IPSec VPN security gateway communication method based on post quantum cryptography

Abstract

The invention discloses an IPSec VPN security gateway communication method based on a post quantum cryptography technology, and the method comprises the following steps: S1, replacing a conventional SM2 algorithm and a certificate with a PQC algorithm and a digital certificate in a first-stage main mode of IKE key negotiation; s2, the initiator and the responder respectively use the PQC key pair to complete key exchange and signature; s3, in the message 1, the initiator sends a security alliance load containing a PQC public key algorithm attribute to the responder; s4, in the message 2, the responder sends an SA load containing a PQC signature certificate and an encryption certificate, and a received SA proposal sent by the initiator is marked; s5, in the message 3 and the message 4, the initiator and the responder complete key exchange and verification; and S6, in the message 5 and the message 6, the initiator and the responder encrypt the transmitted information by using a symmetric cryptographic algorithm, and identify the previous exchange process. According to the invention, the security of the IPSec VPN security gateway is improved, and quantum computing attacks can be resisted.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an IPSec VPN security gateway communication method based on post-quantum cryptography technology. Background Art

[0002] The IPSec VPN (Internet Protocol Security Virtual Private Network) security gateway system is a standardized cryptographic device for the IP network layer in my country's information security field, based on the PKI (Public Key Infrastructure) technology system. Traditional IPSec VPN security gateways rely on classical public key algorithms (such as RSA and SM2) for key negotiation and authentication. With the development of quantum computing technology, these algorithms are at risk of being cracked. Post-quantum cryptography (PQC) algorithms, due to their resistance to quantum attacks, are becoming an important alternative to classical algorithms. However, existing technologies lack a complete alternative to the SM2 algorithm used in IPSec VPN protocols, particularly in combination with digital certificates during the IKE key negotiation phase. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide an IPSec VPN security gateway communication method based on post-quantum cryptography technology, which can improve the security of the IPSec VPN security gateway and resist quantum computing attacks.

[0004] In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows.

[0005] An IPSec VPN security gateway communication method based on post-quantum cryptography technology comprises the following steps: S1. In the first phase of IKE key negotiation in main mode, the post-quantum cryptography algorithm PQC and digital certificates based on the PQC cryptography algorithm are used instead of the traditional SM2 algorithm and digital certificates based on the SM2 cryptography algorithm. S2. The initiator and responder use the PQC encryption key pair and PQC signature key pair to perform key exchange and data signing respectively; S3. In message 1, the initiator sends a security association payload encapsulated in the proposed payload to the responder, and the proposed payload is encapsulated in the transform payload, and the SA attribute payload in the transform payload adds a PQC public key algorithm attribute value; S4. In message 2, the responder sends an SA payload containing the PQC signature certificate and encryption certificate, and the SA payload indicates the SA proposal received from the initiator. S5. In messages 3 and 4, the initiator and responder complete key exchange and verification; the initiator and responder exchange data, including a one-time random number nonce and an identity ID payload, and the exchanged data is encrypted using the other party's encryption key to protect the negotiated temporary key, and both parties digitally sign the exchanged data; S6. In messages 5 and 6, the initiator and responder use a symmetric cryptographic algorithm to encrypt the transmitted information and authenticate the previous exchange process.

[0006] Preferably, the PQC digital certificate in step S1 is a standard X.509 format certificate, and a new OID is used to identify the PQC algorithm, and the public key value and signature value use the public key value and signature value of the PQC algorithm respectively; the PQC algorithm includes but is not limited to a key encapsulation algorithm based on a lattice cryptography mechanism: ML-KEM, and a digital signature algorithm based on a lattice cryptography mechanism: ML-DSA.

[0007] Preferably, the PQC public key algorithm attribute value in step S3 is a predefined object identifier OID value ASYMMETRIC_MLKEM_MLDSA, and ASYMMETRIC_MLKEM_MLDSA is used to explicitly declare in the SA attribute payload of the IKE key negotiation that the current key negotiation adopts a PQC algorithm combination based on the ML-KEM algorithm and the ML-DSA algorithm to replace the traditional SM2 algorithm, and in the PQC algorithm key negotiation scenario, both the sender and the responder use ASYMMETRIC_MLKEM_MLDSA.

[0008] Preferably, in step S5, the initiator and the responder complete the key exchange and verification in message 3, including the following steps: A1. The initiator uses the responder's PQC encryption key to encrypt the public key EncPubKey R The shared key Ski generated by the initiator is encrypted using the ML-KEM algorithm to generate the ciphertext EncData_i. The random number Ni generated by the initiator and the initiator's identity IDi are encrypted using the shared key Ski using the SM4 symmetric encryption algorithm in CBC mode, along with its own PQC signature certificate CERT_sig_i and encryption certificate CERT_enc_i. A2. The initiator uses its own PQC signature key to private key SignPriKey IPerform ML-DSA algorithm signature on the signature data "Ski_b|Ni_b|IDi_b|CERT_enc_i_b" to generate a signature value SIGi_b; Ski_b is a derived value of Ski, Ni_b is a derived value of Ni, IDi_b is a derived value of IDi, and CERT_enc_i_b is a derived value of CERT_enc_i; A3. The responder uses its own PQC encryption key to encrypt the private key EncPriKey R Decrypt EncData_i using the ML-KEM algorithm to obtain Ski, and then use Ski to decrypt Ni and IDi; A4. The responder uses the initiator's PQC signature key to sign the public key SignPubKey I SIGi_b is verified using the ML-DSA algorithm. If the verification succeeds, the initiator's identity and message integrity are confirmed.

[0009] Preferably, in step S5, the initiator and the responder complete the key exchange and verification in message 4, including the following steps: B1. The responder uses the initiator's PQC encryption key to encrypt the public key EncPubKey I The shared key Skr generated by the responder is encrypted using the ML-KEM algorithm to generate the ciphertext EncData_r. The random number Nr generated by the responder and the responder's identity IDr are encrypted using the shared key Skr using the SM4 symmetric encryption algorithm in CBC mode. B2. The responder uses its own PQC signature key to private key SignPriKey R Perform ML-DSA algorithm signature on the signature data "Skr_b|Nr_b|IDr_b|CERT_enc_r_b" to generate a signature value SIGr_b; Skr_b is a derived value of Skr, Nr_b is a derived value of Nr, IDr_b is a derived value of IDr, and CERT_enc_r_b is a derived value of CERT_enc_r; B3. The initiator uses its own PQC encryption key to encrypt the private key EncPriKey I Decrypt EncData_r using the ML-KEM algorithm to obtain Skr, and use Skr to decrypt Nr and IDr; B4. The initiator uses the responder's PQC signature key to the public key SignPubKey R SIGr_b is verified using the ML-DSA algorithm. If the verification succeeds, the initiator's identity and message integrity are confirmed.

[0010] Preferably, the shared key Ski generated by the initiator and the shared key Skr generated by the responder in step S5 are respectively 32-byte keys generated by the ML-KEM algorithm, and the key length is adapted to the key length requirement of the symmetric encryption algorithm by XORing the front and back 16 bytes.

[0011] Preferably, the types of IDi and IDr in step S5 are identity identification formats ID_DER_ASN1_DN based on the X.509 certificate standard.

[0012] Preferably, the step S6 is specifically as follows: the initiator and the responder use the SM4 symmetric encryption algorithm with the encryption mode being the CBC mode to encrypt the identification information, the initialization vector IV is generated by concatenating the derived value of Ski of message 3 and the derived value of Skr of message 4 and then using a hash algorithm, and the identification information includes HASH_I calculated by the initiator through the PRF function and HASH_R calculated by the responder through the PRF function, which are used to verify the consistency of the key negotiation between the two parties.

[0013] Preferably, the ML-KEM algorithm, ML-DSA algorithm, SM4 symmetric encryption algorithm with CBC encryption mode, and hash algorithm used in the method are all determined by message 1 and message 2.

[0014] Preferably, the exchanged data before encryption in step S5 needs to be padded so that its length is equal to an integer multiple of the symmetric encryption algorithm packet length, and the values ​​of the padding bytes are all 0 except the last byte, and the value of the last padding byte is the number of padding bytes excluding itself; the information before encryption in step S6 needs to be padded so that its length is equal to an integer multiple of the symmetric encryption algorithm packet length, and the values ​​of all padding bytes are 0, and the message length in the header should include the length of the padding bytes.

[0015] Due to the adoption of the above technical solution, the technical progress achieved by the present invention is as follows.

[0016] The present invention uses the PQC algorithm and a digital certificate based on the PQC cryptographic algorithm in the IKE key negotiation phase to replace the traditional SM2 algorithm and a digital certificate based on the SM2 cryptographic algorithm, thereby improving the security of the IPSec VPN security gateway and resisting quantum computing attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is an architectural diagram of the IPSec VPN security gateway system based on post-quantum cryptography technology that applies the present invention. DETAILED DESCRIPTION

[0018] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0019] An IPSec VPN security gateway communication method based on post-quantum cryptography technology comprises the following steps: S1. In the first phase of IKE key negotiation in main mode, the post-quantum cryptography algorithm PQC and digital certificates based on the PQC cryptography algorithm are used to replace the traditional SM2 algorithm and digital certificates based on the SM2 cryptography algorithm.

[0020] PQC digital certificates are in standard X.509 format and use a new OID to identify the PQC algorithm. The public key value and signature value use the PQC algorithm's public key value and signature value, respectively. According to GM / T 0022, "IPSec VPN Technical Specification," key agreement based on the PQC algorithm uses PQC algorithm digital certificates, including signature and encryption certificates. PQC algorithms include but are not limited to the ML-KEM and ML-DSA algorithms. ML-KEM is a lattice-based key encapsulation algorithm used for key encapsulation; ML-DSA is a lattice-based digital signature algorithm used for digital signatures. The SM2 public key algorithm originally used in IKE phase 1 has been replaced by the ML-KEM and ML-DSA algorithms.

[0021] The client (Initiator) and server (Responder) need to have a pure PQC digital certificate and the corresponding PQC encryption key pair private key and PQC signature key pair private key. The client's PQC encryption key pair public key is included in the encrypted digital certificate, recorded as EncPubKey I , the private key of the PQC encryption key pair is recorded as EncPriKey I ; The client's PQC signature key pair public key is included in the signature digital certificate, recorded as SignPubKey I , the private key of the PQC signature key pair is recorded as SignPriKey I The server's PQC encryption key pair public key is included in the encrypted digital certificate, recorded as EncPubKey R , the private key of the PQC encryption key pair is recorded as EncPriKey R ; The server's PQC signature key pair public key is included in the signature digital certificate, recorded as SignPubKey R , the private key of the PQC signature key pair is recorded as SignPriKey R .

[0022] S2. The initiator and responder use the PQC encryption key pair and PQC signature key pair to perform key exchange and data signing respectively.

[0023] S3. In message 1, the initiator sends a security association payload encapsulating the proposal payload to the responder, and the proposal payload encapsulates the transform payload, and the SA attribute in the transform payload carries the new PQC public key algorithm attribute value.

[0024] Specifically, the initiator sends a security association payload encapsulating the proposal payload to the responder, and the proposal payload encapsulates the transform payload. The SA attribute in the transform payload needs to carry the new PQC public key algorithm attribute value, as shown in the following table: name describe value ASYMMETRIC_RSA RSA public key cryptography algorithm 1 ASYMMETRIC_SM2 SM2 elliptic curve cryptography algorithm 2 ASYMMETRIC_MLKEM_MLDSA PQC Algorithm 3 The PQC public key algorithm attribute value is a predefined object identifier (OID) value ASYMMETRIC_MLKEM_MLDSA, which is used to explicitly declare in the SA attribute payload of the IKE key negotiation that the current key negotiation adopts the PQC algorithm combination based on the ML-KEM algorithm and the ML-DSA algorithm to replace the traditional SM2 algorithm, and both the sender and the responder use ASYMMETRIC_MLKEM_MLDSA in the PQC algorithm key negotiation scenario.

[0025] S4. In message 2, the responder sends an SA payload containing the PQC signature certificate and the encryption certificate, and the SA payload indicates the received SA proposal sent by the initiator.

[0026] Specifically, the responder sends an SA payload containing the PQC signature certificate and the encryption certificate of the responder, and the payload indicates the received SA proposal sent by the initiator.

[0027] S5. In messages 3 and 4, the initiator and the responder complete the key exchange and verification; the initiator and the responder exchange data, including a nonce and an identity (ID) payload, and the exchanged data is encrypted using the encryption key of the other party to protect the negotiated temporary key Sk, and both parties digitally sign the exchanged data.

[0028] The nonce is a necessary parameter for generating the encryption key and the authentication key; the identity (ID) is the identity of the initiator or the responder; and the temporary key Sk includes the shared key Ski generated by the initiator and the shared key Skr generated by the responder.

[0029] Specifically, the exchanged data of the initiator is as follows: EncData_i=PQC_PubKey_Enc(Ski, EncPubKey R ) XCHi=EncData_i|Symmetric_Encrypt(Ni,Ski)| Symmetric_Encrypt(IDi,Ski)|CERT_sig_i|CERT_enc_i; SIGi_b=PQC_SecKey_Sign(Ski_b|Ni_b|IDi_b|CERT_enc_i_b, SignPriKey I ); Among them, PQC_PubKey_Enc represents the key encapsulation encryption method based on the ML-KEM algorithm. The first parameter Ski of this method represents the shared key generated by this method, that is, the shared key generated by the initiator. The second parameter EncPubKey R Represents the public key of the PQC encryption key pair of the responder. The return value EncData_i of this method is the encrypted ciphertext sent to the responder. PQC_SecKey_Sign represents the private key signature method of the ML-DSA algorithm. The first parameter Ski_b|Ni_b|IDi_b|CERT_enc_i_b of this method represents the data to be signed, where Ski_b is the derived value of Ski, Ni_b is the derived value of Ni, IDi_b is the derived value of IDi, and CERT_enc_i_b is the derived value of CERT_enc_i. Ski_b, Ni_b, IDi_b and CERT_enc_i_b are all in binary form. The second parameter SignPriKey I Represents the private key of the initiator's PQC signature key pair. During the signature operation, a summary operation needs to be performed on the signed data. | indicates binary data connection. Symmetric_Encrypt represents the SM4 symmetric encryption method. The first parameter Ni of this method is a random number generated by the initiator. IDi is the initiator's identity identifier, representing the plaintext data. The second parameter Ski is the shared key generated by the initiator, representing the encryption key. CERT_sig_i is the PQC signature certificate, and CERT_enc_i is the PQC encryption certificate.

[0030] The responder's decrypted initiator's exchanged data is as follows: Ski=PQC_SecKey_Dec(EncData_i, EncPriKey R ) Ni=Symmetric_Decrypt(NiEncData_i,Ski) IDi=Symmetric_Decrypt(IDiEncData_i,Ski) PQC_PubKey_Verify(Ski_b|Ni_b|IDi_b|CERT_enc_i_b, SignPubKeyI ); When the responder receives the above message, it first uses the private key of the ML-KEM algorithm to decrypt and obtain Ski, and then uses Ski to decrypt and obtain Ni and IDi; secondly, it uses the ML-DSA algorithm to verify the data signature. If the verification succeeds, the correctness of the third message is proved. At this point, the initiator and responder have obtained the first shared key Ski.

[0031] Specifically, the initiator and responder complete key exchange and verification in message 3, including the following steps: A1. The initiator uses the responder's PQC encryption key to encrypt the public key EncPubKey R The shared key Ski generated by the initiator is encrypted by the ML-KEM algorithm to generate the ciphertext EncData_i; and the random number Ni generated by the initiator and the initiator's identity IDi are encrypted using the shared key Ski using the SM4 symmetric encryption algorithm in CBC mode, and the initiator's own PQC signature certificate CERT_sig_i and encryption certificate CERT_enc_i are attached.

[0032] A2. The initiator uses its own PQC signature key to private key SignPriKey I Sign the signature data "Ski_b|Ni_b|IDi_b|CERT_enc_i_b" using the ML-DSA algorithm to generate the signature value SIGi_b.

[0033] A3. The responder uses its own PQC encryption key to encrypt the private key EncPriKey R Decrypt EncData_i using the ML-KEM algorithm to obtain Ski, and then use Ski to decrypt Ni and IDi.

[0034] A4. The responder uses the initiator's PQC signature key to sign the public key SignPubKey I SIGi_b is verified using the ML-DSA algorithm. If the verification succeeds, the initiator's identity and message integrity are confirmed.

[0035] Specifically, the data exchanged by the responder is as follows: EncData_r = PQC_PubKey_Enc(Skr, EncPubKey I ) XCHr=EncData_r|Symmetric_Encrypt(Nr,Skr)| Symmetric_Encrypt(IDr,Skr); SIGr_b=PQC_SecKey_Sign(Skr_b|Nr_b|IDr_b|CERT_enc_r_b, SignPriKey R ) Similarly, when the initiator receives the above message, it first uses the private key of the ML-KEM algorithm to decrypt and obtain the shared key Skr generated by the responder, and then uses Skr to decrypt and obtain the random number Nr generated by the responder and the responder's identity IDr; secondly, it uses the ML-DSA algorithm to verify the data signature "Skr_b|Nr_b|IDr_b|CERT_enc_r_b", where Skr_b is the derived value of Skr, Nr_b is the derived value of Nr, IDr_b is the derived value of IDr, and CERT_enc_r_b is the derived value of the encrypted ciphertext CERT_enc_r sent to the initiator. Skr_b, Nr_b, IDr_b, CERT_enc_r_b and CERT_enc_r are all in binary form. If the verification is successful, the correctness of the fourth message is proved. At this point, the initiator and responder have obtained the first shared key Ski and the second shared key Skr.

[0036] Specifically, the initiator and responder complete key exchange and verification in message 4, including the following steps: B1. The responder uses the initiator's PQC encryption key to encrypt the public key EncPubKey I The shared key Skr generated by the responder is encrypted using the ML-KEM algorithm to generate the ciphertext EncData_r. The random number Nr generated by the responder and the responder's identity IDr are encrypted using the shared key Skr using the SM4 symmetric encryption algorithm in CBC mode.

[0037] B2. The responder uses its own PQC signature key to private key SignPriKey R Sign the signature data "Skr_b|Nr_b|IDr_b|CERT_enc_r_b" using the ML-DSA algorithm to generate the signature value SIGr_b.

[0038] B3. The initiator uses its own PQC encryption key to encrypt the private key EncPriKey I Decrypt EncData_r using the ML-KEM algorithm to obtain Skr, and use Skr to decrypt Nr and IDr.

[0039] B4. The initiator uses the responder's PQC signature key to the public key SignPubKey R SIGr_b is verified using the ML-DSA algorithm. If the verification succeeds, the initiator's identity and message integrity are confirmed.

[0040] Specifically, the temporary key Sk is a 32-byte key generated by the ML-KEM algorithm. Its key length is adapted to the key length requirements of the symmetric encryption algorithm by using the XOR method of the preceding and following 16 bytes. The type of IDi and IDr should use ID_DER_ASN1_DN. ID_DER_ASN1_DN is an identity identification format based on the X.509 certificate standard. It uses the DER-encoded ASN.1 distinguished name (DN) to clearly identify the communicating parties. If the validity verification of the communicating party's certificate fails (including expiration, revocation, or signature verification failure), the negotiation is immediately terminated and an INVALID_CERTIFICATE notification message is sent.

[0041] In step S5, the symmetric encryption operation uses the CBC mode, the IV value of the first payload is 0, and the subsequent IV uses the last set of ciphertext of the previous payload; the exchanged data before encryption in step S5 needs to be padded so that its length is equal to an integer multiple of the symmetric encryption algorithm packet length, and the values ​​of the padding bytes are all 0 except the last byte, and the value of the last padding byte is the number of padding bytes excluding itself.

[0042] After the exchange of messages 3 and 4 is completed, the two parties involved in the communication generate the basic key parameter SKEYID to generate the subsequent keys SKEYID_d, SKEYID_a, and SKEYID_e. The calculation method refers to GM / T 0022.

[0043] S6. In messages 5 and 6, the initiator and responder use a symmetric cryptographic algorithm to encrypt the transmitted information and authenticate the previous exchange process.

[0044] Specifically, the initiator and responder use the SM4 symmetric encryption algorithm in CBC mode to encrypt the authentication information. The key is SKEYID_e. The initialization vector IV is generated by concatenating the value Ski_b derived from Ski in message 3 and the value Skr_b derived from Skr in message 4 and then using a hash algorithm, that is: IV= HASH(Ski_b |Skr_b) The information before encryption needs to be padded so that its length is equal to an integer multiple of the symmetric encryption algorithm block length. The value of all padding bytes is 0. The message length in the header should include the length of the padding bytes because it reflects the length of the ciphertext.

[0045] To authenticate the exchange, authentication information includes HASH_I calculated by the initiator using the PRF function and HASH_R calculated by the responder using the PRF function. This information is used to verify the key agreement consistency between the two parties. The initiator generates HASH_I and the responder generates HASH_R. The calculation formula is as follows: HASH_I = PRF(SKEYID, CKY-I|CKY-R | SAi_b|IDi_b ) HASH_R = PRF(SKEYID, CKY-R| CKY-I|SAr_b|IDr_b) If it detects that the other party's PQC digital certificate is revoked or invalid, it immediately terminates the IKE key negotiation and sends a notification message to the other party.

[0046] The ML-KEM algorithm, ML-DSA algorithm, SM4 symmetric encryption algorithm with CBC mode encryption, and hash algorithm used in the method of the present invention are all determined by message 1 and message 2.

[0047] An IPSec VPN security gateway system based on post-quantum cryptography technology is implemented based on an IPSec VPN security gateway communication method based on post-quantum cryptography technology. It is an upgrade and transformation based on the existing standard IPSec VPN security gateway. It mainly uses the PQC algorithm and PQC digital certificate in the main mode of the first phase of IKE key negotiation, combined with Figure 1 As shown, it includes components such as a post-quantum cryptography module, a classical cryptography module, an IKE key negotiation module, an IPSec ESP processing module, and a device management service. Among them, the output end of the post-quantum cryptography module is connected to the input end of the IKE key negotiation module and the device management service respectively; the output end of the IKE key negotiation module is connected to the input end of the IPSec ESP processing module; the output end of the classical cryptography module is connected to the input end of the IKE key negotiation module, the IPSec ESP processing module, and the device management service respectively.

[0048] The post-quantum cryptography module is mainly used to implement post-quantum cryptographic algorithms, post-quantum key storage and use.

[0049] The classic cryptographic module is mainly used for classic static key management, classic cryptographic algorithm logic implementation and other functions.

[0050] The device management service is a human-computer interaction module used to manage the parameters, function enablement, and permission roles of the IPSec VPN security gateway.

[0051] The IKE key negotiation module is responsible for "security infrastructure", generating shared keys and negotiating security parameters through post-quantum cryptography technology, and providing key materials for the IPSec ESP processing module.

[0052] The IPSec ESP processing module is responsible for "data protection execution", encrypting and authenticating user traffic based on negotiated keys and algorithms to achieve end-to-end secure communication.

Claims

1. An IPSec VPN security gateway communication method based on post-quantum cryptography technology, characterized by: The following steps are involved: S1. In the first phase of IKE key negotiation in main mode, the post-quantum cryptography algorithm PQC and digital certificates based on the PQC cryptography algorithm are used instead of the traditional SM2 algorithm and digital certificates based on the SM2 cryptography algorithm. S2. The initiator and responder use the PQC encryption key pair and PQC signature key pair to perform key exchange and data signing respectively; S3. In message 1, the initiator sends a security association payload encapsulated in the proposed payload to the responder, and the proposed payload is encapsulated in the transform payload, and the SA attribute payload in the transform payload adds a PQC public key algorithm attribute value; S4. In message 2, the responder sends an SA payload containing the PQC signature certificate and encryption certificate, and the SA payload indicates the SA proposal received from the initiator. S5. In messages 3 and 4, the initiator and responder complete key exchange and verification; the initiator and responder exchange data, including a one-time random number nonce and an identity ID payload, and the exchanged data is encrypted using the other party's encryption key to protect the negotiated temporary key, and both parties digitally sign the exchanged data; S6. In messages 5 and 6, the initiator and responder use a symmetric cryptographic algorithm to encrypt the transmitted information and authenticate the previous exchange process.

2. The IPSec VPN security gateway communication method based on post-quantum cryptography technology according to claim 1, characterized in that: In step S1, the PQC digital certificate is a standard X.509 format certificate, and a new OID is used to identify the PQC algorithm. The public key value and signature value use the public key value and signature value of the PQC algorithm respectively; the PQC algorithm includes but is not limited to a key encapsulation algorithm based on a lattice cryptography mechanism: ML-KEM, and a digital signature algorithm based on a lattice cryptography mechanism: ML-DSA.

3. The IPSec VPN security gateway communication method based on post-quantum cryptography technology according to claim 2, characterized in that: In step S3, the PQC public key algorithm attribute value is a predefined object identifier OID value ASYMMETRIC_MLKEM_MLDSA. ASYMMETRIC_MLKEM_MLDSA is used to explicitly declare in the SA attribute payload of the IKE key negotiation that the current key negotiation adopts a PQC algorithm combination based on the ML-KEM algorithm and the ML-DSA algorithm to replace the traditional SM2 algorithm. In the PQC algorithm key negotiation scenario, both the sender and the responder use ASYMMETRIC_MLKEM_MLDSA.

4. The IPSec VPN security gateway communication method based on post-quantum cryptography technology according to claim 2, characterized in that: In step S5, the initiator and the responder complete the key exchange and verification in message 3, including the following steps: A1. The initiator uses the responder's PQC encryption key to encrypt the public key EncPubKey R The shared key Ski generated by the initiator is encrypted using the ML-KEM algorithm to generate the ciphertext EncData_i. The random number Ni generated by the initiator and the initiator's identity IDi are encrypted using the shared key Ski using the SM4 symmetric encryption algorithm in CBC mode, along with its own PQC signature certificate CERT_sig_i and encryption certificate CERT_enc_i. A2. The initiator uses its own PQC signature key to private key SignPriKey I Perform ML-DSA algorithm signature on the signature data "Ski_b|Ni_b|IDi_b|CERT_enc_i_b" to generate a signature value SIGi_b; Ski_b is a derived value of Ski, Ni_b is a derived value of Ni, IDi_b is a derived value of IDi, and CERT_enc_i_b is a derived value of CERT_enc_i; A3. The responder uses its own PQC encryption key to encrypt the private key EncPriKey R Decrypt EncData_i using the ML-KEM algorithm to obtain Ski, and then use Ski to decrypt Ni and IDi; A4. The responder uses the initiator's PQC signature key to sign the public key SignPubKey I SIGi_b is verified using the ML-DSA algorithm. If the verification succeeds, the initiator's identity and message integrity are confirmed.

5. The IPSec VPN security gateway communication method based on post-quantum cryptography technology according to claim 4, characterized in that: In step S5, the initiator and the responder complete the key exchange and verification in message 4, including the following steps: B1. The responder uses the initiator's PQC encryption key to encrypt the public key EncPubKey I The shared key Skr generated by the responder is encrypted using the ML-KEM algorithm to generate the ciphertext EncData_r. The random number Nr generated by the responder and the responder's identity IDr are encrypted using the shared key Skr using the SM4 symmetric encryption algorithm in CBC mode. B2. The responder uses its own PQC signature key to private key SignPriKey R Perform ML-DSA algorithm signature on the signature data "Skr_b|Nr_b|IDr_b|CERT_enc_r_b" to generate a signature value SIGr_b; Skr_b is a derived value of Skr, Nr_b is a derived value of Nr, IDr_b is a derived value of IDr, and CERT_enc_r_b is a derived value of CERT_enc_r; B3. The initiator uses its own PQC encryption key to encrypt the private key EncPriKey I Decrypt EncData_r using the ML-KEM algorithm to obtain Skr, and use Skr to decrypt Nr and IDr; B4. The initiator uses the responder's PQC signature key to the public key SignPubKey R SIGr_b is verified using the ML-DSA algorithm. If the verification succeeds, the initiator's identity and message integrity are confirmed.

6. The IPSec VPN security gateway communication method based on post-quantum cryptography technology according to claim 5, characterized in that: The shared key Ski generated by the initiator and the shared key Skr generated by the responder in step S5 are respectively 32-byte keys generated by the ML-KEM algorithm, and the key length is adapted to the key length requirement of the symmetric encryption algorithm by means of XOR of the front and back 16 bytes.

7. The IPSec VPN security gateway communication method based on post-quantum cryptography technology according to claim 5, characterized in that: The types of IDi and IDr in step S5 are the identity identification format ID_DER_ASN1_DN based on the X.509 certificate standard.

8. The IPSec VPN security gateway communication method based on post-quantum cryptography technology according to claim 5, characterized in that: The specific step S6 is: the initiator and the responder use the SM4 symmetric encryption algorithm with the CBC mode to encrypt the identification information, the initialization vector IV is generated by the concatenation of the derived value of Ski of message 3 and the derived value of Skr of message 4 and then by the hash algorithm, and the identification information includes HASH_I calculated by the initiator through the PRF function and HASH_R calculated by the responder through the PRF function, which are used to verify the consistency of the key negotiation between the two parties.

9. The IPSec VPN security gateway communication method based on post-quantum cryptography technology according to claim 8, characterized in that: The ML-KEM algorithm, ML-DSA algorithm, SM4 symmetric encryption algorithm with CBC encryption mode, and hash algorithm used in the method are all determined by message 1 and message 2.

10. The IPSec VPN security gateway communication method based on post-quantum cryptography technology according to claim 8, characterized in that: The exchanged data before encryption in step S5 needs to be padded so that its length is equal to an integer multiple of the symmetric encryption algorithm packet length, and the values ​​of the padding bytes are all 0 except the last byte, and the value of the last padding byte is the number of padding bytes excluding itself; the information before encryption in step S6 needs to be padded so that its length is equal to an integer multiple of the symmetric encryption algorithm packet length, and the values ​​of all padding bytes are 0, and the message length in the header should include the length of the padding bytes.

Images