate;

[0045] When the file type in the second file header indicates that the pre-stored digital certificate is a file type of a lightweight certificate file, obtaining a second public key file mark in the second file header;

[0046] Read the second public key data stored in the security authentication device according to the second public key file mark;

[0047] Extracting a second public key offset in the second file header and a second file body of the pre-stored digital certificate; the second file body includes data before the public key data and data after the public key data;

[0048] The second public key data is inserted into the position of the second public key offset of the second file body to obtain a digital certificate containing the public key data.

[0049] In a third aspect, a digital certificate processing device for a quantum-resistant cryptographic algorithm is provided, the device comprising:

[0050] A receiving module is used to receive a digital certificate to be stored sent by a host computer, where the digital certificate to be stored is generated based on a quantum-resistant cryptographic algorithm;

[0051] An establishment module is used to establish a lightweight certificate file for excluding public key data, and the lightweight certificate file includes a file header and a file body;

[0052] A writing module is used to write the identifier of the public key data in the digital certificate to be stored into the file header, the identifier including the public key file mark and the public key offset of the public key in the digital certificate, and to write the data before and after the public key data in the digital certificate to be stored into the file body, and store the lightweight certificate file of the written data.

[0053] In a third aspect, a digital certificate processing device for a quantum-resistant cryptographic algorithm is provided, the device comprising:

[0054] A judgment module, used to judge whether the security authentication device supports the digital certificate restoration function based on the model or function of the security authentication device;

[0055] The generating module is configured to generate a digital certificate reading instruction for instructing the security authentication device to restore the digital certificate if the instruction is yes, and send the instruction to the security authentication device to obtain the restored digital certificate from the security authentication device;

[0056] If not, the first acquisition module is used to obtain a pre-stored digital certificate from a security authentication device;

[0057] A first reading module is used to read a second file header of a pre-stored digital certificate;

[0058] A second obtaining module is configured to obtain a second public key file mark in the second file header when the file type in the second file header indicates that the pre-stored digital certificate is a file type of a lightweight certificate file;

[0059] A second reading module is used to read the second public key data stored in the security authentication device according to the second public key file mark;

[0060] An extraction module, configured to extract a second public key offset in the second file header and a second file body of the pre-stored digital certificate; the second file body including data before and after the public key data;

[0061] The inserting module is used to insert the second public key data into the position of the second public key offset of the second file body to obtain a digital certificate containing the public key data.

[0062] In a fifth aspect, an embodiment of the present application provides a computer storage medium, which stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.

[0063] In a sixth aspect, an embodiment of the present application provides an electronic device, which may include: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the above-mentioned method steps.

[0064] The technical solutions provided by the embodiments of the present application may have the following beneficial effects:

[0065] In an embodiment of the present application, on the one hand, the amount of public key data in a digital certificate generated based on a quantum-resistant cryptographic algorithm is large. By establishing a lightweight certificate file for excluding public key data, the present application can write the public key offset of the public key data in the digital certificate to be stored and the data before and after the public key data into the file body, so that the digital certificate only records the location of the public key data in the digital certificate to be stored and non-public key information without storing the public key data. Therefore, the large amount of public key data is excluded, which significantly reduces the size of the certificate file, thereby reducing storage costs and expanding the functional expansion and application range of the device. On the other hand, when restoring the data of a pre-stored digital certificate, since there is no need to parse the entire certificate file, the amount of calculation is reduced, which is suitable for resource-constrained devices.

[0066] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0068] Figure 1 This is a flow chart of a method for processing digital certificates for quantum-resistant cryptographic algorithms provided in an embodiment of the present application;

[0069] Figure 2 This is a schematic diagram comparing the file bodies of an original digital certificate and a lightweight certificate file provided by this application;

[0070] Figure 3 This is a flow chart of another method for processing digital certificates for quantum-resistant cryptographic algorithms provided in an embodiment of the present application;

[0071] Figure 4 This is a structural diagram of a digital certificate processing device for a quantum-resistant cryptographic algorithm provided in an embodiment of the present application;

[0072] Figure 5 This is a schematic structural diagram of another digital certificate processing device for quantum-resistant cryptographic algorithms provided in an embodiment of the present application;

[0073] Figure 6 This is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0074] The following description and the drawings sufficiently illustrate specific embodiments of the application to enable those skilled in the art to practice them.

[0075] It should be clear that the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0076] When the following description refers to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are merely examples of systems and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0077] In the description of this application, it should be understood that the terms "first", "second", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood according to specific circumstances. In addition, in the description of this application, unless otherwise specified, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship.

[0078] Currently, when storing certificates, security authentication devices usually need to store complete public and private key data.

[0079] The applicants of this application have noted that with the introduction of quantum-resistant cryptographic algorithms, the length of certificate public keys and signatures has increased significantly, leading to an increase in certificate file size. For example, an X.509 certificate embedded with a Dilithium5 public key and signature can reach 8KB in size, while traditional ECC certificates are typically only around 1KB. This not only increases storage costs but also limits the functionality and application scope of devices.

[0080] In order to solve the above problems, the applicant of this application has found that, on the one hand, by establishing a lightweight certificate file for excluding public key data, the public key offset of the public key data in the digital certificate to be stored and the data before and after the public key data can be written into the file body, so that the digital certificate only records the location of the public key data in the digital certificate to be stored and non-public key information without storing the public key data. Therefore, the large amount of public key data is excluded, the size of the certificate file is significantly reduced, thereby reducing storage costs and expanding the functional expansion and application range of the device. On the other hand, when restoring the data of the pre-stored digital certificate, since there is no need to parse the entire certificate file, the amount of calculation is reduced, which is suitable for resource-constrained devices.

[0081] This application provides a method and apparatus for processing digital certificates for quantum-resistant cryptographic algorithms to address the aforementioned related technical issues. The following detailed description of the method for processing digital certificates for quantum-resistant cryptographic algorithms provided by embodiments of this application is presented in conjunction with the accompanying drawings. This method can be implemented as a computer program and run on a digital certificate processing apparatus for quantum-resistant cryptographic algorithms based on the von Neumann architecture. This computer program can be integrated into an application or run as a standalone tool application.

[0082] See Figure 1 , provides a flow chart of a digital certificate processing method for a quantum-resistant cryptographic algorithm for an embodiment of the present application, which is applied to a security authentication device. Figure 1As shown, the method of the embodiment of the present application may include the following steps:

[0083] S101, receiving a digital certificate to be stored sent by a host computer, where the digital certificate to be stored is generated based on a quantum-resistant cryptographic algorithm;

[0084] The host computer is a computer system used for management and monitoring in an automated control system. The digital certificate to be stored is a digital certificate that needs to be stored by a secure authentication device. A digital certificate is an electronic document issued by a trusted third-party organization (such as a certificate authority (CA)) that verifies the identity of the certificate holder and contains public key information. Post-quantum cryptography (PQC) algorithms are cryptographic algorithms that remain secure even after the advent of quantum computers.

[0085] In some embodiments of the present application, a security authentication device (such as a smart card or USB key) initializes a communication connection with a host computer (such as a personal computer or server), and the host computer sends a digital certificate generated based on a quantum-resistant cryptographic algorithm to the security authentication device, and the security authentication device receives the digital certificate to be stored sent by the host computer.

[0086] S102, creating a lightweight certificate file for excluding public key data, the lightweight certificate file including a file header and a file body;

[0087] Among them, the lightweight certificate file is an optimized certificate file format, the purpose of which is to reduce the storage space requirement.

[0088] Taking the X.509 certificate as an example, its data structure is briefly summarized as follows:

[0089] a) Version number: identifies the certificate version (v1 / v2 / v3).

[0090] b) Serial number: An integer that uniquely identifies the certificate.

[0091] c) Signature algorithm: The algorithm used by the CA signature (such as SHA256-RSA).

[0092] d) Issuer: CA’s Distinguished Name (DN).

[0093] e) Validity period: start and end time.

[0094] f) Subject: DN of the certificate holder.

[0095] g) Subject public key information (SubjectPublicKeyInfo):

[0096] 1. Algorithm identifier: public key algorithm (such as RSA, ECC).

[0097] 2. Public key data: DER-encoded public key bit string (such as RSA modulus and exponent).

[0098] h) Extensions: such as key usage, subject alternative names, etc.

[0099] i) Signature: CA’s hash signature of the certificate content.

[0100] Taking the PGP certificate (OpenPGP) as an example, its data structure is briefly summarized as follows:

[0101] a) Public-Key Packet:

[0102] 1. Version number (v4 is the mainstream).

[0103] 2. Algorithm identifier (such as RSA=1, ECDH=18).

[0104] 3. Creation time.

[0105] 4. Public key parameters (dynamically defined according to the algorithm).

[0106] b) User ID Packet: The identity of the holder (such as an email address).

[0107] c) Signature Packet: self-signed or signed by another entity, binding the user ID and public key.

[0108] d) Subkey package (optional): additional encryption subkeys.

[0109] It can be seen that a digital certificate must contain the public key data corresponding to the certificate. The location of the public key in a digital certificate is not fixed and is related to the certificate format and the length of other information in the certificate.

[0110] Therefore, the lightweight certificate file established in this application for excluding public key data includes a file header and a file body.

[0111] The file header includes:

[0112] File type: Declare whether the file uses the lightweight storage solution of this application;

[0113] Public key identifier: declares the ID / identifier / index / file name of the public key file (or the key file containing the public key) stored in the device corresponding to the certificate;

[0114] Public key offset: declares the position of the first byte of the public key data in the entire certificate (offset byte number, starting from 0).

[0115] The file body includes the certificate file data after deleting the public key data, that is, the result obtained after deleting the public key data from the complete certificate. For example, the comparison between the file body of the original digital certificate and the lightweight certificate file is shown in the figure below. Figure 2 shown.

[0116] The data structure of the lightweight certificate file is shown in Table 1.

[0117] Table 1

[0118]

[0119] Among them, type 01 indicates that the file uses a lightweight storage solution, public key file ID 0002 represents the public key corresponding to the certificate, and the key file ID in the device is 0002; public key offset 0220 indicates that the offset position of the first byte of the public key data in the complete certificate is 0x0220 (544 in decimal).

[0120] In some embodiments of the present application, the process of establishing a lightweight certificate file for excluding public key data includes: first obtaining the data structure of the lightweight certificate file, then establishing a file header and file body based on the data structure, and finally combining the file header and file body to obtain a lightweight certificate file for excluding public key data.

[0121] S103, write the identifier of the public key data in the digital certificate to be stored into the file header, the identifier includes the public key file mark and the public key offset of the public key in the digital certificate, and write the data before and after the public key data in the digital certificate to be stored into the file body, and store the lightweight certificate file of the written data.

[0122] In some embodiments of the present application, the specific process of writing the identifier of the public key data in the digital certificate to be stored into the file header includes: retrieving the public key file mark related to the digital certificate to be stored from the internal memory; determining the starting and ending positions of the public key data in the digital certificate to be stored, the starting and ending positions include the public key offset, and the public key offset is the starting byte position of the public key data starting from 0; using the public key file mark and public key offset as identifiers of the public key data; and writing the file type and identifier of the lightweight certificate file into the file header.

[0123] The internal memory may be a storage area of ​​a security chip in the security authentication device, or may be a flash storage independently provided in the security authentication device.

[0124] In some embodiments of the present application, the following steps are followed to determine the data before and after the public key data in the digital certificate to be stored, including: determining the public key length of the public key data based on the start and end positions; obtaining data of all bytes before the public key offset in the digital certificate to be stored as the data before the public key data in the digital certificate to be stored; adding the public key offset and the public key length to obtain the target position; and using the data of the bytes at the target position and all bytes after the target position as the data after the public key data in the digital certificate to be stored.

[0125] Specifically, the process of determining the start and end locations of the public key data in the digital certificate to be stored includes: obtaining the certificate format of the digital certificate to be stored; parsing the digital certificate to be stored based on the certificate format to obtain the certificate data structure; and analyzing the start and end locations of the public key data based on the certificate data structure. This method requires the device to have the ability and resources to parse the certificate data structure.

[0126] Specifically, the process of determining the start and end positions of the public key data in the digital certificate to be stored includes: reading the public key data byte string associated with the digital certificate to be stored from the internal memory based on the public key file tag associated with the digital certificate to be stored; searching the digital certificate to be stored for a string identical to the public key data byte string in a forward-to-backward search manner; if a string identical to the public key data byte string is found, the position of the first byte of the string identical to the public key data byte string is used as the public key offset; and determining the start and end positions of the public key data in the digital certificate to be stored based on the public key offset. This method does not require the device to have the ability to parse the certificate data structure and is therefore more suitable for resource-constrained devices.

[0127] Furthermore, when the upper computer reads the certificate from the security authentication device, the security authentication device restores and outputs the complete certificate. This method specifically includes: responding to the digital certificate reading instruction sent by the upper computer, determining whether the digital certificate reading instruction instructs the security authentication device to restore the digital certificate; if not, directly returning the pre-stored digital certificate; if yes, reading the first file header of the pre-stored digital certificate; when the file type in the first file header indicates that the pre-stored digital certificate is a file type of a lightweight certificate file, obtaining the first public key file mark in the first file header; according to the first public key file mark, reading the internally stored first public key data; extracting the first public key offset in the first file header and the first file body of the pre-stored digital certificate; in the first file body, determining the position of the first public key offset; outputting data of all bytes before the position of the first public key offset in the first file body; outputting the first public key data; outputting data of the bytes at the position of the first public key offset in the first file body and data of all bytes after the position of the first public key offset.

[0128] Specifically, the method further includes: returning the pre-stored digital certificate when the file type in the first file header indicates that the pre-stored digital certificate is not a file type of a lightweight certificate file.

[0129] In an embodiment of the present application, on the one hand, the amount of public key data in a digital certificate generated based on a quantum-resistant cryptographic algorithm is large. By establishing a lightweight certificate file for excluding public key data, the present application can write the public key offset of the public key data in the digital certificate to be stored and the data before and after the public key data into the file body, so that the digital certificate only records the location of the public key data in the digital certificate to be stored and non-public key information without storing the public key data. Therefore, the large amount of public key data is excluded, which significantly reduces the size of the certificate file, thereby reducing storage costs and expanding the functional expansion and application range of the device. On the other hand, when restoring the data of a pre-stored digital certificate, since there is no need to parse the entire certificate file, the amount of calculation is reduced, which is suitable for resource-constrained devices.

[0130] See Figure 3 , provides a flow chart of a digital certificate processing method for a quantum-resistant cryptographic algorithm for an embodiment of the present application, which is applied to a host computer. Figure 3 As shown, the method of the embodiment of the present application may include the following steps:

[0131] S201, based on the model or function of the security authentication device, determining whether the security authentication device supports a digital certificate restoration function; if so, generating a digital certificate read instruction instructing the security authentication device to restore the digital certificate, and sending the instruction to the security authentication device to obtain the restored digital certificate from the security authentication device; if not, obtaining a pre-stored digital certificate from the security authentication device;

[0132] S202, reading a second file header of a pre-stored digital certificate;

[0133] S203: When the file type in the second file header indicates that the pre-stored digital certificate is a file type of a lightweight certificate file, obtain a second public key file mark in the second file header;

[0134] S204, reading the second public key data stored in the security authentication device according to the second public key file mark;

[0135] S205, extracting the second public key offset in the second file header and the second file body of the pre-stored digital certificate; the second file body includes data before the public key data and data after the public key data;

[0136] S206: Insert the second public key data into the second public key offset position of the second file body to obtain a digital certificate containing the public key data.

[0137] In an embodiment of the present application, on the one hand, the amount of public key data in a digital certificate generated based on a quantum-resistant cryptographic algorithm is large. By establishing a lightweight certificate file for excluding public key data, the present application can write the public key offset of the public key data in the digital certificate to be stored and the data before and after the public key data into the file body, so that the digital certificate only records the location of the public key data in the digital certificate to be stored and non-public key information without storing the public key data. Therefore, the large amount of public key data is excluded, which significantly reduces the size of the certificate file, thereby reducing storage costs and expanding the functional expansion and application range of the device. On the other hand, when restoring the data of a pre-stored digital certificate, since there is no need to parse the entire certificate file, the amount of calculation is reduced, which is suitable for resource-constrained devices.

[0138] The following are device embodiments of the present application, which can be used to implement the method embodiments of the present application. For details not disclosed in the device embodiments of the present application, please refer to the method embodiments of the present application.

[0139] See Figure 4 , which shows a schematic diagram of the structure of a digital certificate processing device for quantum-resistant cryptographic algorithms, provided by an exemplary embodiment of the present application. This digital certificate processing device for quantum-resistant cryptographic algorithms can be implemented as all or part of an electronic device through software, hardware, or a combination of both. The device 1 includes a receiving module 10, a creation module 20, and a writing module 30.

[0140] The receiving module 10 is used to receive the digital certificate to be stored sent by the host computer, where the digital certificate to be stored is generated based on a quantum-resistant cryptographic algorithm;

[0141] An establishing module 20 is used to establish a lightweight certificate file for excluding public key data, the lightweight certificate file including a file header and a file body;

[0142] The writing module 30 is used to write the identifier of the public key data in the digital certificate to be stored into the file header, the identifier includes the public key file mark and the public key offset of the public key in the digital certificate, and write the data before and after the public key data in the digital certificate to be stored into the file body, and store the lightweight certificate file of the written data.

[0143] It should be noted that the digital certificate processing device for a quantum-resistant cryptographic algorithm provided in the above-mentioned embodiment, when executing the digital certificate processing method for a quantum-resistant cryptographic algorithm, is merely illustrated by the division of the aforementioned functional modules. In actual applications, the aforementioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. Furthermore, the digital certificate processing device for a quantum-resistant cryptographic algorithm provided in the above-mentioned embodiment and the digital certificate processing method for a quantum-resistant cryptographic algorithm are based on the same concept. The implementation process is detailed in the method embodiment and will not be repeated here.

[0144] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0145] In an embodiment of the present application, on the one hand, the amount of public key data in a digital certificate generated based on a quantum-resistant cryptographic algorithm is large. By establishing a lightweight certificate file for excluding public key data, the present application can write the public key offset of the public key data in the digital certificate to be stored and the data before and after the public key data into the file body, so that the digital certificate only records the location of the public key data in the digital certificate to be stored and non-public key information without storing the public key data. Therefore, the large amount of public key data is excluded, which significantly reduces the size of the certificate file, thereby reducing storage costs and expanding the functional expansion and application range of the device. On the other hand, when restoring the data of a pre-stored digital certificate, since there is no need to parse the entire certificate file, the amount of calculation is reduced, which is suitable for resource-constrained devices.

[0146] See Figure 5 , which shows a schematic diagram of the structure of a digital certificate processing device for quantum-resistant cryptographic algorithms, provided by an exemplary embodiment of the present application. This digital certificate processing device for quantum-resistant cryptographic algorithms can be implemented as all or part of an electronic device through software, hardware, or a combination of both. The device 2 includes a determination module 40, a generation module 50, a first acquisition module 60, a first reading module 70, a second acquisition module 80, a second reading module 90, an extraction module 100, and an insertion module 110.

[0147] A determination module 40 is configured to determine whether the security authentication device supports a digital certificate restoration function based on the model or function of the security authentication device;

[0148] If yes, the generating module 50 is used to generate a digital certificate reading instruction instructing the security authentication device to restore the digital certificate, and send the instruction to the security authentication device to obtain the restored digital certificate from the security authentication device;

[0149] If not, the first acquisition module 60 is used to obtain a pre-stored digital certificate from a security authentication device;

[0150] A first reading module 70 is configured to read a second file header of a pre-stored digital certificate;

[0151] A second obtaining module 80 is configured to obtain a second public key file marker in the second file header when the file type in the second file header indicates that the pre-stored digital certificate is a file type of a lightweight certificate file;

[0152] A second reading module 90 is configured to read the second public key data stored in the security authentication device according to the second public key file tag;

[0153] An extraction module 100 is configured to extract a second public key offset in a second file header and a second file body of a pre-stored digital certificate; the second file body includes data before and after the public key data;

[0154] The inserting module 110 is configured to insert the second public key data into the second public key offset position of the second file body to obtain a digital certificate containing the public key data.

[0155] It should be noted that the digital certificate processing device for a quantum-resistant cryptographic algorithm provided in the above-mentioned embodiment, when executing the digital certificate processing method for a quantum-resistant cryptographic algorithm, is merely illustrated by the division of the aforementioned functional modules. In actual applications, the aforementioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. Furthermore, the digital certificate processing device for a quantum-resistant cryptographic algorithm provided in the above-mentioned embodiment and the digital certificate processing method for a quantum-resistant cryptographic algorithm are based on the same concept. The implementation process is detailed in the method embodiment and will not be repeated here.

[0156] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0157] In an embodiment of the present application, on the one hand, the amount of public key data in a digital certificate generated based on a quantum-resistant cryptographic algorithm is large. By establishing a lightweight certificate file for excluding public key data, the present application can write the public key offset of the public key data in the digital certificate to be stored and the data before and after the public key data into the file body, so that the digital certificate only records the location of the public key data in the digital certificate to be stored and non-public key information without storing the public key data. Therefore, the large amount of public key data is excluded, which significantly reduces the size of the certificate file, thereby reducing storage costs and expanding the functional expansion and application range of the device. On the other hand, when restoring the data of a pre-stored digital certificate, since there is no need to parse the entire certificate file, the amount of calculation is reduced, which is suitable for resource-constrained devices.

[0158] The present application also provides a computer-readable medium having program instructions stored thereon, which, when executed by a processor, implement the digital certificate processing method for quantum-resistant cryptographic algorithms provided by the above-mentioned various method embodiments.

[0159] The present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the digital certificate processing method for a quantum-resistant cryptographic algorithm of each of the above-mentioned method embodiments.

[0160] See Figure 6 , is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 6 As shown, the electronic device 1000 may include: at least one processor 1001 , at least one network interface 1004 , a user interface 1003 , a memory 1005 , and at least one communication bus 1002 .

[0161] The communication bus 1002 is used to implement the connection and communication between these components.

[0162] The user interface 1003 may include a display screen (Display) and a camera (Camera). Optionally, the user interface 1003 may also include a standard wired interface and a wireless interface.

[0163] The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0164] The processor 1001 may include one or more processing cores. The processor 1001 utilizes various interfaces and circuits to connect various components within the electronic device 1000. It executes instructions, programs, code sets, or instruction sets stored in the memory 1005, and accesses data stored in the memory 1005 to perform various functions and process data within the electronic device 1000. Optionally, the processor 1001 may be implemented in hardware using at least one of a digital signal processing (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The processor 1001 may integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. The CPU primarily processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing content displayed on the display; and the modem handles wireless communications. It is understood that the modem may also be implemented independently of the processor 1001 and implemented on a separate chip.

[0165] Among them, the memory 1005 may include a random access memory (RAM) or a read-only memory (Read-Only Memory). Optionally, the memory 1005 includes a non-transitory computer-readable storage medium. The memory 1005 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 1005 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 1005 may also be optionally at least one storage system located away from the aforementioned processor 1001. As Figure 6 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a digital certificate processing application for a quantum-resistant cryptographic algorithm.

[0166] exist Figure 6In the electronic device 1000 shown, the user interface 1003 is mainly used to provide an input interface for the user and obtain user input data; and the processor 1001 can be used to call the digital certificate processing application for the quantum-resistant cryptography algorithm stored in the memory 1005 and specifically perform the following operations:

[0167] Receive the digital certificate to be stored sent by the host computer, where the digital certificate to be stored is generated based on a quantum-resistant cryptographic algorithm;

[0168] Create a lightweight certificate file for excluding public key data, the lightweight certificate file includes a file header and a file body;

[0169] The identifier of the public key data in the digital certificate to be stored is written into the file header, the identifier including the public key file mark and the public key offset of the public key in the digital certificate, and the data before and after the public key data in the digital certificate to be stored are written into the file body to store a lightweight certificate file that stores the written data.

[0170] In one embodiment, when executing the step of writing the identifier of the public key data in the digital certificate to be stored into the file header, the processor 1001 specifically performs the following operations:

[0171] Retrieving a public key file tag associated with the digital certificate to be stored from the internal memory;

[0172] Determine the starting and ending positions of the public key data in the digital certificate to be stored. The starting and ending positions include the public key offset, which is the starting byte position of the public key data starting from 0;

[0173] Using the public key file tag and the public key offset as identifiers of the public key data;

[0174] Write the file type and identifier of the lightweight certificate file into the file header.

[0175] In one embodiment, when determining the data before and after the public key data in the digital certificate to be stored, the processor 1001 specifically performs the following operations:

[0176] Determine the public key length of the public key data according to the start and end positions;

[0177] Obtain all bytes of data preceding the public key offset in the digital certificate to be stored as data preceding the public key data in the digital certificate to be stored;

[0178] Add the public key offset and the public key length to get the target position;

[0179] The data of the byte at the target position and the data of all bytes after the target position are used as the data after the public key data in the digital certificate to be stored.

[0180] In one embodiment, when determining the start and end positions of the public key data in the digital certificate to be stored, the processor 1001 specifically performs the following operations:

[0181] Obtain the certificate format of the digital certificate to be stored;

[0182] Based on the certificate format, parse the digital certificate to be stored and obtain the certificate data structure;

[0183] According to the certificate data structure, analyze the starting and ending positions of the public key data.

[0184] In one embodiment, when determining the start and end positions of the public key data in the digital certificate to be stored, the processor 1001 specifically performs the following operations:

[0185] Reading a public key data byte string associated with the digital certificate to be stored from the internal memory based on a public key file tag associated with the digital certificate to be stored;

[0186] In the digital certificate to be stored, search from front to back for a string that is identical to the byte string of the public key data;

[0187] If a string identical to the public key data byte string is found, the position of the first byte of the string identical to the public key data byte string is used as the public key offset;

[0188] Based on the public key offset, the starting and ending positions of the public key data in the digital certificate to be stored are determined.

[0189] In one embodiment, the processor 1001 further performs the following operations:

[0190] In response to a digital certificate reading instruction sent by the host computer, determining whether the digital certificate reading instruction instructs the security authentication device to restore the digital certificate;

[0191] If not, directly return the pre-stored digital certificate;

[0192] If yes, read the first file header of the pre-stored digital certificate;

[0193] When the file type in the first file header indicates that the pre-stored digital certificate is a file type of a lightweight certificate file, obtaining the first public key file mark in the first file header;

[0194] Reading the first public key data stored internally according to the first public key file mark;

[0195] Extracting a first public key offset in a first file header and a first file body of a pre-stored digital certificate;

[0196] In the first file body, determining the location of the first public key offset;

[0197] Output all bytes of data before the first public key offset in the first file body;

[0198] Outputting first public key data;

[0199] Output the data of the bytes at the position of the first public key offset in the first file body and the data of all bytes after the position of the first public key offset.

[0200] In one embodiment, the processor 1001 further performs the following operations:

[0201] In a case where the file type in the first file header indicates that the pre-stored digital certificate is not a file type of a lightweight certificate file, the pre-stored digital certificate is returned.

[0202] In an embodiment of the present application, on the one hand, the amount of public key data in a digital certificate generated based on a quantum-resistant cryptographic algorithm is large. By establishing a lightweight certificate file for excluding public key data, the present application can write the public key offset of the public key data in the digital certificate to be stored and the data before and after the public key data into the file body, so that the digital certificate only records the location of the public key data in the digital certificate to be stored and non-public key information without storing the public key data. Therefore, the large amount of public key data is excluded, which significantly reduces the size of the certificate file, thereby reducing storage costs and expanding the functional expansion and application range of the device. On the other hand, when restoring the data of a pre-stored digital certificate, since there is no need to parse the entire certificate file, the amount of calculation is reduced, which is suitable for resource-constrained devices.

[0203] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The program for processing digital certificates for quantum-resistant cryptographic algorithms can be stored in a computer-readable storage medium. When executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory, or a random access memory.

[0204] The above disclosure is only a preferred embodiment of the present application, and certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A digital certificate processing method for quantum-resistant cryptographic algorithms, characterized in that: Applied to a security authentication device, the method includes: Receiving a digital certificate to be stored sent by a host computer, where the digital certificate to be stored is generated based on a quantum-resistant cryptographic algorithm; Creating a lightweight certificate file for excluding public key data, wherein the lightweight certificate file includes a file header and a file body; The identifier of the public key data in the digital certificate to be stored is written into the file header, wherein the identifier includes the public key file mark and the public key offset of the public key in the digital certificate, and the data before and after the public key data in the digital certificate to be stored are written into the file body to store a lightweight certificate file storing the written data.

2. The method according to claim 1, characterized in that The step of writing the identifier of the public key data in the digital certificate to be stored into the file header includes: Retrieving a public key file tag associated with the digital certificate to be stored from the internal memory; Determine the starting and ending positions of the public key data in the digital certificate to be stored, where the starting and ending positions include a public key offset, which is the starting byte position of the public key data starting from 0; Using the public key file tag and the public key offset as identifiers of public key data; The file type of the lightweight certificate file and the identifier are written into the file header.

3. The method according to claim 2, characterized in that The steps of determining data before the public key data and data after the public key data in the digital certificate to be stored include: Determining a public key length of the public key data according to the start and end positions; Obtaining all bytes of data preceding the public key offset in the digital certificate to be stored as data preceding the public key data in the digital certificate to be stored; Add the public key offset and the public key length to obtain the target position; The data of the byte at the target position and the data of all bytes after the target position are used as the data after the public key data in the digital certificate to be stored.

4. The method according to claim 2, characterized in that Determining the starting and ending positions of the public key data in the digital certificate to be stored includes: Obtaining the certificate format of the digital certificate to be stored; Parsing the digital certificate to be stored based on the certificate format to obtain a certificate data structure; The starting and ending positions of the public key data are analyzed according to the certificate data structure.

5. The method according to claim 2, characterized in that Determining the starting and ending positions of the public key data in the digital certificate to be stored includes: Reading a public key data byte string associated with the digital certificate to be stored from the internal memory based on a public key file tag associated with the digital certificate to be stored; Searching the digital certificate to be stored from front to back for a character string that is identical to the byte string of the public key data; When a character string identical to the public key data byte string is found, the position of the first byte of the character string identical to the public key data byte string is used as the public key offset; Based on the public key offset, the starting and ending positions of the public key data in the digital certificate to be stored are determined.

6. The method according to claim 1, characterized in that The method further comprises: In response to a digital certificate reading instruction sent by the host computer, determining whether the digital certificate reading instruction instructs the security authentication device to restore the digital certificate; If not, directly return the pre-stored digital certificate; If yes, read the first file header of the pre-stored digital certificate; When the file type in the first file header indicates that the pre-stored digital certificate is a file type of a lightweight certificate file, obtaining a first public key file mark in the first file header; Reading the first public key data stored internally according to the first public key file mark; Extracting a first public key offset in the first file header and a first file body of the pre-stored digital certificate; Determining the position of the first public key offset in the first file body; Output all bytes of data preceding the position of the first public key offset in the first file body; outputting the first public key data; Output the data of the bytes at the position of the first public key offset in the first file body and the data of all bytes after the position of the first public key offset.

7. The method according to claim 6, characterized in that The method further comprises: When the file type in the first file header indicates that the pre-stored digital certificate is not a file type of a lightweight certificate file, the pre-stored digital certificate is returned.

8. A digital certificate processing method for quantum-resistant cryptographic algorithms, characterized in that: Applied to a host computer, the method includes: Based on the model or function of the security authentication device, determine whether the security authentication device supports the digital certificate restoration function; If yes, generating a digital certificate reading instruction instructing the security authentication device to restore the digital certificate, and sending the instruction to the security authentication device to obtain the restored digital certificate from the security authentication device; If not, obtaining a pre-stored digital certificate from the security authentication device; Read the second file header of the pre-stored digital certificate; When the file type in the second file header indicates that the pre-stored digital certificate is a file type of a lightweight certificate file, obtaining a second public key file mark in the second file header; Reading the second public key data stored in the security authentication device according to the second public key file mark; Extracting a second public key offset in the second file header and a second file body of the pre-stored digital certificate; the second file body includes data before the public key data and data after the public key data; Insert the second public key data into the position of the second public key offset of the second file body to obtain a digital certificate containing the public key data.

9. A digital certificate processing device for quantum-resistant cryptographic algorithms, characterized in that: The device comprises: A receiving module is used to receive a digital certificate to be stored sent by a host computer, where the digital certificate to be stored is generated based on a quantum-resistant cryptographic algorithm; An establishing module, configured to establish a lightweight certificate file for excluding public key data, wherein the lightweight certificate file includes a file header and a file body; A writing module is used to write the identifier of the public key data in the digital certificate to be stored into the file header, wherein the identifier includes the public key file mark and the public key offset of the public key in the digital certificate, and write the data before and after the public key data in the digital certificate to be stored into the file body, and store a lightweight certificate file of the written data.

10. A digital certificate processing device for quantum-resistant cryptographic algorithms, characterized in that: The device comprises: A judgment module, used to judge whether the security authentication device supports the digital certificate restoration function based on the model or function of the security authentication device; a generating module, if yes, for generating a digital certificate reading instruction for instructing the security authentication device to restore the digital certificate, and sending the instruction to the security authentication device to obtain the restored digital certificate from the security authentication device; If not, the first acquisition module is used to obtain a pre-stored digital certificate from the security authentication device; A first reading module is used to read a second file header of a pre-stored digital certificate; A second obtaining module is configured to obtain a second public key file mark in the second file header when the file type in the second file header indicates that the pre-stored digital certificate is a file type of a lightweight certificate file; A second reading module is used to read the second public key data stored in the security authentication device according to the second public key file mark; an extraction module, configured to extract a second public key offset from the second file header and a second file body of the pre-stored digital certificate; the second file body including data before the public key data and data after the public key data; The inserting module is used to insert the second public key data into the position of the second public key offset of the second file body to obtain a digital certificate containing the public key data.

Images