Implementation of extensible cryptographic network protocol and password algorithm negotiation method, system, device and medium

Abstract

The application provides an implementation of an extensible encryption network protocol and a cryptographic algorithm negotiation method, system, device and medium, and relates to the technical field of information security. The method comprises the following steps: obtaining an algorithm calling request of an application layer; calling a uniform program interface of an algorithm compatibility layer according to information of a to-be-called cryptographic algorithm; using the uniform program interface to initiate a query request of the to-be-called cryptographic algorithm to a providing program interface through a core program interface in the algorithm compatibility layer; using the providing program interface to query a calling method of the to-be-called cryptographic algorithm from a preset cryptographic algorithm list based on the query request of the to-be-called cryptographic algorithm; and using the providing program interface to call the to-be-called cryptographic algorithm in a post-quantum cryptographic algorithm library in an extensible layer. The application calls a new cryptographic algorithm in the post-quantum cryptographic algorithm library, thereby improving the expansibility of the cryptographic algorithm and the ability to resist quantum algorithm attacks.

Description

Technical Field

[0001] This application relates to the field of information security technology, and more specifically, to an implementation of a scalable encrypted network protocol and a method, system, device, and medium for cryptographic algorithm negotiation. Background Technology

[0002] SSH (Secure Shell) is a network security protocol primarily used to provide encrypted remote login and data transmission services between clients and servers in insecure network environments. As a crucial protocol for remote login and data transmission, the security of SSH is essential for network communication.

[0003] Post-quantum SSH protocols refer to protocols that introduce post-quantum cryptographic algorithms into the SSH protocol to enhance its resistance to quantum computing attacks. However, post-quantum SSH protocols have significant drawbacks. Current post-quantum SSH protocol schemes generally adopt a single, fixed algorithm structure design, making it difficult to flexibly adjust the types of algorithms and protocol parameters according to actual needs. This makes them unable to adapt to rapidly changing security requirements and new application scenarios, and they also pose a risk of being breached by quantum algorithms. Summary of the Invention

[0004] This application addresses the shortcomings of the prior art by providing an implementation of a scalable encrypted network protocol and a method, system, device, and medium for cryptographic algorithm negotiation, in order to solve the problems existing in the prior art.

[0005] The technical solution adopted in the embodiments of this application is as follows: In a first aspect, embodiments of this application provide a method for implementing an extensible encrypted network protocol, applied to a client or server, the method comprising: Obtain the application layer algorithm call request, wherein the algorithm call request includes: information about the cryptographic algorithm to be called; Based on the information of the cryptographic algorithm to be invoked, the unified program interface of the algorithm compatibility layer is invoked; Using the unified program interface, a query request for the cryptographic algorithm to be invoked is initiated to the providing program interface through the core program interface in the algorithm compatibility layer; Using the provided program interface, based on the query request for the cryptographic algorithm to be invoked, the calling method of the cryptographic algorithm to be invoked is queried from the preset cryptographic algorithm list; Using the provided program interface, the cryptographic algorithm to be invoked is loaded and invoked according to the invocation method of the cryptographic algorithm to be invoked in the post-quantum cryptographic algorithm library in the extensible layer. The post-quantum cryptographic algorithm library includes at least two post-quantum cryptographic algorithms.

[0006] In one embodiment, the method further includes: The newly added post-quantum cryptographic algorithms in the post-quantum cryptographic algorithm library are encapsulated into the unified program interface using the cryptographic interface encapsulation module in the extensible layer. The registration intermediate module in the extensible layer is used to generate the calling method for the newly added quantum cryptography algorithm; The registration module in the extensible layer is used to register the calling method of the newly added quantum cryptography algorithm to the preset cryptography algorithm list.

[0007] In one embodiment, the at least two post-quantum cryptography algorithms include: a domestically developed post-quantum cryptography algorithm and an internationally recognized post-quantum cryptography algorithm, wherein the domestically developed post-quantum cryptography algorithm includes: a domestically developed post-quantum encryption algorithm, a domestically developed post-quantum decryption algorithm, and a domestically developed post-quantum encapsulation algorithm.

[0008] Secondly, embodiments of this application also provide a cryptographic algorithm negotiation method, applied to a client, the method comprising: A cryptographic algorithm negotiation request is initiated to the server; the cryptographic algorithm negotiation request includes: a first list of cryptographic algorithms supported by the client; the cryptographic algorithm negotiation request is used to enable the server to negotiate cryptographic algorithms based on the first list of cryptographic algorithms and a second list of cryptographic algorithms supported by the server, to obtain a target list of cryptographic algorithms; The server receives the target cryptographic algorithm list sent by the server, so that the server executes the implementation method of the extensible encrypted network protocol described in any of the above embodiments based on the target cryptographic algorithm list.

[0009] In one embodiment, before initiating the cryptographic algorithm negotiation request to the server, the method further includes: Add the first newly added cryptographic algorithm to the first cryptographic algorithm list.

[0010] Thirdly, this application also provides a cryptographic algorithm negotiation method, applied to a server, the method comprising: Receive a cryptographic algorithm negotiation request sent by a client; the cryptographic algorithm negotiation request includes: a first list of cryptographic algorithms supported by the client; Based on the first list of cryptographic algorithms and the second list of cryptographic algorithms supported by the server, a cryptographic algorithm negotiation is performed to obtain the target list of cryptographic algorithms; The target cryptographic algorithm list is sent to the client so that the client executes the implementation method of the extensible encrypted network protocol described in any of the above embodiments based on the target cryptographic algorithm list.

[0011] In one embodiment, before receiving the cryptographic algorithm negotiation request sent by the client, the method further includes: Add the second new cryptographic algorithm to the second cryptographic algorithm list.

[0012] Fourthly, embodiments of this application also provide a scalable encrypted network protocol system, including: an application layer, a quantum-resistant encrypted network protocol layer, an algorithm compatibility layer, and a scalable layer; the algorithm compatibility layer is pre-integrated with a unified program interface, a core program interface, and a provider program interface; the scalable layer is configured with a post-quantum cryptography algorithm library; The application layer is used to send algorithm call requests to the quantum-resistant encryption network protocol layer; The quantum-resistant encryption network protocol layer is used to implement the scalable encryption network protocol implementation method described in any of the above embodiments.

[0013] Fifthly, embodiments of this application also provide an electronic device, including: a processor, a storage medium, and a bus. The storage medium stores program instructions executable by the processor. When the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the program instructions to implement the scalable encrypted network protocol implementation method described in any of the above embodiments.

[0014] Sixthly, embodiments of this application also provide a readable storage medium storing program instructions, which, when executed by a processor, implement the implementation method of the scalable encrypted network protocol described in any of the above embodiments.

[0015] The beneficial effects of this application are as follows: This application provides a method for implementing an extensible encrypted network protocol, comprising: obtaining an algorithm invocation request from the application layer, the algorithm invocation request including information about the cryptographic algorithm to be invoked; invoking a unified program interface of the algorithm compatibility layer according to the information about the cryptographic algorithm to be invoked; using the unified program interface, initiating a query request for the cryptographic algorithm to be invoked to a provider interface through a core program interface in the algorithm compatibility layer; using the provider interface, querying a calling method for the cryptographic algorithm to be invoked from a preset cryptographic algorithm list based on the query request for the cryptographic algorithm to be invoked; using the provider interface, loading and invoking the cryptographic algorithm to be invoked in a post-quantum cryptographic algorithm library in the extensible layer according to the calling method of the cryptographic algorithm to be invoked, the post-quantum cryptographic algorithm library including at least two post-quantum cryptographic algorithms.

[0016] This method is closely integrated with a scalable encryption network protocol system. By leveraging the collaborative work of various interfaces, it simplifies the algorithm calling process, reduces the difficulty of application development, and enables efficient calling of various post-quantum cryptographic algorithms. This improves the system's adaptability to multiple post-quantum cryptographic algorithms, greatly enhances the scalability and security of cryptographic algorithms, and can effectively address the security challenges brought about by quantum computing. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram of the structure of an scalable encrypted network protocol system provided in an embodiment of this application; Figure 2 One of the flowcharts illustrating the implementation method of the extensible encrypted network protocol provided in the embodiments of this application; Figure 3 A second schematic flowchart illustrating the implementation method of the extensible encrypted network protocol provided in this application embodiment; Figure 4 One of the flowcharts illustrating the cryptographic algorithm negotiation method provided in this application embodiment; Figure 5 A second schematic flowchart illustrating the cryptographic algorithm negotiation method provided in this application embodiment; Figure 6 This is a schematic diagram of the remote login process provided in an embodiment of this application; Figure 7 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application; Figure 8 A schematic diagram of the structure of an implementation device for a scalable encrypted network protocol provided in an embodiment of this application; Figure 9 One of the schematic diagrams of the cryptographic algorithm negotiation device provided in the embodiments of this application; Figure 10 This is a second schematic diagram of the cryptographic algorithm negotiation device provided in the embodiments of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of this application, but not all embodiments.

[0020] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0021] Furthermore, the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Additionally, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0022] It should be noted that, where there is no conflict, the features in the embodiments of this application can be combined with each other.

[0023] Figure 1 This is a schematic diagram of the structure of the scalable encrypted network protocol system provided in the embodiments of this application, such as... Figure 1 As shown, this application provides a scalable encrypted network protocol system, including: an application layer, a quantum-resistant encrypted network protocol layer, an algorithm compatibility layer, and a scalable layer.

[0024] The algorithm compatibility layer pre-integrates a unified programming interface (Envelope API), a core programming interface (CoreInternal API), and a provider module API. The extensibility layer is configured with a post-quantum cryptography algorithm library, which stores at least two post-quantum cryptography algorithms. The functional implementation of each layer is explained below: 1. Application layer.

[0025] The application layer can be either a client-side application or a server-side application. Taking a client-side application as an example, when a user performs data transmission operations on the client, the client application will send an algorithm call request to the quantum-resistant encryption network protocol layer according to the data security requirements, specifying the required encryption, signing, and other cryptographic operation types and related parameters.

[0026] 2. Quantum-resistant encryption network protocol layer.

[0027] The quantum-resistant encryption network protocol layer is used to implement scalable encryption network protocols. Upon receiving an algorithm call request from the application layer, the quantum-resistant encryption network protocol layer first parses the request content to determine the required cryptographic operations and the corresponding post-quantum cryptographic algorithms. Then, it calls the corresponding post-quantum cryptographic algorithms through the Envelope API, the unified program interface of the algorithm compatibility layer, to encrypt and sign the data. During data transmission, the quantum-resistant encryption network protocol layer is also responsible for encapsulating, transmitting, and receiving the encrypted data according to specific network protocol specifications, and performing decryption and signature verification operations at the receiving end to ensure data integrity and security.

[0028] 3. Algorithm compatibility layer.

[0029] The Envelope API acts as a bridge between the application layer and the underlying cryptographic algorithms. By shielding the differences in underlying algorithm implementations, it provides unified management for operations such as encryption / decryption, signing, signature verification, and key derivation. For example, when the application layer needs to encrypt data, it only needs to send an encryption request to the Envelope API, without needing to know which post-quantum cryptography algorithm is used to complete the encryption operation, greatly simplifying the development difficulty and complexity of the application layer.

[0030] The Core Internal API primarily handles internal management functions and is not directly exposed to applications. It is mainly used to load and manage Provider Module APIs. When the system starts up or needs to invoke a new cryptographic algorithm, the Core Internal API accurately loads the corresponding Provider Module API based on system configuration and requirements, ensuring its proper functioning and functionality.

[0031] The Provider Module API (PPAPI) is a key interface for enabling the extensibility of cryptographic algorithms. It supports loading third-party cryptographic algorithms through post-quantum cryptography libraries. For example, various domestically developed post-quantum cryptographic algorithms such as Aigis-Enc and Aigis-Sig can be registered with the system by developers following the standard interface format and registration process specified by the PAPI. After successful registration, the Envelope API can call these registered post-quantum cryptographic algorithms to perform operations such as encryption and decryption of data, thereby effectively improving the extensibility of cryptographic algorithms.

[0032] 4. Extensible layer.

[0033] The extensible layer includes a post-quantum cryptography algorithm library, which stores at least two post-quantum cryptography algorithms. In addition to the previously mentioned Aigis-Enc and Aigis-Sig algorithms, various internationally recognized or domestically developed post-quantum cryptography algorithms, such as Kyber and Dilithium, can be added according to specific needs. These algorithms are stored in the algorithm library with standardized interfaces, facilitating loading and invocation by the Provider Module API.

[0034] Based on this, the embodiments of this application also provide a method for implementing an extensible encrypted network protocol. This method can be generated by any electronic device with computing and processing capabilities, such as a client device or a server device.

[0035] The following examples, in conjunction with the accompanying drawings, illustrate the implementation method of the scalable encrypted network protocol provided in this application. This method can be applied to either the client or the server.

[0036] Figure 2 One of the flowcharts illustrating an implementation method for an extensible encrypted network protocol provided in an embodiment of this application is as follows: Figure 2 As shown, the method includes: S101, Obtain the application layer algorithm call request.

[0037] The application layer serves as the entry point for user interaction and system encryption functionality. It can be either a client-side application or a server-side application. When a user performs data transmission operations on the client side, or when the server needs to encrypt stored data, the application layer generates an algorithm call request based on the data's security requirements. This request includes information about the cryptographic algorithm to be invoked, such as its name (e.g., Aigis-Enc) and version number.

[0038] Taking online banking transfers by a client as an example, the client application will generate an algorithm call request containing the specified post-quantum cryptography algorithm name and version number according to the bank's requirements for encrypting transaction data, and send it to the quantum-resistant encryption network protocol layer.

[0039] S102. Based on the information of the cryptographic algorithm to be invoked, invoke the unified program interface of the algorithm compatibility layer.

[0040] After receiving an algorithm call request from the application layer, the quantum-resistant encryption network protocol layer parses the information about the cryptographic algorithm to be invoked. Then, based on this information, the quantum-resistant encryption network protocol layer invokes the unified program interface (Envelope API) of the algorithm compatibility layer. The Envelope API, acting as a unified management interface between the application layer and the underlying cryptographic algorithms, is responsible for shielding the differences in the underlying algorithm implementations. Upon receiving the call request, it prepares to uniformly schedule subsequent encryption and decryption operations. For example, after the quantum-resistant encryption network protocol layer parses a request to invoke the Aigis-Enc algorithm, it sends a call instruction to the Envelope API, which then initiates the management process for operations related to the Aigis-Enc algorithm.

[0041] S103. Using a unified program interface, a query request for the cryptographic algorithm to be called is initiated to the provider program interface through the core program interface in the algorithm compatibility layer.

[0042] Upon receiving a call request, the Envelope API, in order to obtain the specific invocation method of the cryptographic algorithm to be invoked, initiates a query request for the cryptographic algorithm to be invoked through the Core Internal API in the algorithm compatibility layer. The Core Internal API mainly undertakes internal management and interface scheduling functions, accurately transmitting the query request from the Envelope API to the Provider Module API.

[0043] For example, the Envelope API queries the Provider Module API for the method to invoke the Aigis-Enc algorithm through the Core Internal API. The Core Internal API accurately sends the query request to the Provider Module API based on the system's internal configuration and interface calling rules.

[0044] S104. Using a provider interface, based on the query request for the cryptographic algorithm to be called, query the calling method of the cryptographic algorithm to be called from the preset cryptographic algorithm list.

[0045] The list of preset cryptographic algorithms stores the algorithm's name, basic description, the algorithm itself, the length of the public and private keys involved in the algorithm, the security level of the algorithm, the type of the algorithm (signature algorithm or key encapsulation algorithm), and the address of the function to be called.

[0046] Upon receiving a query request, the Provider Module API retrieves the invocation method for the desired cryptographic algorithm from a list of preset cryptographic algorithms, based on the algorithm's information. This list of preset cryptographic algorithms is stored in a post-quantum cryptographic algorithm library within the extensible layer.

[0047] The Provider Module API performs a precise match in the list based on information such as algorithm name and version number to retrieve the corresponding calling method. For example, for a query request for the Aigis-Enc algorithm, the Provider Module API finds the calling method for the Aigis-Enc algorithm in the preset cryptographic algorithm list, including the function call format and parameter passing rules of the Aigis-Enc algorithm.

[0048] S105. Using a provider interface, load and call the cryptographic algorithm to be called from the post-quantum cryptographic algorithm library in the extensible layer according to the calling method of the cryptographic algorithm to be called.

[0049] After obtaining the calling method of the cryptographic algorithm to be invoked, the Provider Module API first loads the cryptographic algorithm to be invoked from the post-quantum cryptographic algorithm library in the extensible layer, and then invokes the algorithm according to the calling method.

[0050] During the loading process, the Provider Module API, following the system resource allocation and algorithm loading mechanism, reads the algorithm to be called from the algorithm library into the runtime environment such as memory. Then, it strictly executes the algorithm according to the calling method, performing operations such as encryption, decryption, signing, and signature verification on the data. For example, after loading the Aigis-Enc algorithm into the system runtime environment, the Provider Module API encrypts online banking transfer transaction data according to the previously obtained calling method, ensuring data security during transmission.

[0051] The post-quantum cryptography algorithm library includes at least two post-quantum cryptography algorithms, covering domestically developed post-quantum cryptography algorithms. For example, it may include domestically developed post-quantum cryptography algorithms and international post-quantum cryptography algorithms. Domestically developed post-quantum cryptography algorithms include domestically developed post-quantum encryption algorithms, domestically developed post-quantum decryption algorithms, and domestically developed post-quantum encapsulation algorithms, etc.

[0052] Among them, domestically developed post-quantum encryption algorithms may include, for example, the plaintext-attack-safe encryption algorithm Aigis-pke.Enc; domestically developed post-quantum decryption algorithms may include, for example, the plaintext-attack-safe decryption algorithm Aigis-pke.Dec; and domestically developed post-quantum encapsulation algorithms may include, for example, the ciphertext-attack-safe key encapsulation algorithm Aigis-enc.Encaps and the ciphertext-attack-safe key decapsulation algorithm Aigis-enc.Decaps.

[0053] Optionally, it may also include a plaintext-secure key pair generation algorithm, Aigis-pke.KeyGen, a ciphertext-secure key pair generation algorithm, Aigis-enc.KeyGen, a key generation algorithm, Aigis-sig.KeyGen, a signature generation algorithm, Aigis-sig.Sign, and a signature verification algorithm, Aigis-sig.Verify.

[0054] In summary, this application provides an implementation method for a scalable encrypted network protocol, enabling efficient invocation of various post-quantum cryptographic algorithms. This method is tightly integrated with the scalable encrypted network protocol system, utilizing the collaborative work of various interfaces to simplify the algorithm invocation process, reduce application development difficulty, and improve the system's adaptability to various post-quantum cryptographic algorithms. It significantly enhances the scalability and security of cryptographic algorithms, effectively addressing the security challenges posed by quantum computing.

[0055] Figure 3 This is a second flowchart illustrating an implementation method for an extensible encrypted network protocol provided in an embodiment of this application. Figure 3 As shown, the method of this application further includes: S201. The cryptographic interface encapsulation module in the extensible layer is used to encapsulate the newly added post-quantum cryptographic algorithms in the post-quantum cryptographic algorithm library into a unified program interface.

[0056] When a new post-quantum cryptography algorithm needs to be integrated into the system, such as the newly developed domestic post-quantum cryptography algorithm X-Cipher, the system administrator or developer adds the algorithm to the post-quantum cryptography algorithm library. At this time, the cryptographic interface encapsulation module in the extensible layer starts working. This module analyzes the newly added X-Cipher algorithm, identifies its key characteristics such as input and output format and algorithm operation logic, and then encapsulates the X-Cipher algorithm according to the standard interface specification defined by the unified program interface (Envelope API).

[0057] By encapsulating the algorithm, the X-Cipher algorithm can interact with the Envelope API in a unified way, shielding it from the differences in its underlying implementation. This provides convenient conditions for subsequent application-layer calls to the algorithm, ensuring that all application-layer calls to the algorithm are completed through the algorithm compatibility layer. For example, the encryption and decryption functions of the X-Cipher algorithm are redefined and wrapped according to the Envelope API format, making them directly callable by the Envelope API.

[0058] S202. Use the registration intermediate module in the extensible layer to generate the calling method for the newly added quantum cryptography algorithm.

[0059] After encapsulating the newly added quantum cryptography algorithm, the registration intermediate module generates a calling method for the algorithm based on the encapsulated algorithm information. The registration intermediate module analyzes the interface parameters and function call order of the encapsulated X-Cipher algorithm, and, combined with the system's calling rules and resource management mechanisms, generates a complete calling method. This calling method includes the parameter passing method required for the algorithm call, the specific steps of the function call, and the exception handling mechanism. For example, for the encryption call of the X-Cipher algorithm, the registration intermediate module will clearly specify the format of the input data, the key passing method, and the return value and handling process when errors occur during encryption, forming a detailed calling guide so that the subsequent system can accurately call the algorithm.

[0060] S203. Using the registration module in the extensible layer, register the calling method of the newly added quantum cryptography algorithm to the preset cryptography algorithm list.

[0061] After receiving the calling methods for newly added post-quantum cryptographic algorithms generated by the registration intermediate module, the registration module registers them in the preset cryptographic algorithm list. This list, stored in the post-quantum cryptographic algorithm library, serves as the basis for the system to query and invoke cryptographic algorithms. The registration module associates the calling methods of the X-Cipher algorithm with information such as the algorithm name and version number, and accurately adds them to the preset cryptographic algorithm list according to a specific storage format and indexing rules. Thus, when the application layer initiates a call request for the X-Cipher algorithm, the provider module API can quickly retrieve the calling method from the preset cryptographic algorithm list, thereby enabling the invocation of the algorithm. For example, the registration module creates a new entry for the X-Cipher algorithm in the preset cryptographic algorithm list, recording detailed information about its calling method and related algorithm identifiers, ensuring that the system can efficiently manage and invoke the algorithm.

[0062] The additional post-quantum cryptography algorithm extension process in this embodiment further improves the implementation method of scalable encryption network protocols.

[0063] By leveraging the collaborative work of the cryptographic interface encapsulation module, the registration intermediate module, and the registration module, the automated integration of newly added quantum cryptographic algorithms is achieved without requiring large-scale modifications to the system's core code. This reduces the difficulty and cost of algorithm updates. Furthermore, this extended process enables the system to quickly adopt new cryptographic algorithms, enhancing its security and adaptability, effectively addressing evolving network security threats, and further improving the scalability and practical value of the encrypted network protocol.

[0064] In summary, the embodiments of this application provide a method for implementing a scalable encrypted network protocol, which has the following advantages: 1. Efficient Algorithm Call: Through clear and orderly steps, based on the application layer request and through the collaboration of various interfaces in the algorithm compatibility layer, the quantum cryptography algorithm is accurately called from the extensibility layer, simplifying the calling process, reducing the difficulty of application development, and improving the efficiency of algorithm calling.

[0065] 2. Strong scalability: The extensible layer is equipped with a cryptographic interface encapsulation module, a registration intermediate module, and a registration module, which can easily integrate new quantum cryptographic algorithms into the system without large-scale modifications to the core code. This enhances the system's ability to accept new cryptographic algorithms and adapt to the development of cryptography and the emergence of new algorithms.

[0066] 3. Dynamic management capability: Supports the dynamic addition of new cryptographic algorithms to the cryptographic algorithm lists of the client and server, enabling the system to update cryptographic algorithms in a timely manner, enhancing its adaptability to new cryptographic algorithms, and effectively responding to ever-changing network security threats.

[0067] 4. Security and Reliability: It is closely integrated with the scalable encrypted network protocol system, providing a reliable cryptographic algorithm foundation for data transmission. By performing operations such as encryption, decryption, signing, and verification on data, it ensures the security and integrity of data and guarantees the security and stability of network communication.

[0068] This application also provides a cryptographic algorithm negotiation method, applied to a client-side application. Figure 4 This is one of the flowcharts illustrating the cryptographic algorithm negotiation method provided in the embodiments of this application, such as... Figure 4 As shown, the method includes: S301, Initiate a cryptographic algorithm negotiation request to the server.

[0069] Before establishing a communication connection or transmitting data with the server, the client device needs to initiate a cryptographic algorithm negotiation request. This request contains a first list of cryptographic algorithms supported by the client. This first list records information about the various post-quantum cryptographic algorithms supported by the client, such as algorithm name (e.g., Aigis-Enc, NewHope, etc.) and version number. The purpose of the cryptographic algorithm negotiation request is to allow the server to negotiate cryptographic algorithms based on the first list provided by the client and its own second list of supported cryptographic algorithms, thereby determining a target list of cryptographic algorithms supported by both parties.

[0070] For example, when a client device makes an online shopping payment, it initiates a cryptographic algorithm negotiation request before sending payment data to the server. The request includes information about the supported post-quantum cryptographic algorithms such as Aigis-Enc and NewHope, so that the server can negotiate based on this.

[0071] S302, Receive the target cryptographic algorithm list sent by the server, so that the server can execute the implementation method of the extensible encrypted network protocol based on the target cryptographic algorithm list.

[0072] After receiving the cryptographic algorithm negotiation request from the client, the server compares and analyzes its own list of second cryptographic algorithms with the client's list of first cryptographic algorithms to find cryptographic algorithms that are supported by both parties, forms a target cryptographic algorithm list, and sends the list back to the client. After receiving the target cryptographic algorithm list, the client confirms the negotiation result.

[0073] At this point, the server will execute the implementation method of the Extensible Encryption Network Protocol (EEN) based on the target cryptographic algorithm list to perform operations such as encryption, decryption, signing, and signature verification on the data subsequently transmitted between the server and the client. For example, if the server analyzes and finds that both parties support the Aigis-Enc algorithm, it will compile a target cryptographic algorithm list of Aigis-Enc algorithms and send it to the client. Subsequently, when processing the client's payment data, the server will call the Aigis-Enc algorithm to encrypt the payment data according to the implementation method of the EEN, ensuring the security of data transmission.

[0074] Before initiating a cryptographic algorithm negotiation request to the server, the client can also perform the following operations: add the first newly added cryptographic algorithm to the first cryptographic algorithm list. When the client obtains a new cryptographic algorithm (such as the new domestic post-quantum cryptographic algorithm X-Cipher), and after evaluation confirms that the algorithm is suitable for its own security needs and system environment, the client will add the relevant information of the first newly added cryptographic algorithm (including algorithm name, version number, functional description, etc.) to the first cryptographic algorithm list.

[0075] The addition process can be manually configured by the system administrator or automatically added to the list when a new algorithm is detected as available, via a preset automatic update program. For example, if a client detects that the X-Cipher algorithm has advantages in security and performance, it will be automatically added to the first list of cryptographic algorithms. Subsequently, when initiating a cryptographic algorithm negotiation request, this algorithm information will be included in the request, participating in the cryptographic algorithm negotiation process between the client and the server, thus improving the client's support for new cryptographic algorithms and the flexibility of negotiation.

[0076] Taking an online file storage service as an example, a user uses a client application installed on their personal computer to access a cloud server to upload files. Before uploading, the client application sends a post-quantum cryptographic algorithm negotiation request to the server, containing a list of post-quantum cryptographic algorithms supported by the client, such as Aigis-Enc and Kyber. Upon receiving the request, the server compares its own list of supported cryptographic algorithms with the request and finds that both support the Aigis-Enc algorithm. Therefore, the server sends a target list of Aigis-Enc algorithms to the client. After the client receives and confirms the target list, the server uses the Aigis-Enc algorithm to implement an extensible encrypted network protocol to encrypt the uploaded file, ensuring the security of the file during transmission and storage.

[0077] If, during use, the client acquires a new, highly efficient post-quantum cryptography algorithm, X-Cipher, it adds it to its first list of cryptographic algorithms. Before the next communication with the server, the client's cryptographic algorithm negotiation request will include X-Cipher information. The server will renegotiate based on the new request. If both parties support the algorithm, it can be included in the target cryptographic algorithm list for use in encrypting subsequent communication data, thereby continuously improving the security and adaptability of the file storage service.

[0078] This application also provides a cryptographic algorithm negotiation method for use on the server side. Figure 5 This is a second flowchart illustrating the cryptographic algorithm negotiation method provided in the embodiments of this application, as shown below. Figure 5 As shown, the method includes: S401: Receive a cryptographic algorithm negotiation request sent by the client.

[0079] When establishing a communication connection with a client or preparing to receive data from the client, the server-side device waits to receive a cryptographic algorithm negotiation request from the client. This request contains a primary list of cryptographic algorithms supported by the client, detailing information such as algorithm name (e.g., Aigis-Enc, NewHope), version number, and algorithm characteristics. For example, when a user initiates a transfer to an online bank server via a mobile client, the mobile client first sends a cryptographic algorithm negotiation request to the bank server. The primary list of cryptographic algorithms may include multiple post-quantum cryptographic algorithms supported by the client. The server accurately receives this request and the list information to prepare for subsequent negotiations.

[0080] S402. Based on the first cryptographic algorithm list and the second cryptographic algorithm list supported by the server, perform cryptographic algorithm negotiation to obtain the target cryptographic algorithm list.

[0081] After receiving a cryptographic algorithm negotiation request from the client, the server performs a detailed comparison and analysis of the client's first list of cryptographic algorithms and its own second list of supported cryptographic algorithms. The server's second list stores information on various post-quantum cryptographic algorithms supported by the server. By comparing the algorithm names, version numbers, and other information in the two lists one by one, the server identifies cryptographic algorithms supported by both parties. These commonly supported cryptographic algorithms form the target cryptographic algorithm list. For example, if the server's second list includes algorithms such as Aigis-Enc and CRYSTALS-Kyber, and a comparison with the client's first list reveals that both parties support the Aigis-Enc algorithm, then Aigis-Enc will be included in the target cryptographic algorithm list. During the actual negotiation process, if multiple commonly supported algorithms exist, the server can sort these algorithms according to preset priority rules (such as security priority, performance priority, etc.) to ultimately determine the specific content and order of the target cryptographic algorithm list.

[0082] S403. Send a list of target cryptographic algorithms to the client so that the client can execute an implementation of the extensible encrypted network protocol based on the list of target cryptographic algorithms.

[0083] After determining the target cryptographic algorithm list, the server sends the list back to the client. Upon receiving and confirming the target cryptographic algorithm list, both parties will execute the implementation method of the Extensible Encryption Network Protocol based on this list. During subsequent data transmission, the server performs encryption, decryption, signing, and signature verification operations on the data sent by the client according to the algorithms in the target cryptographic algorithm list, ensuring the security and integrity of the data. For example, in the online banking transfer scenario mentioned above, the server sends a target cryptographic algorithm list containing the Aigis-Enc algorithm to the client. After the client confirms, when the server receives the client's transfer data, it will call the Aigis-Enc algorithm to encrypt the data, ensuring the security of the transfer information during transmission.

[0084] Before receiving a cryptographic algorithm negotiation request from the client, the server can perform the following operations: add a second, newly added cryptographic algorithm to the second cryptographic algorithm list. When the server obtains a new post-quantum cryptographic algorithm (such as the novel international post-quantum cryptographic algorithm Z-Protect), and after security assessment and performance testing confirms that the algorithm meets the server's security policy and operational requirements, the server will add the relevant information of the second, newly added cryptographic algorithm (including algorithm name, version number, functional description, applicable scenarios, etc.) to the second cryptographic algorithm list. The addition process can be completed manually by the system administrator or through the server's preset automatic update program. For example, if the server's automatic update program detects that the Z-Protect algorithm performs well in terms of security and processing efficiency, it will automatically add it to the second cryptographic algorithm list. In this way, during subsequent cryptographic algorithm negotiations with the client, the newly added Z-Protect algorithm will have the opportunity to participate in the negotiation. If the client also supports the algorithm, it can be included in the target cryptographic algorithm list, thereby improving the security and adaptability of data encryption between the server and the client.

[0085] The cryptographic algorithm negotiation method provided in the above embodiments, by negotiating a list of cryptographic algorithms between the client and server, can quickly and accurately determine a list of target cryptographic algorithms supported by both parties. This provides a reliable cryptographic algorithm foundation for the implementation of scalable encrypted network protocols and ensures the security of network communication. Simultaneously, it supports dynamically adding new cryptographic algorithms to the client and server's supported list, enabling both the client and server to adapt to new cryptographic algorithms in a timely manner. This improves the system's scalability and adaptability to cryptographic algorithms and effectively addresses ever-changing network security threats.

[0086] After the algorithm negotiation is completed on the client and server sides, remote login can also be performed. The following combines... Figure 6 This paper provides an exemplary description of a method for remote login between the client and server using the post-quantum SSH protocol.

[0087] exist Figure 6 In the example shown, the participants are the client and the server, which are connected via network and have completed the PQC-SM2 cryptographic algorithm negotiation, determining that this algorithm will be used for subsequent session communication. The session establishment process is as follows: 1. Algorithm adds notification (Message 1) After successfully adding the PQC+SM2 algorithm to its algorithm list, the client proactively sends a message to the server stating, "Client has added PQC+SM2 algorithm to algorithm list." This message informs the server that the client now supports the target algorithm, preparing for subsequent negotiation and session establishment. For example, if the client is a financial app, after completing the integration and adaptation of the PQC+SM2 algorithm, it sends this notification to the financial service provider to ensure the server is aware that the client has the capability to use this algorithm.

[0088] 2. Algorithm negotiation confirmation (Message 2) After receiving message 1, the server performs algorithm negotiation and matching based on its own algorithm support list (which is pre-configured to support the PQC+SM2 algorithm). Since the server also supports the PQC+SM2 algorithm, it selects this algorithm and returns a message to the client stating "PQC+SM2 algorithm selected during cryptographic algorithm negotiation, returned to client." This step clarifies the cryptographic algorithm used by both parties in the session, which is fundamental to session establishment and ensures consistency in subsequent encrypted communication.

[0089] 3. Client key exchange (Message 3) Upon receiving message 2 and confirming the use of the PQC+SM2 algorithm, the client uses this algorithm to generate session key parameters (such as the public key and temporary key) and sends them to the server via a message stating "Client uses supported PQC+SM2 cryptographic negotiation algorithm for session key exchange." For example, the client uses the PQC+SM2 algorithm's key generation mechanism to generate a public key PubC, encapsulates it in message 3, and sends it to the server for subsequent key negotiation.

[0090] 4. Server-side key exchange (Message 4) After receiving message 3, the server also generates its own session key parameters (such as the server's public key PubS, temporary key, etc.) based on the PQC+SM2 algorithm, and sends them to the client through the message "The server uses the supported PQC+SM2 cryptographic negotiation algorithm to exchange session keys". At the same time, the server combines the key parameters of the client and its own, and generates a session key according to the PQC+SM2 algorithm process (such as calculating the shared session key SK using PubC and PubS through the key negotiation algorithm).

[0091] 5. Send public key and authorization information (Message 5) After generating the session key, the server sends a message to the client stating, "Server sends PQC+SM2 public key and public key authorization information." The PQC+SM2 public key is used by the client to verify the server's identity and for subsequent encrypted communication. The public key authorization information includes the public key's validity scope and usage permissions (such as its use for login authentication, business data encryption, etc.). For example, the server sends the public key PubS and authorization information stating, "This public key is only used for this session login and business data interaction, valid for 30 minutes," to the client, ensuring the security and compliance of key usage.

[0092] 6. Login Request (Message 6) Upon receiving message 5, the client verifies the validity of the server's public key and authorization information. Then, using a login key protected by a PQC+SM2 public key or a session key (such as encrypting the login password and user identifier using the session key SK), the client initiates a login request to the server via the message "Log in using the PQC+SM2 public key or a public key-protected login key." For example, the client encapsulates the user account "user001" and the encrypted password (encrypted using SK) in message 6 and sends it to the server, ensuring that the login information is securely protected during transmission.

[0093] 7. Login authentication feedback (Message 7) After receiving message 6, the server uses the session key SK to decrypt the login information and verify the user's identity (e.g., verifying the account and password, checking user permissions). If the verification is successful, the server returns a "Login Successful" message to the client, completing the login authentication; if the verification fails, it returns the corresponding error message (e.g., incorrect account or password, insufficient permissions, etc.). After successful login, the client and server can securely conduct subsequent business data interactions (e.g., transaction data transmission, user information query, etc.) based on the PQC+SM2 algorithm and session key.

[0094] This application also provides an electronic device, which can be a client device or a server device. Figure 7 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application, such as... Figure 7 As shown, the electronic device includes a processor 100, a storage medium 200, and a bus 300. The storage medium stores program instructions executable by the processor. When the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the program instructions to implement the scalable encrypted network protocol implementation method described in any of the above embodiments.

[0095] This application also provides a readable storage medium storing program instructions, which, when executed by a processor, implement the implementation method of the scalable encrypted network protocol described in any of the above embodiments.

[0096] The following will continue to explain the implementation method of the scalable encrypted network protocol, the apparatus, the device, and the storage medium for the cryptographic algorithm negotiation method provided in any of the above embodiments of this application. The specific implementation process and the resulting technical effects are the same as those in the corresponding method embodiments. For the sake of brevity, the parts not mentioned in the following embodiments can be referred to the corresponding content in the method embodiments.

[0097] Figure 8 This is a schematic diagram of the structure of an implementation device for a scalable encrypted network protocol provided in an embodiment of this application. This device is applied to a client or server, such as... Figure 8 As shown, the device includes: The acquisition module 10 is used to acquire the algorithm call request of the application layer, wherein the algorithm call request includes: information of the cryptographic algorithm to be called.

[0098] The calling module 20 is used to call the unified program interface of the algorithm compatibility layer based on the information of the cryptographic algorithm to be called.

[0099] The first initiating module 30 is used to initiate a query request for the cryptographic algorithm to be called to the providing program interface through the core program interface in the algorithm compatibility layer using the unified program interface.

[0100] The query module 40 is used to query the calling method of the cryptographic algorithm to be called from the preset cryptographic algorithm list based on the query request of the cryptographic algorithm to be called using the provider interface.

[0101] The loading module 50 is used to load the cryptographic algorithm to be invoked in the post-quantum cryptographic algorithm library in the extensible layer according to the invocation method of the cryptographic algorithm to be invoked, using the provider interface. The post-quantum cryptographic algorithm library includes at least two post-quantum cryptographic algorithms.

[0102] Optionally, the device further includes an encapsulation module, used to encapsulate the newly added post-quantum cryptographic algorithms in the post-quantum cryptographic algorithm library into the unified program interface using the cryptographic interface encapsulation module in the extensible layer; to generate a calling method for the newly added post-quantum cryptographic algorithm using the registration intermediate module in the extensible layer; and to register the calling method for the newly added post-quantum cryptographic algorithm to the preset cryptographic algorithm list using the registration module in the extensible layer.

[0103] Figure 9 This is one of the structural schematic diagrams of the cryptographic algorithm negotiation device provided in the embodiments of this application, such as... Figure 9 As shown, the device is used on a client side and includes: The second initiating module 60 is used to initiate a cryptographic algorithm negotiation request to the server; the cryptographic algorithm negotiation request includes: a first cryptographic algorithm list supported by the client; the cryptographic algorithm negotiation request is used to enable the server to negotiate cryptographic algorithms based on the first cryptographic algorithm list and the second cryptographic algorithm list supported by the server to obtain a target cryptographic algorithm list.

[0104] The second receiving module 70 is used to receive the target cryptographic algorithm list sent by the server, so that the server can execute the implementation method of the extensible encrypted network protocol described in any of the above embodiments based on the target cryptographic algorithm list.

[0105] Optionally, the device further includes a first addition module for adding a first new cryptographic algorithm to the first cryptographic algorithm list.

[0106] Figure 10 This is a second schematic diagram of the cryptographic algorithm negotiation device provided in the embodiments of this application, as shown below. Figure 10 As shown, this device is used on the server side, and the device includes: The third receiving module 80 is used to receive a cryptographic algorithm negotiation request sent by the client; the cryptographic algorithm negotiation request includes: a first list of cryptographic algorithms supported by the client.

[0107] The negotiation module 90 negotiates cryptographic algorithms based on the first cryptographic algorithm list and the second cryptographic algorithm list supported by the server to obtain a target cryptographic algorithm list; and sends the target cryptographic algorithm list to the client so that the client executes the implementation method of the extensible encrypted network protocol described in any of the above embodiments based on the target cryptographic algorithm list.

[0108] Optionally, the device further includes a second addition module for adding a second new cryptographic algorithm to the second cryptographic algorithm list.

[0109] The above-described device is used to execute the method provided in the foregoing embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.

[0110] These modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more microprocessors, or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together as a system-on-a-chip (SOC).

[0111] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0112] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0113] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in a combination of hardware and software functional units.

[0114] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0115] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for implementing a scalable encrypted network protocol, characterized in that, A quantum-resistant cryptographic network protocol layer applied in a client or server, the method comprising: Obtain the application layer algorithm call request, wherein the algorithm call request includes: information about the cryptographic algorithm to be called; Based on the information of the cryptographic algorithm to be invoked, the unified program interface of the algorithm compatibility layer is invoked; Using the unified program interface, a query request for the cryptographic algorithm to be invoked is initiated to the providing program interface through the core program interface in the algorithm compatibility layer; Using the provided program interface, based on the query request for the cryptographic algorithm to be invoked, the calling method of the cryptographic algorithm to be invoked is queried from the preset cryptographic algorithm list; Using the provided program interface, the cryptographic algorithm to be invoked is loaded and invoked according to the invocation method of the cryptographic algorithm to be invoked in the post-quantum cryptographic algorithm library in the extensible layer. The post-quantum cryptographic algorithm library includes at least two post-quantum cryptographic algorithms. The method further includes: The newly added post-quantum cryptographic algorithms in the post-quantum cryptographic algorithm library are encapsulated into the unified program interface using the cryptographic interface encapsulation module in the extensible layer. The registration intermediate module in the extensible layer is used to generate the calling method for the newly added quantum cryptography algorithm; The registration module in the extensible layer is used to register the calling method of the newly added quantum cryptography algorithm to the preset cryptography algorithm list.

2. The method according to claim 1, characterized in that, The at least two post-quantum cryptography algorithms include: domestic post-quantum cryptography algorithms and international post-quantum cryptography algorithms, wherein the domestic post-quantum cryptography algorithms include: domestic post-quantum encryption algorithms, domestic post-quantum decryption algorithms, and domestic post-quantum encapsulation algorithms.

3. A cryptographic algorithm negotiation method, characterized in that, Applied to a client, the method includes: A cryptographic algorithm negotiation request is initiated to the server; the cryptographic algorithm negotiation request includes: a first list of cryptographic algorithms supported by the client; the cryptographic algorithm negotiation request is used to enable the server to negotiate cryptographic algorithms based on the first list of cryptographic algorithms and a second list of cryptographic algorithms supported by the server, to obtain a target list of cryptographic algorithms; Receive the target cryptographic algorithm list sent by the server; The cryptographic algorithm to be invoked is determined based on the target cryptographic algorithm list, so that the client executes the implementation method of the scalable encrypted network protocol according to any one of claims 1-2 based on the cryptographic algorithm to be invoked.

4. The method according to claim 3, characterized in that, Before initiating the cryptographic algorithm negotiation request to the server, the method further includes: Add the first newly added cryptographic algorithm to the first cryptographic algorithm list.

5. A cryptographic algorithm negotiation method, characterized in that, Applied to the server side, the method includes: Receive a cryptographic algorithm negotiation request sent by a client; the cryptographic algorithm negotiation request includes: a first list of cryptographic algorithms supported by the client; Based on the first list of cryptographic algorithms and the second list of cryptographic algorithms supported by the server, a cryptographic algorithm negotiation is performed to obtain the target list of cryptographic algorithms; The target cryptographic algorithm list is sent to the client so that the client determines the cryptographic algorithm to be invoked based on the target cryptographic algorithm list and executes the implementation method of the extensible encrypted network protocol according to any one of claims 1-2 based on the cryptographic algorithm to be invoked.

6. The method according to claim 5, characterized in that, Before receiving the cryptographic algorithm negotiation request sent by the client, the method further includes: Add the second new cryptographic algorithm to the second cryptographic algorithm list.

7. A scalable encrypted network protocol system, characterized in that, include: The system comprises an application layer, a quantum-resistant encryption network protocol layer, an algorithm compatibility layer, and an extensible layer. The algorithm compatibility layer is pre-integrated with a unified program interface, a core program interface, and a provider program interface. The extensible layer is configured with a post-quantum cryptography algorithm library. The application layer is used to send algorithm call requests to the quantum-resistant encryption network protocol layer; The quantum-resistant encryption network protocol layer is used to implement the scalable encryption network protocol implementation method according to any one of claims 1-2.

8. An electronic device, characterized in that, include: The device includes a processor, a storage medium, and a bus. The storage medium stores program instructions executable by the processor. When the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the program instructions to implement the scalable encrypted network protocol implementation method according to any one of claims 1 to 2.

9. A readable storage medium, characterized in that, The readable storage medium stores program instructions, which, when executed by a processor, implement the method for implementing the scalable encrypted network protocol as described in any one of claims 1 to 2.

Images