Identity processing method and apparatus

Abstract

The present disclosure provides an identity processing method and device, and relates to the technical field of communication. The method comprises the following steps: receiving an authentication string sent by a first user for identity authentication; calculating an identity password algorithm public key of the first user based on a user identifier of the first user; querying a post-quantum digital signature algorithm public key of the first user based on the identity password algorithm public key of the first user; verifying a first identity signature in the authentication string according to the identity password algorithm public key of the first user, and verifying a post-quantum signature in the authentication string according to the post-quantum digital signature algorithm public key of the first user; and determining that the identity authentication of the first user is successful after both verifications are passed. Through the above technical means, the problem that the identity processing is affected by quantum algorithms in the prior art, resulting in that the security of identity processing cannot be guaranteed, is solved.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of communication, and particularly relates to an identity processing method and device. BACKGROUND

[0002] With the constant breakthroughs in quantum computing hardware and the emergence of quantum algorithms, the current traditional cryptographic algorithms based on computational complexity such as large number factorization have been greatly threatened. The identity processing scenario is particularly important for communication security because it involves user sensitive information. How to avoid the influence of quantum algorithms on identity processing and ensure the security of identity processing is a problem that needs to be solved at present. SUMMARY

[0003] The present disclosure provides an identity processing method and device, which at least improves the security guarantee of users to a certain extent.

[0004] Other characteristics and advantages of the present disclosure will become apparent from the following detailed description, or will be learned by practice of the present disclosure.

[0005] According to one aspect of the present disclosure, an identity processing method is provided, applied to a public key management center side, comprising: receiving an authentication string sent by a first user for identity authentication, wherein the authentication string comprises first signature data, a first identity signature, and a post-quantum signature, the first identity signature and the post-quantum signature being obtained by performing an identity cryptographic algorithm digital signature operation and a post-quantum digital signature operation on the first signature data, respectively; calculating an identity cryptographic algorithm public key of the first user based on a user identifier of the first user; querying a post-quantum digital signature algorithm public key of the first user based on the identity cryptographic algorithm public key of the first user; verifying the first identity signature in the authentication string according to the identity cryptographic algorithm public key of the first user, and verifying the post-quantum signature in the authentication string according to the post-quantum digital signature algorithm public key of the first user, and determining that the identity authentication of the first user is successful after both verifications are passed.

[0006] In one embodiment of the present disclosure, after determining that the identity authentication of the first user is successful, the method further comprises: receiving a public key query request sent by the first user, wherein the public key query request carries an identity cryptographic algorithm public key of a second user that needs to be queried; querying a post-quantum digital signature algorithm public key and / or a post-quantum key encapsulation algorithm public key of the second user based on the identity cryptographic algorithm public key of the second user; performing an identity cryptographic algorithm digital signature operation and a post-quantum digital signature operation on second signature data composed of the identity cryptographic algorithm public key, the post-quantum digital signature algorithm public key, and / or the post-quantum key encapsulation algorithm public key of the second user in sequence to obtain a first double signature; and sending the second signature data and the first double signature to the first user.

[0007] In one embodiment of the present disclosure, after determining that the identity authentication of the first user is successful, the method further comprises: receiving third signature data and a second identity signature sent by the first user, wherein the third signature data comprises a post-quantum digital signature algorithm public key and / or a post-quantum key encapsulation algorithm public key, and the second identity signature is obtained by performing an identity cryptography algorithm digital signature operation on the third signature data; calculating an identity cryptography algorithm public key of the first user based on a user identifier of the first user; verifying the second identity signature according to the identity cryptography algorithm public key of the first user, and after verification, updating the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key of the first user in the key information table.

[0008] In one embodiment of the present disclosure, after determining that the identity authentication of the first user is successful, the method further comprises: receiving third signature data and a second dual signature sent by the first user, wherein the third signature data comprises a post-quantum digital signature algorithm public key and / or a post-quantum key encapsulation algorithm public key, and the second dual signature is obtained by sequentially performing an identity cryptography algorithm digital signature operation and a post-quantum digital signature operation on the third signature data; calculating an identity cryptography algorithm public key of the first user based on a user identifier of the first user, and querying the post-quantum digital signature algorithm public key of the first user based on the identity cryptography algorithm public key of the first user; verifying the second dual signature according to the identity cryptography algorithm public key and the post-quantum digital signature algorithm public key of the first user, and after verification, updating the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key of the first user in the key information table.

[0009] According to another aspect of the present disclosure, there is provided an identity processing method applied to a first user side, comprising: obtaining a center identifier of a post-quantum cryptography public key management center, and using a current timestamp and the center identifier to form first signature data; performing an identity cryptography algorithm digital signature operation and a post-quantum digital signature operation on the first signature data respectively to generate a first identity signature and a post-quantum signature; forming an authentication string by combining the first signature data, the first identity signature and the post-quantum signature, and sending the authentication string to the post-quantum cryptography public key management center for identity authentication.

[0010] In one embodiment of the present disclosure, after determining that the identity authentication is successful, the method further comprises: after sending the public key query request for querying the identity cryptography algorithm public key of the second user to the post-quantum cryptography public key management center, receiving the second signature data and the first double signature fed back by the post-quantum cryptography public key management center, wherein the second signature data comprises the identity cryptography algorithm public key of the second user, the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key, and the first double signature is obtained by sequentially performing the identity cryptography algorithm digital signature operation and the post-quantum digital signature operation on the second signature data; obtaining the identity cryptography algorithm public key and the post-quantum digital signature algorithm public key of the post-quantum cryptography public key management center; sequentially verifying the first double signature according to the identity cryptography algorithm public key and the post-quantum digital signature algorithm public key of the post-quantum cryptography public key management center, and obtaining the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key of the second user after verification.

[0011] In one embodiment of the present disclosure, after determining that the identity authentication is successful, the method further comprises: using the current timestamp, the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key to form third signature data; performing the identity cryptography algorithm digital signature operation on the third signature data to generate a second identity signature; and sending the third signature data and the second identity signature to the post-quantum cryptography public key management center to update the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key in the key information table of the post-quantum cryptography public key management center.

[0012] In one embodiment of the present disclosure, after determining that the identity authentication is successful, the method further comprises: using the current timestamp, the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key to form third signature data; performing the identity cryptography algorithm digital signature operation and the post-quantum digital signature operation on the third signature data in sequence to generate a second double signature; and sending the third signature data and the second double signature to the post-quantum cryptography public key management center to update the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key in the key information table of the post-quantum cryptography public key management center.

[0013] According to still another aspect of the present disclosure, there is provided an identity processing apparatus applied to a public key management center side, comprising: a receiving module configured to receive an authentication string sent by a first user for identity authentication, wherein the authentication string comprises first signature data, a first identity signature, and a post-quantum signature, the first identity signature and the post-quantum signature being obtained by performing an identity cryptographic algorithm digital signature operation and a post-quantum digital signature operation on the first signature data respectively; a calculating module configured to calculate an identity cryptographic algorithm public key of the first user based on a user identifier of the first user; a querying module configured to query a post-quantum digital signature algorithm public key of the first user based on the identity cryptographic algorithm public key of the first user; and a signature verification module configured to verify the first identity signature in the authentication string according to the identity cryptographic algorithm public key of the first user, and verify the post-quantum signature in the authentication string according to the post-quantum digital signature algorithm public key of the first user, and determine that the identity authentication of the first user is successful if both verifications are passed.

[0014] According to still another aspect of the present disclosure, there is provided an identity processing apparatus applied to a first user side, comprising: an obtaining module configured to obtain a center identifier of a post-quantum cryptographic public key management center, and use a current timestamp and the center identifier to form first signature data; a signing module configured to perform an identity cryptographic algorithm digital signature operation and a post-quantum digital signature operation on the first signature data respectively to generate a first identity signature and a post-quantum signature; and a sending module configured to form an authentication string by combining the first signature data, the first identity signature, and the post-quantum signature, and send the authentication string to the post-quantum cryptographic public key management center for identity authentication.

[0015] According to still another aspect of the present disclosure, there is provided an electronic device, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any of the above identity processing methods via execution of the executable instructions.

[0016] According to still another aspect of the present disclosure, there is provided a computer readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement any of the above identity processing methods.

[0017] In the embodiments of the present disclosure, the identity cryptographic algorithm public key of the first user is calculated based on the user identifier, the post-quantum digital signature algorithm public key of the first user is queried based on the identity cryptographic algorithm public key, the first identity signature is verified according to the identity cryptographic algorithm public key, the post-quantum signature in the authentication string is verified according to the post-quantum digital signature algorithm public key, and the identity authentication of the first user is determined to be successful if both verifications are passed. Through the above technical means, the problem that the identity processing is affected by quantum algorithms in the prior art, resulting in that the security of identity processing cannot be guaranteed, is solved, and the user data is double signed, thereby guaranteeing the communication security.

[0018] It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings, which are incorporated in and form a part of the specification, illustrate one embodiment of the present disclosure and, together with the description, serve to explain the principles of the present disclosure. It is appreciated that the drawings described below are only some embodiments of the present disclosure, and other drawings can be obtained by those of ordinary skill in the art without creative effort on the basis of these drawings.

[0020] Figure 1 A schematic diagram showing an identity processing system architecture in an embodiment of the present disclosure.

[0021] Figure 2 A flowchart showing an identity processing method in an embodiment of the present disclosure.

[0022] Figure 3 A flowchart showing a user public key query method in an embodiment of the present disclosure.

[0023] Figure 4 A flowchart showing a user public key update method in an embodiment of the present disclosure.

[0024] Figure 5 A flowchart showing another identity processing method in an embodiment of the present disclosure.

[0025] Figure 6 A flowchart showing another user public key query method in an embodiment of the present disclosure.

[0026] Figure 7 A flowchart showing another user public key update method in an embodiment of the present disclosure.

[0027] Figure 8 A schematic diagram showing an identity processing apparatus in an embodiment of the present disclosure.

[0028] Figure 9 A schematic diagram showing another identity processing apparatus in an embodiment of the present disclosure.

[0029] Figure 10 A schematic diagram showing an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0031] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0032] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0033] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0034] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0035] It should be noted that, unless otherwise specified, the embodiments of this disclosure and the technical features thereof can be combined with each other.

[0036] To facilitate understanding, the following is an explanation of several terms used in this disclosure:

[0037] Identity-Based Cryptography (IBC): IBC is an identity-based cryptography system. In the traditional public key cryptography system, the user's public key is a string of random numbers, and the correspondence between the public key and the user's identity needs to be verified through digital certificates and other means. In IBC, the user's public key can be directly generated from the user's identity (such as an email address, an identity card number, etc.), and the private key is generated by the key / private key generator (PKG) according to the system master key and the user's identity and securely distributed to the user.

[0038] Post-Quantum cryptography (PQC) is a new generation of cryptographic algorithm that can resist quantum computing attacks on existing cryptographic algorithms, and can ensure the security of the cryptographic algorithm in a quantum environment.

[0039] Digital Signature: Digital signature is a method of verifying the authenticity and integrity of electronic documents using asymmetric encryption technology.

[0040] The digital signature in the identity-based cryptography algorithm is denoted as an identity-based cryptography digital signature operation, and the public key used is denoted as an identity-based cryptography public key. The digital signature in the post-quantum cryptography algorithm is denoted as a post-quantum digital signature operation, and the public key used is denoted as a post-quantum digital signature algorithm public key. The post-quantum cryptography algorithm also has a post-quantum key encapsulation algorithm public key, which is used to encrypt the session.

[0041] The specific implementation of the embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0042] Figure 1 A schematic diagram showing the structure of an identity processing system in an embodiment of the present disclosure, which can apply the identity processing method or identity processing apparatus in various embodiments of the present disclosure.

[0043] As Figure 1 shown, the system architecture can include a user 101 and a public key management center 102. The user 101 can be various electronic devices, including but not limited to mobile phones, computers, and tablets, etc., and the public key management center 102 can be various servers. The user 101 can perform identity authentication, query other users' public keys, and update his own public key, etc. in the public key management center 102.

[0044] Figure 2 A flowchart showing an identity processing method in an embodiment of the present disclosure, which is applied to the public key management center side, as Figure 2 shown, the method includes the following steps:

[0045] S201, receiving an authentication string sent by a first user for identity authentication, wherein the authentication string comprises first signature data, a first identity signature, and a post-quantum signature, the first identity signature and the post-quantum signature being obtained by performing an identity-based cryptography algorithm digital signature operation and a post-quantum digital signature operation on the first signature data, respectively;

[0046] S202, calculating an identity-based cryptography algorithm public key of the first user based on a user identifier of the first user;

[0047] S203, querying a post-quantum digital signature algorithm public key of the first user based on the identity-based cryptography algorithm public key of the first user;

[0048] S204, verifying the first identity signature in the authentication string according to the identity-based cryptography algorithm public key of the first user, verifying the post-quantum signature in the authentication string according to the post-quantum digital signature algorithm public key of the first user, and determining that the identity authentication of the first user is successful if both verifications are passed.

[0049] Based on the user identifier of the first user, the identity-based cryptography algorithm public key of the first user is calculated. In the public key management center, a key information table is maintained to store the correspondence between the identity-based cryptography algorithm public key and the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key. Based on the identity-based cryptography algorithm public key of the first user, the post-quantum digital signature algorithm public key of the first user is queried in the key information table.

[0050] Then, the first identity signature in the authentication string is verified according to the identity-based cryptography algorithm public key of the first user, and if the data in the verified first identity signature is the same as the first signature data, it is determined that the current verification is passed. The post-quantum signature in the authentication string is verified according to the post-quantum digital signature algorithm public key of the first user, and if the data in the verified post-quantum signature is the same as the first signature data, it is determined that the current verification is passed. After both verifications are passed, it is determined that the identity authentication of the first user in the public key management center is completed. If one of the verifications fails, it is determined that the identity authentication fails.

[0051] According to the technical scheme provided by the embodiment of the present disclosure, the authentication string sent by the first user for identity authentication is received, wherein the authentication string includes first signature data, a first identity signature, and a post-quantum signature, the first identity signature and the post-quantum signature are obtained by performing identity password algorithm digital signature operation and post-quantum digital signature operation on the first signature data respectively; the identity password algorithm public key of the first user is calculated based on the user identifier of the first user; the post-quantum digital signature algorithm public key of the first user is queried based on the identity password algorithm public key of the first user; the first identity signature in the authentication string is verified according to the identity password algorithm public key of the first user, and the post-quantum signature in the authentication string is verified according to the post-quantum digital signature algorithm public key of the first user, and the identity authentication of the first user is determined to be successful after both verifications are passed. Through the above technical means, the problem that the identity processing is affected by the quantum algorithm in the prior art, resulting in that the security of the identity processing cannot be guaranteed, is solved, and then the user data is double signed to guarantee the communication security.

[0052] In an optional embodiment, the first signature data includes a timestamp and a center identifier. The timestamp and the center identifier in the first signature data are verified, and after the verification is passed, the identity password algorithm public key of the first user is calculated based on the user identifier of the first user. If the verification is not passed, it can be directly confirmed that the identity authentication fails.

[0053] When the timestamp is in a preset range, it is confirmed that the timestamp verification is passed. When the center identifier in the first signature data is consistent with the center identifier of the public key management center, it is confirmed that the center identifier verification is passed. Through the above technical means, the efficiency of the identity authentication can be improved, and resource waste can be avoided.

[0054] Figure 3 A flowchart of a user public key query method in an embodiment of the present disclosure is shown, the method is applied to the public key management center side, as shown in Figure 3 The method includes the following steps:

[0055] S301, receiving a public key query request sent by a first user, wherein the public key query request carries an identity password algorithm public key of a second user that needs to be queried;

[0056] S302, querying the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key of the second user based on the identity password algorithm public key of the second user;

[0057] S303, performing identity password algorithm digital signature operation and post-quantum digital signature operation on second signature data composed of the identity password algorithm public key, the post-quantum digital signature algorithm public key, and / or the post-quantum key encapsulation algorithm public key of the second user in sequence to obtain a first double signature;

[0058] S304, sending the second signature data and the first double signature to the first user.

[0059] After receiving the public key query request sent by the first user, the identity password algorithm public key of the second user to be queried is identified from the public key query request, and the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key of the second user are queried in the key information table based on the identity password algorithm public key of the second user. The second signature data composed of the identity password algorithm public key, the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key of the second user is used, and the identity password algorithm digital signature operation and the post-quantum digital signature operation are sequentially performed on the second signature data to obtain the first double signature. Finally, the second signature data and the first double signature are sent to the first user together. After the first user verifies the signature, the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key of the second user can be obtained. Through the above technical means, the embodiment of the disclosure avoids the influence of quantum algorithms on communication security and protects the user public key from being leaked in the query process.

[0060] Figure 4 A flowchart of a user public key updating method in an embodiment of the disclosure is shown, which is applied to the public key management center side, as shown in Figure 4 The method includes the following steps:

[0061] S401, receiving third signature data and a second identity signature sent by a first user, wherein the third signature data includes a post-quantum digital signature algorithm public key and / or a post-quantum key encapsulation algorithm public key, and the second identity signature is obtained by performing an identity password algorithm digital signature operation on the third signature data;

[0062] S402, calculating an identity password algorithm public key of the first user based on a user identifier of the first user;

[0063] S403, verifying the second identity signature according to the identity password algorithm public key of the first user, and updating the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key of the first user in the key information table after the verification is passed.

[0064] Based on the user identifier of the first user, the identity password algorithm public key of the first user is calculated using the identity password algorithm. The second identity signature is verified according to the identity password algorithm public key of the first user, and if the data in the second identity signature obtained by the verification is the same as the third signature data, it is determined that the verification is passed. After the verification is passed, the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key in the third signature data are used to update the public key of the first user in the key information table. Through the above technical means, the embodiment of the disclosure can quickly update the user public key and improve the efficiency.

[0065] In an optional embodiment, the third signature data includes a timestamp. The timestamp in the third signature data is verified; after verification, the identity password algorithm public key of the first user is calculated based on the user identifier of the first user. If the verification fails, it can be directly confirmed that the update of the user public key fails. The technical means described above can improve the efficiency of updating the user public key.

[0066] In an embodiment of the present disclosure, after determining that the identity authentication of the first user is successful, the method further includes: receiving third signature data and a second double signature sent by the first user, wherein the third signature data includes a post-quantum digital signature algorithm public key and / or a post-quantum key encapsulation algorithm public key, and the second double signature is obtained by sequentially performing an identity password algorithm digital signature operation and a post-quantum digital signature operation on the third signature data; calculating the identity password algorithm public key of the first user based on the user identifier of the first user, and querying the post-quantum digital signature algorithm public key of the first user based on the identity password algorithm public key of the first user; verifying the second double signature according to the identity password algorithm public key and the post-quantum digital signature algorithm public key of the first user, and after verification, updating the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key of the first user in the key information table.

[0067] In order to avoid the influence of quantum algorithms on communication security and protect the user public key from being leaked, the first user sequentially performs an identity password algorithm digital signature operation and a post-quantum digital signature operation on the third signature data when updating the user public key. The corresponding public key management center verifies the second double signature sent by the first user according to the identity password algorithm public key and the post-quantum digital signature algorithm public key of the first user.

[0068] Figure 5 A flowchart of an identity processing method in an embodiment of the present disclosure is shown, which is applied to the first user side, as shown in Figure 5 The method includes the following steps:

[0069] S501, obtaining the center identifier of the post-quantum password public key management center, and using the current timestamp and the center identifier to form first signature data;

[0070] S502, performing an identity password algorithm digital signature operation and a post-quantum digital signature operation on the first signature data respectively to generate a first identity signature and a post-quantum signature;

[0071] S503, forming an authentication string by combining the first signature data, the first identity signature and the post-quantum signature, and sending it to the post-quantum password public key management center for identity authentication.

[0072] The first user uses the identity signature private key of the first user to perform an identity cryptographic algorithm digital signature operation on the first signature data, to obtain a first identity signature, and uses the post-quantum signature private key of the first user to perform a post-quantum digital signature operation on the first signature data, to obtain a post-quantum signature. Then, the first signature data, the first identity signature, and the post-quantum signature are combined to form an authentication string, and the authentication string is sent to the post-quantum cryptographic public key management center, and the post-quantum cryptographic public key management center performs identity authentication on the first user based on the authentication string.

[0073] According to the technical scheme provided in the embodiments of the present disclosure, an authentication string sent by a first user for identity authentication is received, wherein the authentication string includes first signature data, a first identity signature, and a post-quantum signature, the first identity signature and the post-quantum signature are obtained by performing an identity cryptographic algorithm digital signature operation and a post-quantum digital signature operation on the first signature data, respectively; an identity cryptographic algorithm public key of the first user is calculated based on a user identifier of the first user; and a post-quantum digital signature algorithm public key of the first user is queried based on the identity cryptographic algorithm public key of the first user. Through the above technical means, the problem that the quantum algorithm affects identity processing and causes the identity processing security to be not guaranteed in the prior art is solved, and then the user data is double signed to guarantee the communication security.

[0074] Figure 6 A flowchart of a user public key query method in an embodiment of the present disclosure is shown, the method is applied to a first user side, as shown in Figure 6 The method includes the following steps:

[0075] S601, after sending a public key query request for querying an identity cryptographic algorithm public key of a second user to a post-quantum cryptographic public key management center, receiving second signature data and a first double signature fed back by the post-quantum cryptographic public key management center, wherein the second signature data includes the identity cryptographic algorithm public key, a post-quantum digital signature algorithm public key, and / or a post-quantum key encapsulation algorithm public key of the second user, and the first double signature is obtained by sequentially performing an identity cryptographic algorithm digital signature operation and a post-quantum digital signature operation on the second signature data;

[0076] S602, obtaining the identity cryptographic algorithm public key and the post-quantum digital signature algorithm public key of the post-quantum cryptographic public key management center;

[0077] S603, sequentially verifying the first double signature based on the identity cryptographic algorithm public key and the post-quantum digital signature algorithm public key of the post-quantum cryptographic public key management center, and obtaining the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key of the second user after the verification is passed.

[0078] The identity password algorithm public key and the post-quantum digital signature algorithm public key of the post-quantum password public key management center are public, and the first user side can query the identity password algorithm public key and the post-quantum digital signature algorithm public key of the post-quantum password public key management center. The first double signature is verified according to the identity password algorithm public key of the post-quantum password public key management center, and a verification result is obtained, and then the verification result is verified according to the post-quantum digital signature algorithm public key of the post-quantum password public key management center, and if the data obtained by this verification is the same as the second signature data, it is confirmed that the verification is passed, and the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key of the second user are obtained. Through the above technical means, the embodiment of the disclosure avoids the influence of quantum algorithm on communication security, and protects the user public key from being leaked in the query process.

[0079] Figure 7 A flowchart of a user public key updating method in an embodiment of the disclosure is shown, and the method is applied to the first user side, as shown in Figure 7 The method comprises the following steps:

[0080] S701, the third signature data is composed of the current timestamp, the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key;

[0081] S702, the third signature data is subjected to an identity password algorithm digital signature operation to generate a second identity signature;

[0082] S703, the third signature data and the second identity signature are sent to the post-quantum password public key management center to update the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key in the key information table of the post-quantum password public key management center.

[0083] The first user uses the identity signature private key of itself to perform an identity password algorithm digital signature operation on the third signature data to obtain a second identity signature. Then the third signature data and the second identity signature are sent to the post-quantum password public key management center, and the post-quantum password public key management center updates the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key of the first user in the key information table based on the third signature data and the second identity signature. Through the above technical means, the embodiment of the disclosure can quickly update the user public key and improve the efficiency.

[0084] In one embodiment of the present disclosure, after determining that the identity authentication is successful, the method further comprises: composing third signature data using the current timestamp, the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key; performing, in sequence, an identity cryptography algorithm digital signature operation and a post-quantum digital signature operation on the third signature data to generate a second double signature; and sending the third signature data and the second double signature to the post-quantum cryptography public key management center to update the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key in the key information table of the post-quantum cryptography public key management center.

[0085] In order to avoid the influence of quantum algorithms on communication security and protect the user public key from being leaked, the first user performs, in sequence, an identity cryptography algorithm digital signature operation and a post-quantum digital signature operation on the third signature data when updating the user public key.

[0086] Through the above technical means, based on the PQC public key query function, users can:

[0087] Based on the PQC digital signature algorithm public key (post-quantum digital signature algorithm public key) of the other party, the PQC digital signature (post-quantum signature) of the other party is verified to achieve identity authentication or data integrity protection.

[0088] Based on the PQC key encapsulation algorithm public key of the other party, a symmetric key is shared with the other party, and then secure communication between the two parties is realized.

[0089] The IBC algorithm and the PQC algorithm can also be combined for use to realize various IBC and PQC hybrid schemes.

[0090] Based on the same inventive concept, the present disclosure further provides an identity processing apparatus, as follows. Since the principle of solving problems by the apparatus embodiment is similar to that of the above-mentioned method embodiment, the implementation of the apparatus embodiment can be referred to the implementation of the above-mentioned method embodiment, and the repeated parts will not be described herein.

[0091] Figure 8 A schematic diagram of an identity processing apparatus in an embodiment of the present disclosure is shown, which is applied to the public key management center side, as shown in the figure, the identity processing apparatus can comprise: Figure 8

[0092] The receiving module 801 is configured to receive an authentication string sent by a first user for identity authentication, wherein the authentication string comprises first signature data, a first identity signature and a post-quantum signature, the first identity signature and the post-quantum signature being obtained by performing an identity cryptography algorithm digital signature operation and a post-quantum digital signature operation on the first signature data, respectively;

[0093] The computing module 802 is configured to calculate an identity cryptography algorithm public key of the first user based on a user identity of the first user.​

[0094] The query module 803 is configured to query the post-quantum digital signature algorithm public key of the first user based on the identification password algorithm public key of the first user.

[0095] The signature verification module 804 is configured to verify the first identification signature in the authentication string according to the identification password algorithm public key of the first user, and verify the post-quantum signature in the authentication string according to the post-quantum digital signature algorithm public key of the first user. If both verifications are passed, it is determined that the identity authentication of the first user is successful.

[0096] According to the technical scheme provided by the embodiments of the present disclosure, the authentication string sent by the first user for identity authentication is received, wherein the authentication string includes first signature data, a first identification signature, and a post-quantum signature, the first identification signature and the post-quantum signature are obtained by performing identification password algorithm digital signature operation and post-quantum digital signature operation on the first signature data respectively; the identification password algorithm public key of the first user is calculated based on the user identification of the first user; the post-quantum digital signature algorithm public key of the first user is queried based on the identification password algorithm public key of the first user; the first identification signature in the authentication string is verified according to the identification password algorithm public key of the first user, and the post-quantum signature in the authentication string is verified according to the post-quantum digital signature algorithm public key of the first user. If both verifications are passed, it is determined that the identity authentication of the first user is successful. Through the above technical means, the problem that the quantum algorithm affects identity processing in the prior art, resulting in that the security of identity processing cannot be guaranteed, is solved, and then the user data is double signed to guarantee the communication security.

[0097] In one embodiment, the calculation module 802 is further configured to verify the timestamp and the center identification in the first signature data, and if the verification is passed, the identification password algorithm public key of the first user is calculated based on the user identification of the first user. If the verification is not passed, it can be directly confirmed that the identity authentication fails.

[0098] In one embodiment, the signature verification module 804 is further configured to receive the public key query request sent by the first user, wherein the public key query request carries the identification password algorithm public key of the second user which needs to be queried; the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key of the second user are queried based on the identification password algorithm public key of the second user; the second signature data composed of the identification password algorithm public key, the post-quantum digital signature algorithm public key, and / or the post-quantum key encapsulation algorithm public key of the second user is sequentially subjected to identification password algorithm digital signature operation and post-quantum digital signature operation to obtain a first double signature; and the second signature data and the first double signature are sent to the first user.

[0099] In an embodiment, the signature verification module 804 is further configured to receive third signature data and a second identity signature sent by the first user, wherein the third signature data comprises a post-quantum digital signature algorithm public key and / or a post-quantum key encapsulation algorithm public key, and the second identity signature is obtained by performing an identity cryptography algorithm digital signature operation on the third signature data; calculate an identity cryptography algorithm public key of the first user based on the user identifier of the first user; verify the second identity signature according to the identity cryptography algorithm public key of the first user, and if the verification is passed, update the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key of the first user in the key information table.

[0100] In an embodiment, the signature verification module 804 is further configured to verify the timestamp in the third signature data; if the verification is passed, calculate an identity cryptography algorithm public key of the first user based on the user identifier of the first user. If the verification is not passed, directly confirm that the update of the user public key fails. Through the above technical means, the embodiments of the present disclosure can improve the efficiency of updating the user public key.

[0101] In an embodiment, the signature verification module 804 is further configured to receive third signature data and a second double signature sent by the first user, wherein the third signature data comprises a post-quantum digital signature algorithm public key and / or a post-quantum key encapsulation algorithm public key, and the second double signature is obtained by sequentially performing an identity cryptography algorithm digital signature operation and a post-quantum digital signature operation on the third signature data; calculate an identity cryptography algorithm public key of the first user based on the user identifier of the first user, and query the post-quantum digital signature algorithm public key of the first user based on the identity cryptography algorithm public key of the first user; verify the second double signature according to the identity cryptography algorithm public key and the post-quantum digital signature algorithm public key of the first user, and if the verification is passed, update the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key of the first user in the key information table.

[0102] Figure 9 A schematic diagram of an identity processing apparatus in an embodiment of the present disclosure is shown, which is applied to a public key management center side. As shown in the figure, the identity processing apparatus can include: Figure 9

[0103] The acquisition module 901 is configured to acquire a center identifier of a post-quantum cryptography public key management center, and use a current timestamp and the center identifier to form first signature data;

[0104] The signature module 902 is configured to perform an identity cryptography algorithm digital signature operation and a post-quantum digital signature operation on the first signature data respectively, and generate a first identity signature and a post-quantum signature;

[0105] ​The sending module 903 is configured to compose an authentication string by the first signature data, the first identity signature, and the post-quantum signature, and send the authentication string to the post-quantum cryptographic public key management center for identity authentication.

[0106] According to the technical scheme provided by the embodiment of the present disclosure, the authentication string sent by the first user for identity authentication is received, wherein the authentication string includes first signature data, a first identity signature, and a post-quantum signature, the first identity signature and the post-quantum signature are obtained by performing identity cryptographic algorithm digital signature operation and post-quantum digital signature operation on the first signature data respectively; the identity cryptographic algorithm public key of the first user is calculated based on the user identifier of the first user; and the post-quantum digital signature algorithm public key of the first user is queried based on the identity cryptographic algorithm public key of the first user. Through the above technical means, the problem that the quantum algorithm affects identity processing and causes the identity processing security to be not guaranteed in the prior art is solved, and then the user data is double signed to guarantee the communication security.

[0107] In one embodiment, the sending module 903 is further configured to, after sending the public key query request for querying the identity cryptographic algorithm public key of the second user to the post-quantum cryptographic public key management center, receive the second signature data and the first double signature fed back by the post-quantum cryptographic public key management center, wherein the second signature data includes the identity cryptographic algorithm public key, the post-quantum digital signature algorithm public key, and / or the post-quantum key encapsulation algorithm public key of the second user, and the first double signature is obtained by sequentially performing identity cryptographic algorithm digital signature operation and post-quantum digital signature operation on the second signature data; S602, the identity cryptographic algorithm public key and the post-quantum digital signature algorithm public key of the post-quantum cryptographic public key management center are obtained; and S603, the first double signature is sequentially verified according to the identity cryptographic algorithm public key and the post-quantum digital signature algorithm public key of the post-quantum cryptographic public key management center, and the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key of the second user are obtained after the verification is passed.

[0108] In one embodiment, the sending module 903 is further configured to compose third signature data by using the current timestamp, the post-quantum digital signature algorithm public key, and / or the post-quantum key encapsulation algorithm public key; perform identity cryptographic algorithm digital signature operation on the third signature data to generate a second identity signature; and send the third signature data and the second identity signature to the post-quantum cryptographic public key management center to update the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key in the key information table of the post-quantum cryptographic public key management center.

[0109] In one embodiment, the sending module 903 is further configured to compose third signature data with the current timestamp, the post-quantum digital signature algorithm public key, and / or the post-quantum key encapsulation algorithm public key; perform, in sequence, an identity cryptographic algorithm digital signature operation and a post-quantum digital signature operation on the third signature data to generate a second double signature; and send the third signature data and the second double signature to the post-quantum cryptography public key management center to update the post-quantum digital signature algorithm public key and / or the post-quantum key encapsulation algorithm public key in the key information table of the post-quantum cryptography public key management center.

[0110] Those skilled in the art can understand that various aspects of the present disclosure can be implemented as a system, a method or a program product. Therefore, various aspects of the present disclosure can be embodied as a whole hardware implementation, a whole software implementation (including firmware, microcode, etc.), or an implementation combining hardware and software aspects, which can be collectively referred to as "circuitry", "module" or "system" herein.

[0111] The electronic device 1000 according to this embodiment of the present disclosure will be described below with reference to Figure 10 Figure 10 The displayed electronic device 1000 is merely an example and should not impose any limitation on the functions and use range of the embodiments of the present disclosure.

[0112] As shown in Figure 10 The electronic device 1000 is in the form of a general computing device. The components of the electronic device 1000 can include, but are not limited to, the above-mentioned at least one processing unit 1010, the above-mentioned at least one storage unit 1020, and a bus 1030 connecting different system components, including the storage unit 1020 and the processing unit 1010.

[0113] The storage unit stores program code that can be executed by the processing unit 1010, so that the processing unit 1010 performs the steps according to various exemplary embodiments of the present disclosure described in the above "Exemplary Method" section of the present specification. For example, the processing unit 1010 can perform the following steps of the above-mentioned method embodiments: receiving an authentication string sent by a first user for identity authentication; calculating an identity cryptographic algorithm public key of the first user based on a user identifier of the first user; querying a post-quantum digital signature algorithm public key of the first user based on the identity cryptographic algorithm public key of the first user; verifying a first identity signature in the authentication string according to the identity cryptographic algorithm public key of the first user, and verifying a post-quantum signature in the authentication string according to the post-quantum digital signature algorithm public key of the first user, and determining that the identity authentication of the first user is successful if both verifications are passed.

[0114] ​The storage unit 1020 can include a readable medium in the form of volatile storage such as random access memory (RAM) 10201 and / or cache memory 10202, and also can include a non-volatile storage such as read only memory (ROM) 10203.

[0115] The storage unit 1020 also can include a program / utility 10204 having a set (at least one) of program modules 10205, including an operating system, one or more application programs, other program modules, and program data, each of which can give the electronic device 1000 its functionality, or some combination thereof.

[0116] The bus 1030 can represent one or more of several types of bus structures, including a storage bus or bus controller, a peripheral bus, a graphics acceleration port, a processor or local bus using any of a variety of bus architectures.

[0117] The electronic device 1000 also can communicate with one or more external devices 1040 such as a keyboard or pointing device, a Bluetooth device, etc.; other devices that enable a user to interact with the electronic device 1000; and / or one or more devices that enable the electronic device 1000 to communicate with one or more other computing devices. Such communication can occur via an input / output (I / O) interface 1050. Still yet, the electronic device 1000 can communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and / or a public network (e.g., the Internet) via a network adapter 1060. As depicted, the network adapter 1060 can communicate with the other components of the electronic device 1000 via the bus 1030. It should be appreciated that although the network adapter 1060 is depicted as a single component, the network adapter 1060 can comprise two or more components that work together to facilitate communications with one or more other computing devices.

[0118] Those skilled in the art will readily appreciate that the example embodiments described herein can be implemented by software and / or firmware in addition to or instead of hardware. Thus, the technical solutions according to the embodiments of the present disclosure can be embodied in a software product including a number of instructions stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, or the like) or a network, and the software product can be executed by one or more computers (which can be personal computers, servers, terminal devices, or network devices) to implement the methods according to the embodiments of the present disclosure.

[0119] In the disclosed exemplary embodiments, a computer readable storage medium is also provided, which can be a readable signal medium or a readable storage medium.

[0120] In some possible implementation manners, various aspects of the present disclosure can also be implemented as a program product in the form of a computer readable storage medium, which includes program codes for causing the terminal device to perform the steps described in the above “specific implementation” section according to various exemplary embodiments of the present disclosure when the program product is run on the terminal device.

[0121] More specific examples of the computer readable storage medium in the present disclosure can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination of the foregoing.

[0122] In the present disclosure, the computer readable storage medium can include a data signal carried in the baseband or as a part of a carrier wave propagating through the program codes, in which the readable program codes are borne. Such a propagating data signal can take various forms, including but not limited to electro-magnetic signal, optical signal, or any appropriate combination of the foregoing. The readable signal medium can also be any readable medium other than the readable storage medium, which can send, propagate or transmit the program for use by or in connection with an instruction execution system, apparatus or device.

[0123] Optionally, the program codes contained in the computer readable storage medium can be transmitted by any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any appropriate combination of the foregoing.

[0124] In implementation, the program codes for performing the operations of the present disclosure can be written in any combination of one or more programming languages, including an object oriented programming language, such as Java, C++, etc., and a conventional procedural programming language, such as the “C” language or similar programming languages. The program codes can be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case involving a remote computing device, the remote computing device can be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, through the Internet by connecting to an Internet service provider).

[0125] The computer program product or computer program includes computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device executes the identity processing method provided in any of the embodiments of the present disclosure in various optional manners.

[0126] It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, such division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into a plurality of modules or units for embodiment.

[0127] In addition, although the various steps of the method in the present disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired result. In addition or alternatively, some steps can be omitted, a plurality of steps can be combined into one step, and / or one step can be divided into a plurality of steps, etc.

[0128] From the above description of the embodiments, those skilled in the art can easily understand that the example embodiments described herein can be implemented by software, or by software in combination with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or network, and includes several instructions to make a computing device (which can be a personal computer, server, mobile terminal, or network device, etc.) execute the method according to the embodiments of the present disclosure.

[0129] Other embodiments of the present disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. The present disclosure is intended to cover any variations, uses, or adaptations of the present disclosure following the general principles thereof and including such departures from the present disclosure that come within known, accepted, or customary practice in the art to which the present disclosure pertains. The specification and examples are to be regarded as exemplary only, and the true scope of the present disclosure is indicated by the appended claims.

Claims

1. An identity processing method, applied to a public key management center, characterized in that, include: The system receives an authentication string sent by a first user for identity authentication. The authentication string includes first signature data, a first identifier signature, and a post-quantum signature. The first identifier signature and the post-quantum signature are obtained by performing an identifier cryptographic algorithm digital signature operation and a post-quantum digital signature operation on the first signature data, respectively. Calculate the public key of the first user's identifier cryptography algorithm based on the first user's user identifier; Query the first user's post-quantum digital signature algorithm public key based on the first user's identifier cryptographic algorithm public key; The first identifier signature in the authentication string is verified using the first user's identifier cryptographic algorithm public key, and the post-quantum digital signature in the authentication string is verified using the first user's post-quantum digital signature algorithm public key. After both verifications are successful, the first user's identity authentication is confirmed to be successful. After confirming successful authentication of the first user, the method further includes: receiving a public key query request sent by the first user, wherein the public key query request carries the identifier cryptographic algorithm public key of the second user to be queried; querying the second user's post-quantum digital signature algorithm public key and / or post-quantum key encapsulation algorithm public key based on the second user's identifier cryptographic algorithm public key; sequentially performing the identifier cryptographic algorithm digital signature operation and the post-quantum digital signature operation on the second signature data composed of the second user's identifier cryptographic algorithm public key, post-quantum digital signature algorithm public key and / or post-quantum key encapsulation algorithm public key to obtain a first double signature; and sending the second signature data and the first double signature to the first user.

2. The method according to claim 1, characterized in that, After confirming that the first user's identity authentication is successful, the method further includes: The system receives third signature data and second identifier signature sent by the first user, wherein the third signature data includes a public key for a post-quantum digital signature algorithm and / or a public key for a post-quantum key encapsulation algorithm, and the second identifier signature is obtained by performing the identifier cryptography algorithm digital signature operation on the third signature data; Calculate the public key of the first user's identifier cryptography algorithm based on the first user's user identifier; The second identifier signature is verified using the first user's identifier cryptographic algorithm public key. After successful verification, the first user's post-quantum digital signature algorithm public key and / or post-quantum key encapsulation algorithm public key are updated in the key information table.

3. The method according to claim 1, characterized in that, After confirming that the first user's identity authentication is successful, the method further includes: The system receives third signature data and a second double signature sent by the first user, wherein the third signature data includes a public key for a post-quantum digital signature algorithm and / or a public key for a post-quantum key encapsulation algorithm, and the second double signature is obtained by sequentially performing the digital signature operation of the identifier cryptography algorithm and the post-quantum digital signature operation on the third signature data; Calculate the first user's identifier cryptographic algorithm public key based on the first user's user identifier, and query the first user's post-quantum digital signature algorithm public key based on the first user's identifier cryptographic algorithm public key; The second double signature is verified based on the first user's identifier cryptographic algorithm public key and post-quantum digital signature algorithm public key. After successful verification, the first user's post-quantum digital signature algorithm public key and / or post-quantum key encapsulation algorithm public key are updated in the key information table.

4. An identity processing method, applied to a first user side, characterized in that, include: Obtain the central identifier of the quantum cryptography public key management center, and use the current timestamp and the central identifier to form the first signature data; Perform digital signature operations using an identifier cryptography algorithm and a post-quantum digital signature operation on the first signature data to generate a first identifier signature and a post-quantum signature. The first signature data, the first identifier signature, and the post-quantum signature are combined to form an authentication string, which is then sent to the post-quantum cryptography public key management center for identity authentication. After successful identity authentication, the method further includes: sending a public key query request to the post-quantum cryptography public key management center to query the public key of the second user's identifier cryptography algorithm; receiving second signature data and a first double signature from the post-quantum cryptography public key management center; wherein the second signature data includes the second user's identifier cryptography algorithm public key, post-quantum digital signature algorithm public key, and / or post-quantum key encapsulation algorithm public key; and the first double signature is obtained by sequentially performing the identifier cryptography algorithm digital signature operation and the post-quantum digital signature operation on the second signature data; obtaining the identifier cryptography algorithm public key and the post-quantum digital signature algorithm public key from the post-quantum cryptography public key management center; and sequentially verifying the first double signature based on the identifier cryptography algorithm public key and the post-quantum digital signature algorithm public key from the post-quantum cryptography public key management center; and upon successful verification, obtaining the second user's post-quantum digital signature algorithm public key and / or post-quantum key encapsulation algorithm public key.

5. The method according to claim 4, characterized in that, After confirming successful identity authentication, the method further includes: The third signature data is composed using the current timestamp, the public key of the post-quantum digital signature algorithm, and / or the public key of the post-quantum key encapsulation algorithm. Perform a digital signature operation using an identifier cryptography algorithm on the third signature data to generate a second identifier signature; The third signature data and the second identifier signature are sent to the post-quantum cryptography public key management center to update the post-quantum digital signature algorithm public key and / or post-quantum key encapsulation algorithm public key in the key information table of the post-quantum cryptography public key management center.

6. The method according to claim 4, characterized in that, After confirming successful identity authentication, the method further includes: The third signature data is composed using the current timestamp, the public key of the post-quantum digital signature algorithm, and / or the public key of the post-quantum key encapsulation algorithm. The third signature data is subjected to the digital signature operation of the identification cryptography algorithm and the post-quantum digital signature operation in sequence to generate a second double signature; The third signature data and the second double signature are sent to the post-quantum cryptography public key management center to update the post-quantum digital signature algorithm public key and / or post-quantum key encapsulation algorithm public key in the key information table of the post-quantum cryptography public key management center.

7. An identity processing device, applied to a public key management center, characterized in that, include: The receiving module is configured to receive an authentication string sent by a first user for identity authentication, wherein the authentication string includes first signature data, a first identifier signature, and a post-quantum signature, and the first identifier signature and the post-quantum signature are obtained by performing an identifier cryptographic algorithm digital signature operation and a post-quantum digital signature operation on the first signature data, respectively. The calculation module is configured to calculate the public key of the first user's identifier cryptography algorithm based on the first user's user identifier; The query module is configured to query the first user's post-quantum digital signature algorithm public key based on the first user's identifier cryptographic algorithm public key; The signature verification module is configured to verify the first identifier signature in the authentication string based on the first user's identifier cryptographic algorithm public key, and to verify the post-quantum signature in the authentication string based on the first user's post-quantum digital signature algorithm public key. After both verifications are successful, the first user's identity authentication is confirmed to be successful. The signature verification module is further configured to receive a public key query request sent by the first user, wherein the public key query request carries the identifier cryptographic algorithm public key of the second user to be queried; query the second user's post-quantum digital signature algorithm public key and / or post-quantum key encapsulation algorithm public key based on the second user's identifier cryptographic algorithm public key; sequentially perform the identifier cryptographic algorithm digital signature operation and the post-quantum digital signature operation on the second signature data composed of the second user's identifier cryptographic algorithm public key, post-quantum digital signature algorithm public key and / or post-quantum key encapsulation algorithm public key to obtain a first double signature; and send the second signature data and the first double signature to the first user.

8. An identity processing device, applied to a first user side, characterized in that, include: The acquisition module is configured to acquire the central identifier of the quantum cryptography public key management center and use the current timestamp and the central identifier to form the first signature data; The signature module is configured to perform an identifier cryptographic algorithm digital signature operation and a post-quantum digital signature operation on the first signature data respectively, to generate a first identifier signature and a post-quantum signature; The sending module is configured to combine the first signature data, the first identifier signature, and the post-quantum signature into an authentication string and send it to the post-quantum cryptography public key management center for identity authentication. The sending module is further configured to send a public key query request to the post-quantum cryptography public key management center regarding the query of the second user's identifier cryptographic algorithm public key, and then receive second signature data and a first double signature from the post-quantum cryptography public key management center. The second signature data includes the second user's identifier cryptographic algorithm public key, post-quantum digital signature algorithm public key, and / or post-quantum key encapsulation algorithm public key. The first double signature is obtained by sequentially performing the identifier cryptographic algorithm digital signature operation and the post-quantum digital signature operation on the second signature data. The module then obtains the identifier cryptographic algorithm public key and the post-quantum digital signature algorithm public key from the post-quantum cryptography public key management center. Finally, the module verifies the first double signature sequentially based on the identifier cryptographic algorithm public key and the post-quantum digital signature algorithm public key from the post-quantum cryptography public key management center. Upon successful verification, the module obtains the second user's post-quantum digital signature algorithm public key and / or post-quantum key encapsulation algorithm public key.

Images