Software-defined anti-quantum tunneling communication security enhancement method and system

Abstract

The application belongs to the technical field of network communication security, and relates to a software-defined anti-quantum tunnel communication security enhancement method and system, which comprises a message processing module, a remote management module, a password module and an access control module. By introducing an anti-quantum password algorithm and modular design, an anti-quantum tunnel architecture realized by pure software is provided, quantum secure communication is realized without relying on hardware, and non-invasive deployment is supported, and multiple business scenarios are compatible. The application provides an anti-quantum tunnel architecture realized by pure software by introducing an anti-quantum password algorithm and modular design, can realize quantum secure communication without relying on hardware, supports non-invasive deployment, and is compatible with multiple business scenarios.

Description

Technical Field

[0001] The present invention belongs to the field of network communication security technology and relates to a software-defined anti-quantum tunneling communication security enhancement method and system. Background Art

[0002] With the rapid development of internet technology, network tunneling technology plays a vital role in heterogeneous network interconnection and secure transmission. Its primary purpose is to achieve protocol compatibility across diverse network architectures, enhance data transmission security, and extend network boundaries. For example, IPv6 data can be transmitted over IPv4 networks, and enterprise branches can be connected into a unified intranet via logical tunnels. Current mainstream tunneling technologies, such as IPSec, use encapsulation and encryption to establish secure communication tunnels over public networks and are widely used in scenarios such as VPNs, enterprise intranet interconnection, and cross-regional data transmission. However, these technologies rely on traditional encryption algorithms such as RSA and ECC, which are significantly vulnerable to quantum computing and can be cracked by quantum computers. Furthermore, existing quantum-resistant solutions often require specialized hardware or modifications to the underlying protocols of business systems, resulting in high deployment costs, poor compatibility, and a long implementation cycle.

[0003] At the same time, quantum-resistant cryptographic technologies, as core solutions to combat the threat of quantum computing, are primarily categorized into two main categories: quantum key distribution (QKD) and quantum-resistant cryptographic algorithms. Quantum key distribution (QKD) achieves unconditional security based on the properties of quantum physics, but relies on specialized hardware such as single-photon detectors and fiber-optic relays, resulting in high deployment costs and incompatibility with existing network architectures. Quantum-resistant cryptographic algorithms, such as the NIST-standard algorithms CRYSTALS-Kyber and Dilithium, are implemented in software or chips. However, existing solutions often require modifications to business systems or rely on hardware acceleration chips, resulting in limited flexibility. Furthermore, traditional tunneling technologies face management challenges, including a lack of remote, unified management capabilities for tunneling tools, or a lack of quantum-hardened management channels, further increasing security risks.

[0004] In practice, the headquarters and multiple branches of a distributed enterprise network architecture are often geographically dispersed. Traditional VPN deployment requires local configuration on each device, which is inefficient and makes it difficult to unify security policies. Furthermore, quantum-resistant chip hardware is expensive and has poor portability, making it difficult to scale. Software-based quantum-resistant solutions, such as PKI system transformation, require restructuring business system communication protocols, making implementation highly complex. Therefore, providing a low-cost, highly compatible, and quantum-safe tunnel communication solution without changing the existing business system architecture has become a pressing technical challenge. Summary of the Invention

[0005] In response to the problem of insufficient security of existing tunnel communication technology under the threat of quantum computing, the present invention proposes a software-defined anti-quantum tunnel communication security enhancement method and system. Through the purely software-defined anti-quantum tunnel architecture design, combined with the message processing module, remote management module, cryptographic module and access control module, full-stack software deployment is achieved, avoiding dependence on anti-quantum chips and reducing deployment costs. At the same time, the original traffic is intercepted through the virtualized network interface, the business data is transparently encapsulated, and multi-protocol transmission is supported without the need to modify the original protocol, thereby achieving non-intrusive deployment. In addition, the present invention adopts a dual-certificate hybrid authentication mechanism, superimposing quantum protection capabilities on the basis of national secret compliance, and ensuring the equal security of management instructions and data traffic through an anti-quantum reinforced remote management channel to prevent man-in-the-middle attacks under quantum computing. The lightweight traffic access control module implements refined traffic filtering through dynamic blacklist rules, improving the effective utilization of tunnels and the security of intranets.

[0006] A software-defined method for enhancing the security of quantum-resistant tunneling communications includes the following steps:

[0007] Tunnel software is deployed at both the local and remote ends, the tunnel software including a message processing module, a remote management module, a password module and an access control module;

[0008] The local tunnel software establishes a link with the remote tunnel software. The local end calls the cryptographic module to generate a key and sends it to the remote end for tunnel establishment and key negotiation. After the tunnel is established, the local and remote ends use symmetric encryption keys to encapsulate and transmit data.

[0009] The local message processing module receives the plaintext business message from the enterprise intranet, calls the cryptographic module, and encrypts the plaintext using the negotiated key. The local message processing module then sends the encrypted ciphertext business message to the remote message processing module through the tunnel.

[0010] The local message processing module receives the encrypted business message from the remote end, calls the password module to decrypt it into plain text, and sends it to the corresponding device on the enterprise intranet;

[0011] The local message processing module receives the remote management message, which is reinforced using quantum-resistant cryptography technology. After receiving it, the cryptographic module is called to decrypt it, and then the decrypted message is sent to the remote management module for processing.

[0012] Furthermore, a client is deployed on the local end, and a server is deployed on the remote end;

[0013] The tunnel establishment and key negotiation process is as follows:

[0014] S101: The client initiates a key negotiation request;

[0015] S102: After receiving the key agreement request, the server sends the server's national encryption certificate, the server's quantum-resistant certificate, the first random number, and the first signature to the client;

[0016] S103: After receiving the response, the client verifies the server's national encryption certificate, the server's quantum-resistant certificate, and the first signature; if the verification passes, the client proceeds to the next step; otherwise, the connection is terminated;

[0017] S104: The client generates a second random number and generates a client quantum-resistant key pair and a session key seed based on a quantum-resistant cryptographic algorithm; encrypts the session key seed using the public key in the server quantum-resistant certificate to obtain first encrypted information; and calculates a hash value of the first random number and the second random number based on the SM3 cryptographic algorithm to obtain first tamper-proof information.

[0018] S105: The client sends the client's national encryption certificate, the client's quantum-resistant public key, the first encrypted information, the second random number, the first tamper-proof information, and the second signature to the server;

[0019] S106: The server verifies the second signature in the client response; recovers the session key seed from the first encrypted information using the server's quantum-resistant private key; and verifies the first tamper-proof information using the SM3 cryptographic algorithm, the first random number, and the second random number.

[0020] S107: The server generates a first key for a symmetric encryption process using the recovered session key seed and the first and second random numbers; encrypts the first key using the client's quantum-resistant public key to obtain a first authentication tag; and generates second tamper-proof information based on the recovered session key seed.

[0021] S108: The server sends the first authentication tag, the second tamper-proof information, and the third signature to the client;

[0022] S109: The client verifies the third signature of the server; uses the local session key seed to verify the second tamper-proof information; the client verifies the first authentication tag of the server using the first key;

[0023] If all verifications pass, both parties now hold the same first key, indicating that the encryption channel is ready.

[0024] Furthermore, in S102, the server's national secret certificate includes the server's Public Key ;

[0025] The server-side quantum-resistant certificate contains the server-side quantum-resistant public key ;

[0026] The first signature calculation formula is as follows:

[0027] Calculate a hash value based on the first random number : ;

[0028] Generate the first signature : ;

[0029] in, represents the first random number, Represents the SM3 cryptographic algorithm; Represents a timestamp; Represents the server SM2 private key; is the string concatenation operator; Represents the signature generation function;

[0030] The signature verification process in S103 is represented as follows:

[0031] calculate , ;

[0032] pass Conduct verification;

[0033] in, is the recalculated hash value, The server SM2 public key; Represents a signature verification function.

[0034] Furthermore, S104 is specifically as follows:

[0035] The client generates a second random number , prepare for key exchange; the client generates a client quantum-resistant key pair based on the quantum-resistant cryptographic algorithm, and the client quantum-resistant key pair includes the client quantum-resistant public key and client-side quantum-resistant private keys , the generation algorithm is as follows:

[0036] Generate a random matrix: First generate a random private key seed , expanded to the public key matrix , ;

[0037] in, Represents an extension operation; Represents the dimension domain of the matrix, each element in the matrix is ​​a polynomial ring The polynomial on , is the modulus of the polynomial, Represents dimension, is a formal variable, is a modular polynomial, used to construct the algebraic structure of a polynomial ring; Representative Model The ring of integers, that is, all integers modulo The following collection;

[0038] Generate private key vector , expressed as: ;in, express dimensional error sampling distribution, represents random sampling;

[0039] Generate a public key , expressed as:

[0040] ;

[0041] ;

[0042] Where, e is the noise vector;

[0043] Obtaining a quantum-resistant public key , expressed as:

[0044] ;

[0045] Obtain client quantum-resistant private key , expressed as:

[0046] ;

[0047] Generate session key seed;

[0048] Use the public key in the server's quantum-resistant certificate to encrypt the session key seed to obtain the first encrypted information ; The encryption method is as follows:

[0049] Use server-side quantum-resistant public key , expand the server matrix ; ; The server's random private key seed, The server public key;

[0050] Generate random vectors and error 、 , expressed as:

[0051] ;

[0052] ;

[0053] ;

[0054] in, is the univariate error sampling distribution;

[0055] Calculate ciphertext components 、 ; expressed as:

[0056] , ; Represents the result after encoding as a polynomial, represents the matrix transpose, Represents the session key seed;

[0057] Compress to obtain the first encrypted information , expressed as:

[0058] ;

[0059] in, Indicates retaining the low digit of each coefficient;

[0060] based on The cryptographic algorithm calculates the hash value of the first random number and the second random number to obtain the first tamper-proof information , the calculation formula is as follows:

[0061] ;

[0062] in, express Cryptographic algorithm.

[0063] Furthermore, the second signature in S105 is generated based on the SM2 cryptographic algorithm, and the calculation formula is as follows:

[0064] ;

[0065] in, represents the second signature, Indicates based on The signature operation of the cryptographic algorithm, Represents the client's quantum-resistant public key, Represents the client's quantum-resistant private key, Indicates the SM3 cryptographic algorithm, represents the first encrypted information, represents the second random number;

[0066] S106 specifically includes: the server verifies whether the client signature is correct, and terminates the connection if the verification fails; specifically:

[0067] Verify the second signature , expressed as:

[0068] ;

[0069] in, Indicates the server's quantum-resistant private key;

[0070] After verification, the server-side quantum-resistant private key is used to recover the session key seed from the first encrypted information, which is expressed as:

[0071] Decompress the first encrypted information , expressed as:

[0072] ;

[0073] in, First encrypted information Compressed ciphertext component , First encrypted information Compressed ciphertext component , Ciphertext component The decompressed result is: Ciphertext component The result after decompression;

[0074] Use the server's quantum-resistant private key to decrypt the session key seed, expressed as:

[0075] ;

[0076] ;

[0077] in, is the coding information containing noise; is the recovered session key seed; represents the decoding function, Indicates the server's quantum-resistant private key;

[0078] Verify hash consistency, based on The cryptographic algorithm calculates the hash value of the first random number and the second random number. If the hash value is equal to the first tamper-proof information If they are inconsistent, it is considered tampering and the link is terminated; it is expressed as:

[0079] ;in, Indicates conditional judgment.

[0080] Furthermore, S107 is specifically as follows:

[0081] The server uses the recovered session key seed The first key of the symmetric encryption process is generated by the first and second random numbers , expressed as:

[0082] ;

[0083] ;

[0084] ;

[0085] ;

[0086] in, is a key derivation function based on the SM3 cryptographic algorithm; It is the symmetric encryption key of the SM4 algorithm; for Authentication key for authentication tag generation function; The initialization vector for GCM mode; 、 and These are fixed ASCII strings used to identify encryption key derivation, authentication key derivation, and counter modes, respectively.

[0087] Use the client's quantum-resistant public key to encrypt the first key to obtain the first authentication tag , the formula is as follows:

[0088] ;

[0089] in, represents the authentication tag generation function;

[0090] The second tamper-proof information is generated based on the session key seed recovered by the server. The formula is as follows:

[0091] ;

[0092] in, Represents the second tamper-proof information.

[0093] Furthermore, in S108, the third signature calculation formula is as follows:

[0094] ;

[0095] ;

[0096] in, On behalf of the third signature, Represents the first authentication label;

[0097] In S109, the client verifies the server's third signature using the following formula:

[0098] ;

[0099] Using local session key seed Verify the second tamper-proof information, the formula is as follows:

[0100] ;

[0101] The first key of the symmetric encryption process generated synchronously by the client is used to verify whether the first authentication tag of the server is correct, which is expressed as:

[0102] .

[0103] Furthermore, the process of using symmetric encryption keys to encapsulate and transmit data is as follows:

[0104] S201: After receiving the intranet communication data, the client encrypts the data using the first key to obtain a communication message ciphertext; and calculates a communication message authentication tag based on the first key, the sequence number, and the original traffic flow;

[0105] S201 is specifically:

[0106] ;

[0107] ;

[0108] in, Represents intranet communication data, Represents the original traffic, Represents the ciphertext of the communication message, represent Pattern encryption function, Represents the communication message authentication tag, The serial number is a 32-bit unsigned integer; Generate functions for authentication tags;

[0109] S202: The client sends the communication message ciphertext and the communication message authentication tag to the server;

[0110] S203: After receiving the encrypted data, the server first uses the first key to decrypt the communication message ciphertext; then verifies whether the HMAC is correct. If correct, the plaintext message is forwarded to the client;

[0111] S203 is expressed as:

[0112] ;

[0113] ;

[0114] in, for Pattern decryption function; HMAC for the received;

[0115] S204: The server sends the communication message ciphertext and the communication message authentication tag to the client; specifically, a tunnel repeated symmetric encryption process is used to transmit data; when the session key reaches the preset life cycle, the link is disconnected, and the link is re-established and the key is re-negotiated.

[0116] A software-defined anti-quantum tunnel communication security enhancement system for implementing the above-mentioned software-defined anti-quantum tunnel communication security enhancement method, comprising a local end and a remote end,

[0117] Both the local end and the remote end deploy tunnel software;

[0118] The tunnel software comprises:

[0119] The message processing module communicates with the enterprise intranet through plaintext and communicates with the public extranet through ciphertext;

[0120] The remote management module communicates with the message processing module;

[0121] The password module communicates with the message processing module;

[0122] The access control module communicates with the message processing module.

[0123] The technical effect of the present application is that:

[0124] Through the pure software-defined anti-quantum tunnel architecture, the encryption process is realized based on the anti-quantum cryptographic algorithm PQC, the full-stack software is realized through modular design, the dependence on anti-quantum chips is avoided, and the deployment cost is reduced. Further, through the non-invasive deployment of the tunnel, based on the client-server tunnel proxy mode, the original traffic is intercepted through the virtualization of the network interface by the message processing module, the business data is transparently encapsulated, multiple protocol transmission is supported, and the original protocol does not need to be modified. In particular, through the dual-certificate hybrid authentication mechanism, SM2 national secret certificates and anti-quantum certificates are used at the same time, the existing CA system is compatible and the quantum security transition is realized. In addition, through the anti-quantum reinforced remote management channel, the remote management channel and the VPN data tunnel are integrated into the same anti-quantum communication protocol stack, ensuring that the management instructions and data traffic are equally secure. Finally, through the lightweight traffic access control, the blacklist rules are pre-set at the encrypted tunnel entrance, the access traffic filtering is realized, and the tunnel effective utilization rate and the intranet security are improved. BRIEF DESCRIPTION OF DRAWINGS

[0125] Figure 1 It is a schematic diagram of the software-defined anti-quantum tunnel communication security enhancement system of the present application.

[0126] Figure 2Flowchart of tunnel establishment and key negotiation.

[0127] Figure 3 This is the flow chart of symmetric encryption communication. DETAILED DESCRIPTION

[0128] The present invention provides a software-defined anti-quantum tunnel communication security enhancement method and system. By introducing anti-quantum cryptographic algorithms and modular design, a purely software-implemented anti-quantum tunnel architecture is constructed. This architecture can achieve quantum secure communication without relying on hardware, supports non-intrusive deployment, and is compatible with various business scenarios. Figures 1 to 3 Specific embodiments of the present invention are described in detail.

[0129] Figure 1 This is a schematic diagram of the software-defined quantum-resistant tunnel communication security enhancement system of the present invention, illustrating the overall system structure and the interaction between the core modules. The system includes a local end and a remote end, with tunnel software deployed on both ends. The tunnel software consists of a message processing module, a remote management module, a cryptographic module, and an access control module. The enterprise intranet imports raw traffic into the message processing module through a virtualized network interface for encryption, and then transmits it to the remote message processing module via a public external network. The entire communication process involves a dual-certificate authentication mechanism using a national secret certificate and a quantum-resistant certificate, as well as dynamically updated blacklist rules to ensure traffic security.

[0130] During system operation, it is first necessary to establish a tunnel and complete key negotiation, and then achieve real-time communication through data encapsulation and transmission. At the same time, the tunnel working mode, security policy, etc. are centrally managed through the remote management channel. Figure 2 Demonstrates the tunnel establishment and key negotiation process. Figure 3 The specific implementation steps of symmetric encryption communication are described in detail.

[0131] In practical applications, assume that a distributed enterprise headquarters and multiple branches are interconnected via a public external network. The headquarters and each branch deploy the tunneling software of the present invention, intercepting raw traffic through a virtualized network interface and performing transparent quantum-safe encapsulation and transmission. The message processing module ensures business continuity through an intelligent fragmentation and reassembly mechanism, avoiding data loss or delays caused by network fluctuations. For example, when device A in the enterprise intranet sends data to remote device B, the message processing module first captures the data stream, invokes the cryptographic module to encrypt the data packets layer by layer, and then transmits the encrypted data to the remote message processing module via a tunnel. After receiving the encrypted data, the remote message processing module invokes the cryptographic module to decrypt it into plaintext, which is then forwarded to the corresponding device B.

[0132] The remote management module serves as the control center of the system and realizes equal security of command and data flow through the anti-quantum reinforced management channel. The management channel derives independent management keys from the session keys generated by the ML-KEM algorithm, ensuring that the management command is not tampered with or stolen during transmission. The remote management module supports functions such as setting tunnel working mode, real-time tunnel management, and configuring tunnel security policy. For example, the headquarters administrator can query existing tunnel information, add new tunnels, or delete invalid tunnels through the remote management module. In addition, the administrator can also dynamically update the blacklist rules to cope with changing network security threats. The blacklist rules are pre-installed at the encrypted tunnel entrance, and the access control module matches the IP address, port number, and protocol type in the original flow one by one to ensure that illegal traffic is blocked before entering the encrypted tunnel.

[0133] The password module provides quantum-secure password service support for the system, supporting anti-quantum password algorithms and hybrid encryption modes. The password module internally realizes flexible switching of multiple algorithms through modular design, such as selecting different parameter sets in NIST post-quantum standard algorithms to adapt to different scene requirements. In this embodiment, the password module uses the ML-KEM anti-quantum password algorithm for data reinforcement and supports the combination of the SM4 symmetric encryption algorithm and the anti-quantum algorithm, ensuring that both traditional encryption methods and quantum security requirements are met during the transition period. For example, after the tunnel is established, the client and the server independently calculate the same session key seed, and then use the first key for symmetric encryption communication. In this process, the password module calls standardized APIs to complete key generation, distribution, and data encryption operations according to the preset security policy.

[0134] The access control module communicates with the message processing module. Throughout the communication process, the remote management function is realized through the anti-quantum reinforced management channel, ensuring equal security of management command and data flow. The remote management function includes setting tunnel working mode, real-time tunnel management, and configuring tunnel security policy. For example, the administrator can update tunnel certificates, modify encryption algorithms, or adjust tunnel duration through the management channel. Real-time tunnel management supports querying existing tunnel information, adding new tunnels, or deleting invalid tunnels. Configuring tunnel security policy supports querying, adding, or deleting security rules, such as adding blacklist rules for specific IP addresses, port numbers, or protocol types.

[0135] The implementation methods of the remote management function include the following. The tunnel working mode setting supports certificate update operations. The administrator sends the update instruction through the request message structure, which includes the version number, message ID, timestamp, operation type and signature field. The main information includes the instruction type, parameters and certificate data. The server returns the status code and status description. If the update is successful, it returns the new configuration effective timestamp. Real-time tunnel management supports tunnel query function. The administrator can query the tunnel ID, status and network configuration through filtering conditions. The response data format returns the basic configuration, algorithm suite and traffic statistics. The tunnel addition operation requires the specification of the tunnel identifier, IP address pair and algorithm suite. The tunnel deletion operation supports batch processing. Security policy configuration supports rule query, addition or deletion operations. The administrator can dynamically update the blacklist rules through the rule type, rule ID and target value.

[0136] A software-defined method for enhancing the security of quantum-resistant tunneling communications includes the following steps:

[0137] Tunnel software is deployed at both the local and remote ends, the tunnel software including a message processing module, a remote management module, a password module and an access control module;

[0138] The local tunnel software establishes a link with the remote tunnel software. The local end calls the cryptographic module to generate a key and sends it to the remote end for tunnel establishment and key negotiation. After the tunnel is established, the local and remote ends use symmetric encryption keys to encapsulate and transmit data.

[0139] The local message processing module receives the plaintext business message from the enterprise intranet, calls the cryptographic module, and encrypts the plaintext using the negotiated key. The local message processing module then sends the encrypted ciphertext business message to the remote message processing module through the tunnel.

[0140] The local message processing module receives the encrypted business message from the remote end, calls the password module to decrypt it into plain text, and sends it to the corresponding device on the enterprise intranet;

[0141] The local message processing module receives the remote management message, which is reinforced using quantum-resistant cryptography technology. After receiving it, the cryptographic module is called to decrypt it, and then the decrypted message is sent to the remote management module for processing.

[0142] Furthermore, a client is deployed on the local end, and a server is deployed on the remote end;

[0143] The tunnel establishment and key negotiation process is as follows:

[0144] S101: The client initiates a key negotiation request;

[0145] S102: After receiving the key negotiation request, the server sends the server national secret certificate, the server anti-quantum certificate, the first random number and the first signature to the client;

[0146] S103: After receiving the response, the client verifies the server national secret certificate, the server anti-quantum certificate and the first signature; if the verification is passed, the next step is continued, otherwise the link is terminated;

[0147] S104: The client generates a second random number, generates a client anti-quantum key pair and a session key seed based on an anti-quantum cryptographic algorithm; encrypts the session key seed using the public key in the server anti-quantum certificate to obtain first encrypted information; calculates the hash value of the first random number and the second random number based on the SM3 cryptographic algorithm, thereby obtaining the first tamper-proof information;

[0148] S105: The client sends the client national secret certificate, the client anti-quantum public key, the first encrypted information, the second random number, the first tamper-proof information and the second signature to the server;

[0149] S106: The server verifies the second signature in the client response; recovers the session key seed from the first encrypted information using the server anti-quantum private key; verifies the first tamper-proof information through the SM3 cryptographic algorithm, the first random number and the second random number;

[0150] S107: The server generates a first key of the symmetric encryption process using the recovered session key seed and the first and second random numbers; encrypts the first key using the client anti-quantum public key to obtain a first authentication tag; generates second tamper-proof information based on the server recovered session key seed;

[0151] S108: The server sends the first authentication tag, the second tamper-proof information and the third signature to the client;

[0152] S109: The client verifies the server third signature; verifies the second tamper-proof information using the local session key seed; the client verifies the server first authentication tag using the first key;

[0153] If all verifications are passed, both parties have the same first key at this time, indicating that the encryption channel is ready.

[0154] Further, in S102, the server national secret certificate contains the server public key ;

[0155] The server anti-quantum certificate contains the server anti-quantum public key ;

[0156] The first signature calculation formula is as follows:

[0157] Calculate a hash value based on the first random number : ;

[0158] Generate the first signature : ;

[0159] in, represents the first random number, Represents the SM3 cryptographic algorithm; Represents a timestamp; Represents the server SM2 private key; is the string concatenation operator; Represents the signature generation function;

[0160] The signature verification process in S103 is represented as follows:

[0161] calculate , ;

[0162] pass Conduct verification;

[0163] in, is the recalculated hash value, The server SM2 public key; Represents a signature verification function.

[0164] Furthermore, S104 is specifically as follows:

[0165] The client generates a second random number , prepare for key exchange; the client generates a client quantum-resistant key pair based on the quantum-resistant cryptographic algorithm, and the client quantum-resistant key pair includes the client quantum-resistant public key and client-side quantum-resistant private keys , the generation algorithm is as follows:

[0166] Generate a random matrix: First generate a random private key seed , expanded to the public key matrix , ;

[0167] in, Represents an extension operation; Represents the dimension domain of the matrix, each element in the matrix is ​​a polynomial ring The polynomial on , is the modulus of the polynomial, Represents dimension, is a formal variable, is a modular polynomial, used to construct the algebraic structure of a polynomial ring; Representative Model The ring of integers, that is, all integers modulo The following collection;

[0168] Generate private key vector , expressed as: ;in, express dimensional error sampling distribution, represents random sampling;

[0169] Generate a public key , expressed as:

[0170] ;

[0171] ;

[0172] Where, e is the noise vector;

[0173] Obtaining a quantum-resistant public key , expressed as:

[0174] ;

[0175] Obtain client quantum-resistant private key , expressed as:

[0176] ;

[0177] Generate session key seed;

[0178] Use the public key in the server's quantum-resistant certificate to encrypt the session key seed to obtain the first encrypted information ; The encryption method is as follows:

[0179] Use server-side quantum-resistant public key , expand the server matrix ; ; The server's random private key seed, The server public key;

[0180] Generate random vectors and error 、 , expressed as:

[0181] ;

[0182] ;

[0183] ;

[0184] in, is the univariate error sampling distribution;

[0185] Calculate ciphertext components 、 ; expressed as:

[0186] , ; Represents the result after encoding as a polynomial, represents the matrix transpose, Represents the session key seed;

[0187] Compress to obtain the first encrypted information , expressed as:

[0188] ;

[0189] in, Indicates retaining the low digit of each coefficient;

[0190] based on The cryptographic algorithm calculates the hash value of the first random number and the second random number to obtain the first tamper-proof information , the calculation formula is as follows:

[0191] ;

[0192] in, express Cryptographic algorithm.

[0193] Furthermore, the second signature in S105 is generated based on the SM2 cryptographic algorithm, and the calculation formula is as follows:

[0194] ;

[0195] in, represents the second signature, Indicates based on The signature operation of the cryptographic algorithm, Represents the client's quantum-resistant public key, Represents the client's quantum-resistant private key, Indicates the SM3 cryptographic algorithm, represents the first encrypted information, represents the second random number;

[0196] S106 specifically includes: the server verifies whether the client signature is correct, and terminates the connection if the verification fails; specifically:

[0197] Verify the second signature , expressed as:

[0198] ;

[0199] in, Indicates the server's quantum-resistant private key;

[0200] After verification, the server-side quantum-resistant private key is used to recover the session key seed from the first encrypted information, which is expressed as:

[0201] Decompress the first encrypted information , expressed as:

[0202] ;

[0203] in, First encrypted information Compressed ciphertext component , First encrypted information Compressed ciphertext component , Ciphertext component The decompressed result is: Ciphertext component The result after decompression;

[0204] Use the server's quantum-resistant private key to decrypt the session key seed, expressed as:

[0205] ;

[0206] ;

[0207] in, is the coding information containing noise; is the recovered session key seed; represents the decoding function, Indicates the server's quantum-resistant private key;

[0208] Verify hash consistency, based on The cryptographic algorithm calculates the hash value of the first random number and the second random number. If the hash value is equal to the first tamper-proof information If they are inconsistent, it is considered tampering and the link is terminated; it is expressed as:

[0209] ;in, Indicates conditional judgment.

[0210] Furthermore, S107 is specifically as follows:

[0211] The server uses the recovered session key seed The first key of the symmetric encryption process is generated by the first and second random numbers , expressed as:

[0212] ;

[0213] ;

[0214] ;

[0215] ;

[0216] in, is a key derivation function based on the SM3 cryptographic algorithm; It is the symmetric encryption key of the SM4 algorithm; for Authentication key for authentication tag generation function; The initialization vector for GCM mode; 、 and These are fixed ASCII strings used to identify encryption key derivation, authentication key derivation, and counter modes, respectively.

[0217] Use the client's quantum-resistant public key to encrypt the first key to obtain the first authentication tag , the formula is as follows:

[0218] ;

[0219] in, represents the authentication tag generation function;

[0220] The second tamper-proof information is generated based on the session key seed recovered by the server. The formula is as follows:

[0221] ;

[0222] in, Represents the second tamper-proof information.

[0223] Furthermore, in S108, the third signature calculation formula is as follows:

[0224] ;

[0225] ;

[0226] in, On behalf of the third signature, Represents the first authentication label;

[0227] In S109, the client verifies the server's third signature using the following formula:

[0228] ;

[0229] Using local session key seed Verify the second tamper-proof information, the formula is as follows:

[0230] ;

[0231] The first key of the symmetric encryption process generated synchronously by the client is used to verify whether the first authentication tag of the server is correct, which is expressed as:

[0232] .

[0233] Furthermore, the process of using symmetric encryption keys to encapsulate and transmit data is as follows:

[0234] S201: After receiving the intranet communication data, the client encrypts the data using the first key to obtain a communication message ciphertext; and calculates a communication message authentication tag based on the first key, the sequence number, and the original traffic flow;

[0235] S201 is specifically:

[0236] ;

[0237] ;

[0238] in, Represents intranet communication data, Represents the original traffic, Represents the ciphertext of the communication message, represent Pattern encryption function, Represents the communication message authentication tag, The serial number is a 32-bit unsigned integer; Generate functions for authentication tags;

[0239] S202: The client sends the communication message ciphertext and the communication message authentication tag to the server;

[0240] S203: After receiving the encrypted data, the server first uses the first key to decrypt the communication message ciphertext; then verifies whether the HMAC is correct. If correct, the plaintext message is forwarded to the client;

[0241] S203 is expressed as:

[0242] ;

[0243] ;

[0244] in, for Pattern decryption function; is the received HMAC;

[0245] S204: The server sends the communication message ciphertext and the communication message authentication tag to the client; specifically, the tunnel repeats the symmetric encryption process to transmit data; when the session key reaches the preset life cycle, the link is disconnected, the link is re-established and the key is renegotiated.

[0246] A software-defined anti-quantum tunnel communication security enhancement system is used to implement the above-mentioned software-defined anti-quantum tunnel communication security enhancement method, including a local end and a remote end,

[0247] Tunnel software is deployed on both the local end and the remote end;

[0248] The tunnel software includes:

[0249] The message processing module communicates with the enterprise intranet via plain text and with the public extranet via encrypted text;

[0250] a remote management module, communicating with the message processing module;

[0251] A cryptographic module, communicating with the message processing module;

[0252] An access control module communicates with the message processing module.

[0253] In summary, the present invention implements the encryption process based on the PQC algorithm through a purely software-defined quantum-resistant tunnel architecture, realizes full-stack software through modular design, avoids dependence on quantum-resistant chips, and reduces deployment costs. Through tunneling and non-invasive deployment, based on the client-server tunnel proxy mode, the original traffic is intercepted through the virtualized network interface of the message processing module, the business data is transparently encapsulated, and multi-protocol transmission is supported without the need to modify the original protocol. Through the dual-certificate hybrid authentication mechanism, the SM2 national secret certificate and the quantum-resistant certificate are used at the same time, which is compatible with the existing CA system and realizes quantum security transition. Through the quantum-resistant reinforced remote management channel, the remote management channel and the VPN data tunnel are integrated into the same quantum-resistant communication protocol stack to ensure that management instructions and data traffic are equally secure. Through lightweight traffic access control, the blacklist rules are preset at the entrance of the encrypted tunnel to achieve access traffic filtering, improve the effective utilization rate of the tunnel and the security of the intranet.

Claims

1. A software-defined method for enhancing the security of quantum-resistant tunneling communications, characterized in that: The following steps are involved: Tunnel software is deployed at both the local and remote ends, the tunnel software including a message processing module, a remote management module, a password module and an access control module; The local tunnel software establishes a link with the remote tunnel software. The local end calls the cryptographic module to generate a key and sends it to the remote end for tunnel establishment and key negotiation. After the tunnel is established, the local and remote ends use symmetric encryption keys to encapsulate and transmit data. The local message processing module receives the plaintext business message from the enterprise intranet, calls the cryptographic module, and encrypts the plaintext using the negotiated key. The local message processing module then sends the encrypted ciphertext business message to the remote message processing module through the tunnel. The local message processing module receives the encrypted business message from the remote end, calls the password module to decrypt it into plain text, and sends it to the corresponding device on the enterprise intranet; The local message processing module receives the remote management message, which is reinforced using quantum-resistant cryptography technology. After receiving it, the cryptographic module is called to decrypt it, and then the decrypted message is sent to the remote management module for processing. The local end is equipped with a client, and the remote end is equipped with a server; The tunnel establishment and key negotiation process is as follows: S101: The client initiates a key negotiation request; S102: After receiving the key agreement request, the server sends the server's national encryption certificate, the server's quantum-resistant certificate, the first random number, and the first signature to the client; S103: After receiving the response, the client verifies the server's national encryption certificate, the server's quantum-resistant certificate, and the first signature; if the verification passes, the client proceeds to the next step; otherwise, the connection is terminated; S104: The client generates a second random number and generates a client quantum-resistant key pair and a session key seed based on a quantum-resistant cryptographic algorithm; encrypts the session key seed using the public key in the server quantum-resistant certificate to obtain first encrypted information; and calculates a hash value of the first random number and the second random number based on the SM3 cryptographic algorithm to obtain first tamper-proof information. S105: The client sends the client's national encryption certificate, the client's quantum-resistant public key, the first encrypted information, the second random number, the first tamper-proof information, and the second signature to the server; S106: The server verifies the second signature in the client response; recovers the session key seed from the first encrypted information using the server's quantum-resistant private key; and verifies the first tamper-proof information using the SM3 cryptographic algorithm, the first random number, and the second random number. S107: The server generates a first key for a symmetric encryption process using the recovered session key seed and the first and second random numbers; Encrypt the first key using the client's quantum-resistant public key to obtain a first authentication tag; Generate second tamper-proof information based on the session key seed recovered by the server; S108: The server sends the first authentication tag, the second tamper-proof information, and the third signature to the client; S109: The client verifies the third signature of the server; uses the local session key seed to verify the second tamper-proof information; the client verifies the first authentication tag of the server using the first key; If all verifications pass, both parties now hold the same first key, indicating that the encryption channel is ready.

2. A method for enhancing security of quantum-resistant tunneling communication based on software definition according to claim 1, characterized in that: In S102, the server's national secret certificate contains the server Public Key ; The server-side quantum-resistant certificate contains the server-side quantum-resistant public key ; The first signature calculation formula is as follows: Calculate a hash value based on the first random number : ; Generate the first signature : ; in, represents the first random number, Represents the SM3 cryptographic algorithm; Represents a timestamp; Represents the server SM2 private key; is the string concatenation operator; Represents the signature generation function; The signature verification process in S103 is represented as follows: calculate , ; pass Conduct verification; in, is the recalculated hash value, The server SM2 public key; Represents a signature verification function.

3. A software-defined method for enhancing the security of quantum-resistant tunneling communication according to claim 2, characterized in that: S104 is specifically: The client generates a second random number , prepare for key exchange; the client generates a client quantum-resistant key pair based on the quantum-resistant cryptographic algorithm, and the client quantum-resistant key pair includes the client quantum-resistant public key and client-side quantum-resistant private keys , the generation algorithm is as follows: Generate a random matrix: First generate a random private key seed , expanded to the public key matrix , ; in, Represents an extension operation; Represents the dimension domain of the matrix, each element in the matrix is ​​a polynomial ring The polynomial on , is the modulus of the polynomial, Represents dimension, is a formal variable, is a modular polynomial, used to construct the algebraic structure of a polynomial ring; Representative Model The ring of integers, that is, all integers modulo The following collection; Generate private key vector , expressed as: ;in, express dimensional error sampling distribution, represents random sampling; Generate a public key , expressed as: ； ； Where, e is the noise vector; Obtaining a quantum-resistant public key , expressed as: ； Obtain client quantum-resistant private key , expressed as: ； Generate session key seed; Use the public key in the server's quantum-resistant certificate to encrypt the session key seed to obtain the first encrypted information ; The encryption method is as follows: Use server-side quantum-resistant public key , expand the server matrix ; ; The server's random private key seed, The server public key; Generate random vectors and error 、 , expressed as: ； ； ； in, is the univariate error sampling distribution; Calculate ciphertext components 、 ; expressed as: , ; Represents the result after encoding as a polynomial, represents the matrix transpose, Represents the session key seed; Compress to obtain the first encrypted information , expressed as: ； in, Indicates retaining the low digit of each coefficient; based on The cryptographic algorithm calculates the hash value of the first random number and the second random number to obtain the first tamper-proof information , the calculation formula is as follows: ； in, express Cryptographic algorithm.

4. A software-defined method for enhancing the security of quantum-resistant tunneling communications according to claim 3, characterized in that: The second signature in S105 is generated based on the SM2 cryptographic algorithm and is calculated as follows: ； in, represents the second signature, Indicates based on The signature operation of the cryptographic algorithm, Represents the client's quantum-resistant public key, Represents the client's quantum-resistant private key, Indicates the SM3 cryptographic algorithm, represents the first encrypted information, represents the second random number; S106 specifically includes: the server verifies whether the client signature is correct, and terminates the connection if the verification fails; specifically: Verify the second signature , expressed as: ;in, Indicates the server's quantum-resistant private key; After verification, the server-side quantum-resistant private key is used to recover the session key seed from the first encrypted information, which is expressed as: Decompress the first encrypted information , expressed as: ； in, First encrypted information Compressed ciphertext component , First encrypted information Compressed ciphertext component , Ciphertext component The decompressed result is: Ciphertext component The result after decompression; Use the server's quantum-resistant private key to decrypt the session key seed, expressed as: ； ； in, is the coding information containing noise; is the recovered session key seed; represents the decoding function, Indicates the server's quantum-resistant private key; Verify hash consistency, based on The cryptographic algorithm calculates the hash value of the first random number and the second random number. If the hash value is equal to the first tamper-proof information If they are inconsistent, it is considered tampering and the link is terminated; it is expressed as: ;in, Indicates conditional judgment.

5. A software-defined method for enhancing the security of quantum-resistant tunneling communications according to claim 4, characterized in that: S107 is specifically: The server uses the recovered session key seed The first key of the symmetric encryption process is generated by the first and second random numbers , expressed as: ； ； ； ； in, is a key derivation function based on the SM3 cryptographic algorithm; It is the symmetric encryption key of the SM4 algorithm; for Authentication key for authentication tag generation function; The initialization vector for GCM mode; 、 and These are fixed ASCII strings used to identify encryption key derivation, authentication key derivation, and counter modes, respectively. Use the client's quantum-resistant public key to encrypt the first key to obtain the first authentication tag , the formula is as follows: ； in, represents the authentication tag generation function; The second tamper-proof information is generated based on the session key seed recovered by the server. The formula is as follows: ； in, Represents the second tamper-proof information.

6. A software-defined method for enhancing the security of quantum-resistant tunneling communications according to claim 5, characterized in that: In S108, the third signature calculation formula is as follows: ； ； in, On behalf of the third signature, Represents the first authentication label; In S109, the client verifies the server's third signature using the following formula: ； Using local session key seed Verify the second tamper-proof information, the formula is as follows: ； The first key of the symmetric encryption process generated synchronously by the client is used to verify whether the first authentication tag of the server is correct, which is expressed as: 。 7. A software-defined method for enhancing the security of quantum-resistant tunneling communications according to claim 6, characterized in that: The specific process of data encapsulation and transmission using symmetric encryption keys is as follows: S201: After receiving the intranet communication data, the client encrypts the data using the first key to obtain a communication message ciphertext; and calculates a communication message authentication tag based on the first key, the sequence number, and the original traffic flow; S201 is specifically: ； ； in, Represents intranet communication data, Represents the original traffic, Represents the ciphertext of the communication message, represent Pattern encryption function, Represents the communication message authentication tag, The serial number is a 32-bit unsigned integer; Generate functions for authentication tags; S202: The client sends the communication message ciphertext and the communication message authentication tag to the server; S203: After receiving the encrypted data, the server first uses the first key to decrypt the communication message ciphertext; then verifies whether the HMAC is correct. If correct, the plaintext message is forwarded to the client; S203 is expressed as: ； ； in, for Pattern decryption function; is the received HMAC; S204: The server sends the communication message ciphertext and the communication message authentication tag to the client; specifically, the tunnel repeats the symmetric encryption process to transmit data; when the session key reaches the preset life cycle, the link is disconnected, the link is re-established and the key is renegotiated.

8. A software-defined anti-quantum tunneling communication security enhancement system, used to implement a software-defined anti-quantum tunneling communication security enhancement method according to any one of claims 1 to 7, comprising a local end and a remote end, characterized in that: Tunnel software is deployed on both the local end and the remote end; The tunnel software includes: The message processing module communicates with the enterprise intranet via plain text and with the public extranet via encrypted text; a remote management module, communicating with the message processing module; A cryptographic module, communicating with the message processing module; An access control module communicates with the message processing module.

Images