A data communication method based on post-quantum cryptography, an electronic device and a storage medium

Abstract

The application provides a data communication method based on post-quantum cryptography, an electronic device and a storage medium, and relates to the technical field of communication. The application optimizes the data transmission process. When a server transmits data to a client, the data can be chain-encrypted through two encryption algorithms, and the two encryption algorithms are respectively configured as an encryption algorithm based on post-quantum cryptography and a classical encryption algorithm. Thus, the encrypted data can have the theoretical security of the classical encryption algorithm, and can also resist decryption by a quantum computer based on the post-quantum encryption algorithm. In addition, when chain-encryption is performed, the encrypted data is processed based on a fixed hash function to determine a reproducible encryption seed, so that the client can verify the encryption result through re-encryption of the decrypted data, without needing to provide additional verification data for verification of the decryption result, thereby further ensuring the security of the data transmission process.

Description

Technical Field

[0001] This application relates to the field of encryption technology, specifically to a data communication method, electronic device, and storage medium based on post-quantum cryptography. Background Technology

[0002] In encryption technology, classic encryption algorithms, represented by RSA (Richter Algorithm for Large Integers) and ECC (Elliptic Curve Cryptography), primarily rely on the complexity of mathematical problems to ensure the security of encrypted data. That is, traditional computers cannot crack these mathematical problems within a reasonable timeframe, thus guaranteeing the security of data encrypted by classic encryption algorithms.

[0003] With the emergence and development of quantum computers, Shor's algorithm can solve large integer factorization and discrete logarithm problems in polynomial time, rendering public-key encryption methods such as RSA and ECC ineffective. Therefore, how to improve data encryption methods to meet the challenges of quantum computers is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of this, embodiments of this application provide a data communication method, electronic device, and storage medium based on post-quantum cryptography, which can perform chain encryption using two encryption algorithms, and configure the two encryption algorithms as a post-quantum cryptography-based encryption algorithm and a classical encryption algorithm, respectively, to ensure the security of encrypted data under quantum computer attacks.

[0005] In a first aspect, this application provides a data communication method based on post-quantum cryptography, applied to a communication system. For a server and a client connected in the communication system, the data communication method includes: the server generating first data in response to a client's communication request, and executing a first hash function based on the first data to determine at least one encryption seed; the server performing chain encryption on the first data using a first encryption algorithm and a second encryption algorithm based on the at least one encryption seed to determine a target encryption result after encrypting the first data, wherein one of the first encryption algorithm and the second encryption algorithm is configured as a post-quantum cryptography-based encryption algorithm, and the other is configured as a classical encryption algorithm; the server sending the target encryption result to the client; the client decrypting the target encryption result to determine decrypted data; the client executing a first hash function based on the decrypted data to determine at least one verification seed corresponding to the at least one encryption seed; the client performing chain encryption on the decrypted data using the first encryption algorithm and the second encryption algorithm based on the at least one verification seed to determine a verification value of the encryption result after encrypting the decrypted data; and the client using the first data in response to the target encryption result matching the verification value of the encryption result.

[0006] Secondly, this application provides a data communication method based on post-quantum cryptography, applied to a client in a communication system. The data communication method includes: receiving a target encryption result returned by a server in response to a communication request from a client, wherein the target encryption result is the result of chain encryption of first data generated by the server using a first encryption algorithm and a second encryption algorithm based on at least one encryption seed, the at least one encryption seed being the result of inputting the first data into a first hash function, one of the first encryption algorithm and the second encryption algorithm being configured as a post-quantum cryptography-based encryption algorithm, and the other being configured as a classical encryption algorithm; decrypting the target encryption result to determine decrypted data; executing the first hash function based on the decrypted data to determine at least one verification seed corresponding to at least one encryption seed; using the first encryption algorithm and the second encryption algorithm based on at least one verification seed to perform chain encryption of the decrypted data, determining a verification value of the encrypted result after decryption; and, in response to the target encryption result matching the verification value, using the first data.

[0007] Thirdly, this application provides a data communication method based on post-quantum cryptography, applied to a server in a communication system. The data communication method includes: generating first data in response to a communication request from a client of the communication system; performing a first hash function based on the first data to determine at least one encryption seed; performing chain encryption on the first data using a first encryption algorithm and a second encryption algorithm based on the at least one encryption seed to determine a target encryption result after encrypting the first data, wherein one of the first encryption algorithm and the second encryption algorithm is configured as a post-quantum cryptography-based encryption algorithm, and the other is configured as a classical encryption algorithm; sending the target encryption result to the client; enabling the client to decrypt the target encryption result to determine decrypted data; then performing a first hash function based on the decrypted data to determine at least one verification seed corresponding to the at least one encryption seed; subsequently performing chain encryption on the decrypted data using the first encryption algorithm and the second encryption algorithm based on the at least one verification seed to determine a verification value of the encryption result after encrypting the decrypted data; finally, in response to the target encryption result matching the verification value, using the first data.

[0008] Fourthly, this application provides an electronic device including a memory and a processor. The electronic device is configured as a client or server in a communication system. The memory stores a computer program, and when the processor executes the computer program, it implements the steps performed by the server or client in the data communication method described in the first aspect.

[0009] Fifthly, this application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps performed by the server or client in the data communication method described in the first aspect or the data communication method described in the second aspect.

[0010] This application provides a data communication method, electronic device, and storage medium based on post-quantum cryptography, which optimizes the data transmission process. When the server transmits data to the client, chain encryption can be performed using two encryption algorithms, configured as a post-quantum cryptography-based encryption algorithm and a classical encryption algorithm, respectively. Therefore, the encrypted data possesses the theoretical security of classical encryption algorithms, while also having the ability to resist decryption by quantum computers based on the post-quantum encryption algorithm. Furthermore, during chain encryption, the encrypted data is processed using a fixed hash function to determine a reproducible encryption seed, allowing the client to verify the encryption result by re-encrypting the decrypted data without requiring additional verification data, further ensuring the security of the data transmission process. Attached Figure Description

[0011] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 These are application scenario diagrams of the communication system provided in some embodiments of this application.

[0013] Figure 2 This is a signaling diagram of a data communication method based on a communication system provided in some embodiments of this application.

[0014] Figure 3 This is a signaling diagram of an asymmetric algorithm-based encryption / decryption process provided in some embodiments of this application.

[0015] Figure 4 This is a signaling diagram of the encryption / decryption process after quantum migration provided in some embodiments of this application.

[0016] Figure 5 This is an exemplary flowchart of a symmetric key generation process provided in some embodiments of this application.

[0017] Figure 6 This is an exemplary flowchart of a client-based data communication method provided in some embodiments of this application. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] It should be noted that the illustrations provided in this embodiment are only schematic representations of the basic concept of the present invention. Therefore, the drawings only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the shape, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0020] In this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application. Furthermore, the terms "first" and "second" are used only for descriptive and distinguishing purposes and should not be construed as indicating or implying relative importance.

[0021] Application Overview:

[0022] Based on the aforementioned background technology, in the field of encryption technology, the specific security problems of classical encryption algorithms facing quantum computers are as follows:

[0023] The security of the RSA algorithm is based on the problem of large integer factorization (the computational difficulty of factoring large composite numbers into prime factors). For example, given N = p × q (where p and q are large prime numbers), a classical computer would need exponential time to solve it. The security of the ECC algorithm, on the other hand, relies on the difficulty of the Elliptic Curve Discrete Logarithm Problem (ECDLP), which has a higher computational complexity than the traditional discrete logarithm problem.

[0024] In traditional computers, due to the exponential time complexity of mathematical problems, classical computers cannot crack them within a reasonable timeframe (such as over a century), thus failing to ensure the security of encrypted data. For example, it would take a traditional computer approximately 1 billion years to decompose a 2048-bit RSA key.

[0025] However, in quantum computers, Shor's algorithm, based on quantum parallelism and quantum Fourier transform, can solve the aforementioned mathematical problem in polynomial time. That is, Shor's algorithm calculates multiple possibilities simultaneously through the superposition of quantum states, and then extracts periodic information through quantum measurement, efficiently solving the period search problem. Specifically, when a quantum computer executes Shor's algorithm, the solution speed can reach the second level (compared to millions of years for a classical computer).

[0026] Therefore, the security of classical encryption algorithms is difficult to guarantee on quantum computers. To address the challenge of quantum computers, encryption technology has proposed encryption algorithms based on post-quantum cryptography (PQC) (hereinafter referred to as post-quantum encryption algorithms). Unlike traditional encryption, post-quantum encryption algorithms use mathematical problems that even quantum computers cannot solve efficiently (such as lattice theory, hash functions, encoding theory, etc.), thus avoiding being cracked by Shor's algorithm.

[0027] Although the aforementioned post-quantum encryption algorithms can overcome decryption by quantum computers, their security is based on the assumption that "there is currently no efficient quantum solution." However, unlike traditional encryption, they do not have the strict protection provided by mathematical complexity theory and are at risk of being cracked by new algorithms in the future.

[0028] Given that the security of the aforementioned post-quantum cryptography algorithms has not yet been widely recognized, post-quantum cryptography migration mainly adopts a hybrid mode, that is, while retaining classical cryptography, post-quantum cryptography is introduced. As long as one of the key algorithms is not broken, the security of the hybrid algorithm can be maintained.

[0029] However, due to the different protocol flows of various security protocols, hybrid processes can only be designed according to each protocol itself. Furthermore, the methods for key derivation from the key exchange results of post-quantum encryption algorithms and classical algorithms vary widely, leading to significant redundancy across different protocols.

[0030] Therefore, how to reasonably couple post-quantum cryptography algorithms with classical algorithms is a technical problem that urgently needs to be solved by those skilled in the art. To address this problem, this application optimizes the data transmission process. When the server transmits data to the client, chain encryption can be performed using two encryption algorithms, configured as a post-quantum cryptography-based encryption algorithm and a classical encryption algorithm, respectively. Thus, the encrypted data possesses the theoretical security of classical encryption algorithms while also having the ability to resist decryption by quantum computers based on the post-quantum cryptography algorithm. Furthermore, during chain encryption, the encrypted data is processed using a fixed hash function to determine a reproducible encryption seed, allowing the client to verify the encryption result by re-encrypting the decrypted data without requiring additional verification data, further ensuring the security of the data transmission process.

[0031] Exemplary application scenarios:

[0032] The data communication method provided in this application can be used as a cross-terminal communication method, that is, it can be applied between multiple terminals to realize data transmission between terminals.

[0033] In practice, the data communication method provided in this application can often be applied to a communication system formed between a server and a client.

[0034] To further illustrate the implementation of this application, this application also provides an application scenario diagram of a communication system ( Figure 1 ).

[0035] like Figure 1 As shown, the communication system 100 may include a server 110 and multiple clients 120. The data communication method provided in this application can be applied between the server 110 and the clients 120.

[0036] The server 110 and client 120 in the aforementioned communication system 100 are generally electronic devices with computing capabilities (having a processor) and data storage capabilities (having a storage limit) that are connected for communication. The electronic device may include a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the corresponding function (such as the data communication method provided in this application).

[0037] In practical applications, server 110 and client 120 are actually two interconnected terminals with computing capabilities. The hardware configuration can be adjusted based on actual transmission needs to achieve the corresponding data transmission.

[0038] In practical applications, considering that client 120 is generally a consumer-grade terminal, when performing specific tasks, it may not be able to generate some of the data it needs on its own and may need to call it from server 110.

[0039] For example, client 120, due to its limited processing capabilities, often only has the ability to generate pseudo-random numbers. When it needs truly random numbers, it needs to call upon server 110. Server 110, however, is equipped with a quantum entropy source, which can generate truly random numbers by observing the quantum entropy source and send them to client 120.

[0040] Pseudo-random numbers are generated using deterministic algorithms, relying on an initial seed. If the seeds are the same, the output sequence is completely reproducible. The randomness of true random numbers originates from unpredictable physical processes (entropy sources), such as radioactive decay, thermal noise, and quantum phenomena. These processes are inherently nondeterministic, conforming to the principles of quantum mechanics, and therefore theoretically cannot be predicted or reproduced. A quantum entropy source can refer to a device that inherently possesses an unpredictable physical process, but can output random numbers through observation of that process. Unpredictable physical processes generally include radioactive decay, thermal noise in electronic components, and quantum phenomena.

[0041] In addition to the aforementioned true random numbers, the communication system 100 can also transmit other important data (such as credentials, commitments, and other important security data) based on the data communication method provided in this application.

[0042] The data communication method provided in this application will be described in detail below based on the aforementioned communication system 100.

[0043] Exemplary two-way data communication method:

[0044] To illustrate the communication process between the server and the client in detail, this application describes a single data communication process between them. Specifically, this application provides a signaling diagram of a data communication method based on a communication system. Figure 2 ).

[0045] like Figure 2 As shown, the data communication method P200 based on a communication system provided in this application may include the following steps:

[0046] S210, The server generates first data in response to the client's communication request, and performs a first hash function based on the first data to determine at least one encryption seed.

[0047] S220. The server uses a first encryption algorithm and a second encryption algorithm to perform chain encryption on the first data based on at least one encryption seed, and determines the target encryption result after the first data is encrypted.

[0048] S230, The server sends the target encryption result to the client.

[0049] S240. The client decrypts the target encryption result to determine the decrypted data.

[0050] S250, The client executes a first hash function based on the decrypted data to determine at least one verification seed corresponding to at least one encryption seed.

[0051] S260. The client uses the first encryption algorithm and the second encryption algorithm to perform chain encryption on the decrypted data based on at least one verification seed, and determines the verification value of the encryption result after the decrypted data is encrypted.

[0052] S270. The client responds that the target encryption result matches the encryption result verification value and uses the first data.

[0053] In the aforementioned S210, the first data can refer to data sent by the server to the client. It can be represented as a numerical value or as a file to be transmitted. Considering that this application involves relatively complex encryption and verification operations during actual transmission, the size of the first data in actual transmission is generally small. For example, the first data can be a 256-bit binary data.

[0054] As described above, the first data can be determined based on actual communication needs. For example, the first data can be represented as a truly random number. Alternatively, the first data can be represented as a symmetric encryption key used by the server and client in subsequent communication. Yet another example is that the first data can be other important data stored on the server.

[0055] Given that the aforementioned first data is stored on the server / generated by the server, the delivery of the aforementioned first data often depends on a client request. That is, before the aforementioned S210, the client can send a communication request to the server, and the server can determine the first data to be delivered based on the communication request.

[0056] Furthermore, considering that in practical applications, the first and second encryption algorithms involved are often asymmetric encryption algorithms, the corresponding public key can be obtained from the client after receiving the communication request. This public key can be published in a public environment or sent to the server along with the communication request.

[0057] A cryptographic seed can be understood as a random perturbation (also referred to as noise, random error, random vector, etc.) introduced during the encryption process. To ensure that the same plaintext can generate different ciphertexts, random perturbations are introduced during encryption, thereby increasing the randomness and unpredictability of the ciphertext. In other words, by adding random perturbations, it is guaranteed that the same plaintext can generate different ciphertexts.

[0058] This application solidifies the encryption process based on the encryption algorithm into a deterministic process by solidifying the encryption seed (i.e., constructing the encryption seed based on the first data), so that the ciphertext after the plaintext is encrypted based on the encryption seed can be reproduced (i.e., repeated calculations produce the same result).

[0059] To ensure the reproducibility of the encryption seed, the encryption seed in this application can be configured as a hash value of the first data. That is, the first data can be input into a hash function to output the encryption seed. A hash function is a mathematical function that converts input data of arbitrary length (such as text, files, numbers, etc.) into a fixed-length output value (hash value, digest, or fingerprint) using a specific algorithm.

[0060] The hash function used to generate the encryption seed can be referred to as the first hash function, which is mainly used to map the first data into the form and quantity required by subsequent encryption algorithms. For example, the first hash function can map the first data into multiple random numbers of a specific length.

[0061] In addition, to facilitate client verification, both the client and the server are configured with the same first hash function.

[0062] In some embodiments, to achieve quantum-secure identity binding, the input to the aforementioned first hash function may further include relevant information representing the client's identity. For example, the input to the first hash function may further include the hash mapping value of the client's public key, so that the output cryptographic seed is strongly bound to the client's identity.

[0063] In some embodiments, the encryption algorithm may have certain requirements for the encryption seed (such as value requirements, representation requirements, etc.), and the aforementioned process of determining S210 can be performed based on the actual requirements of the encryption seed. Furthermore, the loading of the encryption seed by the two encryption algorithms can also be performed according to the actual situation. For example, the two encryption algorithms can load the same encryption seed. Another example is that the two encryption algorithms can load different encryption seeds. Yet another example is that the two encryption algorithms can each load different parts of an encryption seed. Yet another example is that one of the two encryption algorithms can load one encryption seed, and the other can load at least two encryption seeds. Therefore, in the aforementioned S210, at least one encryption seed corresponding to the first encryption algorithm and the second encryption algorithm can be generated as needed.

[0064] In some embodiments, to improve the randomness of the encryption result, the aforementioned at least one encryption seed can also be two encryption seeds. This allows the first encryption algorithm and the second encryption algorithm to encrypt based on different encryption seeds. See details... Figure 3 The encryption and decryption process described above.

[0065] In the aforementioned S220, after determining the encryption seed, the first data can be encrypted using chain encryption. Chain encryption refers to the process of continuously encrypting data using different encryption algorithms. Considering that this application involves a first encryption algorithm and a second encryption algorithm, its chain encryption can be understood as first encrypting the plaintext data using the first encryption algorithm, and then encrypting the plaintext data again using the second encryption algorithm. The result encrypted through the aforementioned process can be denoted as the target encryption result.

[0066] To ensure the reproducibility of the aforementioned chain encryption while simultaneously improving its security, the first and second encryption algorithms of this application are executed based on a determined encryption seed. Adding random perturbations to the encryption result further ensures that the encryption process can be reproduced on the client side for verification.

[0067] One of the aforementioned first encryption algorithm and second encryption algorithm is a post-quantum encryption algorithm, and the other is a classical encryption algorithm. This application does not restrict the execution order of the post-quantum encryption algorithm and the classical encryption algorithm, as long as the first data is encrypted by both encryption algorithms, so that the encrypted data has both the theoretical security of classical encryption algorithms and can overcome the decoding of quantum computers.

[0068] In some embodiments, considering that after the post-quantum encryption algorithm is accepted, the classical encryption algorithm often needs to be removed during the post-quantum migration, to facilitate the removal of the classical encryption algorithm, during chain encryption, encryption can be performed first based on the post-quantum encryption algorithm, and then based on the classical encryption algorithm. For the specific encryption process, please refer to [link to documentation]. Figure 3 For a description of the encryption process after quantum transfer, please refer to [link to relevant documentation]. Figure 4 And its related descriptions.

[0069] In actual execution, the aforementioned first and second encryption algorithms can incorporate the aforementioned encryption seed according to the rules of the algorithm itself. That is, existing encryption algorithms often directly introduce random factors at the algorithm design level to ensure that the same plaintext input produces different ciphertexts. The aforementioned encryption seed can be used to refer to the random factors in the encryption algorithm. In other words, the encryption algorithm can output different ciphertexts based on different plaintexts because it loads different encryption seeds; when the encryption seed is fixed, its output ciphertext is also fixed.

[0070] The form of the aforementioned encryption seed can be determined based on the requirements of the corresponding encryption algorithm for random perturbation. In a specific encryption algorithm, the encryption seed can be directly configured in the encryption algorithm (i.e., represented as a parameter set in the encryption algorithm), or it can be attached to the encryption process as an external plugin.

[0071] For example, in a post-quantum encryption algorithm based on LWE (Learning with Errors), the algorithm's parameters include an error e composed of random numbers, which is attached to the plaintext during encryption. Due to the algorithm's characteristics, the error e's value is less than q / 4 (where q is the modulus), ensuring that the decrypted result directly removes random perturbations. Therefore, in practical applications, the encryption seed can be configured as the error e.

[0072] For example, in the Elliptic Curve Asymmetric Encryption Algorithm (SM2) released by the State Cryptography Administration of China, a random number k can be generated during the encryption process, and then the encryption calculation is performed based on the random number. Therefore, in practical applications, the encryption seed can be configured as a random number k, instead of being generated by the encryption algorithm itself.

[0073] Furthermore, for encryption algorithms that do not support random perturbation at the algorithmic level, it can be added as an add-on during the encryption process. This process generally involves mixing random perturbation into the plaintext. For example, the encryption seed can be mixed with plaintext according to specific rules, and the encryption algorithm encrypts the mixture. During decryption, the plaintext can be extracted from the decryption result based on the preset mixing rules.

[0074] After determining the target encryption result corresponding to the first data based on the aforementioned S220, the target encryption result can be sent to the client (i.e., S230 is executed) so that the client can decrypt the target encryption result and receive the first data. Preferably, the aforementioned S230 can be transmitted based on a trusted network environment.

[0075] In the aforementioned S240, the decrypted data can refer to the data obtained by the client after decrypting the target encryption result. It should be noted that, considering the possibility of transmission errors or other anomalies, even if the client accurately decrypts the data, the resulting data may not be consistent with the initial data.

[0076] To verify the consistency between the first data and the aforementioned decrypted data, the client can re-execute the encryption process based on the decrypted data to verify whether the received data is the authentic first data.

[0077] The execution process of S240 can be based on the general decryption process of post-quantum encryption and classical encryption methods. Decryption can generally be performed using a key (or private key).

[0078] Following the aforementioned verification process, S250 and S260 correspond to S210 and S220. The verification seed in S250 is actually the mapping result of the decrypted data based on the same first hash function, and its usage and properties are consistent with the encryption seed. The chain encryption process in S260 is strictly consistent with that in S250, and the result of re-encryption in S260 can be recorded as the encryption result verification value.

[0079] Considering that the reproduction processes of S250 and S260 are completely consistent with those of S210 and S220, if the first data is consistent with the decrypted data, then the encryption result verification value is theoretically completely consistent with the target encryption result. Therefore, the consistency between the encryption result verification value and the target encryption result (e.g., comparing the file bit by bit) can be used to verify whether the first data is the same as the verification data.

[0080] The aforementioned S270 can be an execution step following a comparison and verification of the encrypted result verification value with the target encrypted result. That is, when the encrypted result verification value matches the target encrypted result, it indicates that the decrypted data is actually consistent with the first data sent by the server, and the client can use this data.

[0081] Corresponding to S270 above, if the verification value of the encryption result is inconsistent with the target encryption result, it indicates that the data transmitted by the server is abnormal or the data is abnormal during transmission (generally, the server mistakenly sent the data to other clients). In this case, the client can discard the data.

[0082] This application does not limit the processing performed by the client after using the first data. For example, when the first data is a truly random number, the client can directly apply the first data to scenarios that require truly random numbers (such as probability calculations based on random numbers).

[0083] In some embodiments, when the first data is a truly random number, it can also generate a symmetric key for subsequent data exchange between the server and the client. For details on this process, please refer to [link to relevant documentation]. Figure 5 The details and related descriptions will not be elaborated here.

[0084] Therefore, the aforementioned data communication method optimizes the data transmission process. When the server transmits data to the client, chain encryption can be performed using two encryption algorithms, configured as a post-quantum cryptography-based algorithm and a classical encryption algorithm, respectively. Thus, the encrypted data possesses the theoretical security of classical encryption algorithms while also being resistant to decryption by quantum computers due to the post-quantum encryption algorithm. Furthermore, during chain encryption, a fixed hash function is used to process the encrypted data, determining a reproducible encryption seed. This allows the client to verify the encryption result by re-encrypting the decrypted data, eliminating the need for additional verification data and further ensuring the security of the data transmission process.

[0085] Exemplary encryption / decryption process:

[0086] To further illustrate the aforementioned encryption and decryption process, this application also provides a more detailed signaling diagram of the encryption and decryption process based on an asymmetric algorithm for the steps between S220 and S240. Figure 3Asymmetric encryption algorithms refer to algorithms that use different keys for encryption and decryption. Therefore, the server can encrypt data using only the client's public key without needing to know the client's private key.

[0087] like Figure 3 As shown, the encryption / decryption process based on an asymmetric algorithm, P300, may include the following steps:

[0088] S310, The server obtains the public key of the first encryption algorithm and the public key of the second encryption algorithm.

[0089] S320. The server configures the first encryption seed as a random perturbation of the first encryption algorithm, and then executes the first encryption algorithm on the first data based on the public key of the first encryption algorithm to determine the intermediate encryption result of the first data after being encrypted by the first encryption algorithm.

[0090] S330. The server configures the second encryption seed as a random number of the second encryption algorithm, and executes the second encryption algorithm using the public key of the second encryption algorithm to determine the target encryption result.

[0091] S340, The server sends the target encryption result to the client.

[0092] S350: The client decrypts the target encryption result based on the private key of the second encryption algorithm and determines the intermediate decryption result after the target encryption result is decrypted.

[0093] S360: The client decrypts the intermediate decryption result based on the private key of the first encryption algorithm, and determines the decrypted data after the intermediate decryption result is decrypted.

[0094] Given the characteristics of asymmetric encryption and decryption, the public key used for encryption in asymmetric encryption algorithms is often public, while the private key used for decryption is kept secret. When transmitting data to this end, the public key can be obtained first (e.g., through access or download, or by obtaining it through communication methods), and then the data can be encrypted and transmitted based on the public key.

[0095] The aforementioned S310 reflects the server's process of obtaining the public keys for the first and second encryption algorithms. This acquisition of the public keys is generally performed in response to a client's communication request. For example, the server may, in response to a client's communication request, parse the public keys for the first and second encryption algorithms from the communication request, access the client or other storage locations to download the public keys, or retrieve the downloaded public keys.

[0096] Based on the aforementioned post-quantum transfer requirements, this application can perform post-quantum encryption first during chain encryption to facilitate subsequent decoupling. Specifically, in P300, the first encryption algorithm is configured as an asymmetric encryption algorithm based on post-quantum cryptography (such as an asymmetric encryption algorithm satisfying IND-CPA). The second encryption algorithm is configured as an asymmetric encryption algorithm based on elliptic curve cryptography (such as the encryption algorithm in the SM2 standard).

[0097] Furthermore, to further enhance the security of the target encryption result, this application can use two encryption seeds, allowing the first encryption algorithm and the second encryption algorithm to be executed based on different encryption seeds. Here, the two encryption seeds are independent and unrelated at the data level, thus ensuring the independence of the two encryption processes.

[0098] Therefore, in the aforementioned S320, the first encryption algorithm configured as a post-quantum encryption algorithm can encrypt the first data based on the first encryption seed, thereby obtaining the encryption result of the first data after being encrypted by the first encryption algorithm (referred to as the intermediate encryption result).

[0099] Given that post-quantum encryption algorithms were developed relatively recently, random perturbations are often directly introduced into the algorithm design. Therefore, when executing an encryption algorithm based on a first encryption seed, the first encryption algorithm itself often supports the first encryption seed in the form of random perturbations or errors. Its introduction into the encryption process can be directly based on the inherent characteristics of the post-quantum encryption algorithm.

[0100] The asymmetric encryption algorithm based on elliptic curve cryptography used in this application also supports random perturbation (i.e., random number k in the encryption process) during its design. Therefore, when executing S330, the corresponding second encryption seed can be directly loaded and used as the random number k in the encryption algorithm for encryption.

[0101] Based on the target encryption result determined in S320 and S330, data transmission (i.e., S340) can be performed to send it to the client.

[0102] The client can perform the decryption process for asymmetric encryption. Since the key generation for the first and second encryption algorithms is actually performed by the client, the client itself holds the private keys for both algorithms. After receiving the target encryption result, the client can decrypt it based on its private key. The decryption order is the reverse of the encryption order described above.

[0103] That is, the client can first perform private key decryption based on the second encryption algorithm (i.e., S350), and then perform private key decryption based on the first encryption algorithm (i.e., S360) to determine the decryption result (i.e., decrypted data) of the aforementioned target encrypted data.

[0104] In some embodiments, the client's keys are generated before the aforementioned S310. That is, the client can generate the public and private keys of the first encryption algorithm and the second encryption algorithm, then generate a communication request and send it to the server. Instead, after receiving the communication request, the server can obtain the public keys of the first and second encryption algorithms from the client according to the agreed-upon method or pre-agreed method in the communication request.

[0105] In some embodiments, considering that key generation in asymmetric encryption often relies on random numbers, the client can generate random numbers before key generation when generating the aforementioned private and public keys. That is, the client can generate a seed using a random number generation algorithm to generate second data. Based on the second data, the key generation algorithms for the first and second encryption algorithms are executed to determine the public and private keys of the first and second encryption algorithms. The aforementioned second data is a pseudo-random number.

[0106] As can be seen from the foregoing, the coupling of post-quantum encryption algorithms and classical encryption algorithms in this application is actually a "compromise" when the security of post-quantum encryption algorithms themselves is not universally recognized. However, when the security of post-quantum encryption algorithms is subsequently recognized and post-quantum migration is performed, the classical encryption algorithm can be removed, and communication can rely solely on the post-quantum encryption algorithm.

[0107] Based on the aforementioned chain-like encryption process, this application executes the post-quantum encryption algorithm first during the chain-like encryption process. This algorithm can be directly removed during subsequent post-quantum transfers without affecting the communication architecture itself. That is, the data communication method of this application can pre-define the response to the post-quantum transfer instruction, and based on making the communication system respond to the post-quantum transfer instruction, the intermediate encryption result is configured as the target encryption result (i.e., the second encryption algorithm is configured to be skipped in response to the post-quantum transfer execution). In this case, data communication can be performed solely based on the first encryption algorithm.

[0108] To further illustrate this process, this application also provides a signaling diagram of the encryption / decryption process after quantum migration. Figure 4 ).

[0109] like Figure 4 As shown, after responding to the post-quantum migration command, the communication system can issue configuration adjustment commands to both the server and the client to adjust their encryption and decryption processes. Figure 4 The process shown is P400.

[0110] As shown on page 400, the encryption / decryption process following the quantum transfer instruction may include the following steps:

[0111] S410, The server obtains the public key of the first encryption algorithm.

[0112] S420. The server executes the first encryption algorithm on the first data based on the first encryption seed and the public key of the first encryption algorithm, and determines the target encryption result of the first data after being encrypted by the first encryption algorithm.

[0113] S430, The server sends the target encryption result to the client.

[0114] S440: The client decrypts the target encryption result based on the private key of the first encryption algorithm and determines the decrypted data after the target encryption result is decrypted.

[0115] In other words, compared to the aforementioned P300, the P400 can directly configure the intermediate encryption result as the target encryption result. That is, the intermediate encryption result can also be configured as the target encryption result in response to the post-quantum transfer instruction.

[0116] Subsequent communication process based on true random numbers:

[0117] In some embodiments, considering that the first data can be a truly random number, and that both the client and the server know the random number based on the aforementioned communication process, a symmetric key can be constructed based on the random number to transmit data between the server and the client.

[0118] In this scenario, the symmetric key's security is guaranteed by the unpredictability of the true random number itself.

[0119] To illustrate the foregoing in detail, this application also provides an exemplary flowchart of a symmetric key generation process ( Figure 5 ).

[0120] like Figure 5 As shown, the symmetric key generation process P500 can be executed by the client after the client has completed the generation of the encryption result verification value.

[0121] like Figure 5 As shown, P500 may include the following steps:

[0122] S510. Determine whether the target encryption result is consistent with the encryption result verification value.

[0123] S520. If so, execute the second hash function on the first data to determine the key and generate the seed value.

[0124] S530, based on a symmetric key generation algorithm and a key generation seed value, generates a symmetric encryption key for communication data between the client and the server.

[0125] S540, if not, the current communication is deemed to have failed.

[0126] In the aforementioned P500, S510 can be a single judgment step, while S520 and S540 are two different judgment branches of S510. That is, when the judgment result of S510 is yes, S520 and S530 are executed. When the judgment result of S510 is no, S540 is executed.

[0127] In the aforementioned S510, if no anomalies are found, the target encryption result and the encryption result verification value should theoretically be the same. The aforementioned S510 is often implemented through bit-by-bit comparison. For example, a constant-time comparison algorithm can be used to execute the aforementioned S510.

[0128] In the aforementioned S520, considering that the true random number itself is determined through observation of the quantum entropy source, its internal data distribution may not be directly used for key generation. In this step, the first data can be conditioned using a hash function to eliminate statistical defects, ensuring that its distribution and representation meet cryptographic requirements. Specifically, the defective entropy of the true random number (such as partially fixed and partially random) can generally be adjusted to a high entropy value (globally uncorrelated randomness).

[0129] When the first data is a truly random number, the processing logic of the first hash function is essentially the same as that of the second hash function. Therefore, in actual execution, the first hash function and the second hash function can be encapsulated into a single hash function, and the key can be directly generated to generate the seed value when the encryption seed is generated.

[0130] In practical applications, the hash value of the first data and the public key (the concatenation of the public key of the first encryption algorithm and the public key of the second encryption algorithm) can be input into the hash function to generate at least one encryption seed and key generation seed value.

[0131] In the aforementioned S530, the symmetric encryption key can be the key of a symmetric encryption algorithm, meaning that in a symmetric encryption algorithm, the encryption of plaintext and the decryption of ciphertext are based on the same key (i.e., the symmetric encryption key). In S530, the symmetric encryption key can be implemented through key derivation, meaning that the aforementioned symmetric key generation algorithm can be a cryptographic pseudo-random function (Key Derivation Function, KDF).

[0132] During the execution of KDF, the aforementioned first data can be used as key material to provide entropy values, thereby generating the corresponding symmetric encryption key.

[0133] In some embodiments, to further enhance the security of the symmetric encryption key, the target encryption result of the aforementioned transmission of the first data can be used as input to the KDF for identity binding. Specifically, when inputting the target encryption result, the target encryption result can be hashed and then used together with the first data as input.

[0134] Therefore, the aforementioned S530 can further include the following steps:

[0135] S531. Input the target encryption result into the third hash function to determine the encryption information.

[0136] S532. Input the key generation seed and encryption information into the symmetric key generation algorithm to generate a definite symmetric encryption key.

[0137] Considering the first data already recorded on the server, the aforementioned operations S520 and S530 can be reproduced on the server to generate the same symmetric encryption key.

[0138] If the aforementioned S510 determination is negative, it indicates an anomaly in the communication between the client and the server. In practical applications, this can be addressed by re-initiating communication, changing the communication server, or adjusting the communication channel.

[0139] Furthermore, anomalies in communication between the client and server indicate that the private key held by the client does not correspond to the target encryption result. That is, the target encryption result sent by the server is the first data required by other clients. Therefore, in subsequent processes, even if the server incorrectly sends data to other clients, the server should maintain the symmetric encryption key built based on the first data until the client that should receive the data re-initiates communication or successfully verifies it. For clients that fail verification, considering that the algorithm requires a symmetric encryption key as a return value, this return value can be built based on the second data (i.e., the random number used to generate the encryption key). This data is only used as a return value and does not participate in actual communication.

[0140] Example communication process:

[0141] To further illustrate the data communication method provided in this application, this application uses an actual algorithm as an example to explain the communication process of this application.

[0142] The post-quantum encryption algorithm involved in this application can be denoted as CPAPKE, which can actually be an asymmetric encryption algorithm that satisfies IND-CPA. The aforementioned classical encryption algorithm can be an encryption algorithm under the SM2 standard, denoted as SM2.

[0143] Asymmetric encryption algorithms typically include three functions: KeyGen(), Enc(pk,m,r), and Dec(sk,c). KeyGen() generates the key, Enc(pk,m,r) encrypts plaintext m using the public key pk and encryption seed r, and Dec(sk,c) decrypts ciphertext c using the private key sk.

[0144] In the aforementioned complete communication process, the client can first perform the following steps to generate a public key and a private key.

[0145] CPAPKE_KeyGen() → (pk1, sk1). This function generates the public and private keys based on the post-quantum encryption algorithm (i.e., the first encryption algorithm).

[0146] SM2_KeyGen() → (pk2, sk2). This function generates a public and private key based on a classic encryption algorithm (i.e., the second encryption algorithm).

[0147] (pk1||pk2) → pk. Considering that subsequent processing involves hashing the public key, the public keys of the two encryption algorithms can be concatenated (bit-level splicing) to form the public key of the encryption algorithm as a whole.

[0148] The aforementioned public key can be made public or transmitted to the server.

[0149] After obtaining the public key from the server, the following steps can be performed to generate the target encrypted result.

[0150] RealRandom() → m. Here, RealRandom reflects the observation process of the quantum entropy source and can generate a truly random number m. For example, m can be a 256-bit binary value (i.e., (0,1)). 256 ).

[0151] G(m||H(pk)) → (K, r1, r2). Here, G and H are hash functions. The first and second hash functions are combined into a single hash function G, which outputs the encryption seed (r1, r2) and the key generation seed (k). H is another hash function (i.e., the third hash function), primarily used to map data to binary data of a specific size. For example, the aforementioned hash function G can map data to a 3D 256-bit binary data, and the hash function H can map data to a 1D 256-bit binary data.

[0152] CPAPKE.Enc(pk1,m,r1) →c1. This process encrypts the first data based on the first encryption seed. c1 represents the intermediate encryption result.

[0153] SM2.Enc(pk2,c1,r2) →c2. This process encrypts the intermediate encryption result c1 based on the second encryption seed. C2 is the target encryption result. This target encryption result can be sent to the client.

[0154] Furthermore, considering that the client will generate a symmetric encryption key based on the aforementioned truly random number after verifying it, the same steps can be performed on the server to pre-generate the symmetric encryption key.

[0155] KDF(K||H(c2)) → k1. Where k1 is a symmetric encryption key based on a truly random number m.

[0156] Once the client receives the target encrypted result, it can decrypt it, as follows.

[0157] SM2.Dec(sk2,c2) → c3.

[0158] CPAPKE.Dec(sk1,c1) → d. Considering that the ciphertext c may encounter anomalies during transmission, the data related to the aforementioned decryption process is represented using other terms. Here, c3 represents the intermediate decryption result, and d represents the decrypted data. Subsequent re-encryption based on d can be used for verification.

[0159] G(d||H(pk)) → (K', r1', r2'). Here, r1' and r2' are similar to the cases of c3 and d mentioned above, and can be denoted as verification seeds.

[0160] CPAPKE.Enc(pk1,d,r1') →c1'. SM2.Enc(pk2,c1',r2') →c2'. c2' is the verification value of the encryption result.

[0161] Therefore, the verification value of the encrypted result can be compared with the target encrypted result.

[0162] If c2 = c2', then execute KDF(K||H(c2)) → k1, and use k1 as the symmetric encryption key.

[0163] If c2 ≠ c2', then execute KDF(n||H(c2)) → k2. Here, k2 is the random number (denoted as the second data) involved in the aforementioned key generation process. The symmetric encryption key based on k2 is only used as the return value of the algorithm and is not used for actual communication.

[0164] Example single-end processing procedure:

[0165] Based on the foregoing description, this application has fully explained the communication process between the server and the client. Considering that the server mainly provides encrypted data to the client in this application, and considering that the data will be structured by the client while the client is the subject of other related verification operations, the data communication method executed by the client is technically equivalent to the aforementioned two-end data communication method and also falls within the protection scope of this application.

[0166] To further illustrate this point, this application also provides an exemplary flowchart of a data communication method executed by a client ( Figure 6 ).

[0167] like Figure 6 As shown, process P600 may include the following steps:

[0168] S610. The server of the receiving communication system responds to the communication request of the client by sending back the target encryption result, wherein the target encryption result is the result of chain encryption of the first data generated by the server by the first encryption algorithm and the second encryption algorithm based on at least one encryption seed, the at least one encryption seed is the result of inputting the first data into the first hash function, one of the first encryption algorithm and the second encryption algorithm is configured as a post-quantum cryptography-based encryption algorithm, and the other is configured as a classical encryption algorithm.

[0169] S620. Decrypt the target encryption result to determine the decrypted data.

[0170] S630. Based on the decrypted data, execute the first hash function to determine at least one verification seed corresponding to at least one encryption seed.

[0171] S640. Using the first encryption algorithm and the second encryption algorithm, chain encryption is performed on the decrypted data based on at least one verification seed to determine the verification value of the encryption result after the decrypted data is encrypted.

[0172] S650, In response to the target encryption result being consistent with the encryption result verification value, the first data is adopted.

[0173] The technical terms and actual implementation methods mentioned in P600 can be found in the aforementioned content, and will not be repeated here.

[0174] Corresponding to the data communication method executed by the aforementioned client, this application also provides a data communication method executed by the server.

[0175] The data communication method may include the following steps:

[0176] First, in response to a communication request from a client of the communication system, first data is generated, and a first hash function is executed based on the first data to determine at least one encryption seed.

[0177] Next, chain encryption is performed on the first data using a first encryption algorithm and a second encryption algorithm based on at least one encryption seed to determine the target encryption result of the first data. One of the first encryption algorithm and the second encryption algorithm is configured as a post-quantum cryptography-based encryption algorithm, and the other is configured as a classical encryption algorithm.

[0178] Finally, the target encryption result is sent to the client so that the client can execute the processing procedure shown on page 600 above. That is, the client first decrypts the target encryption result to determine the decrypted data, then executes the first hash function based on the decrypted data to determine at least one verification seed corresponding to at least one encryption seed, then uses the first encryption algorithm and the second encryption algorithm to perform chain encryption on the decrypted data based on at least one verification seed to determine the verification value of the encrypted result after decryption; finally, in response to the target encryption result matching the encryption result verification value, the first data is used.

[0179] It should be noted that in actual implementation, the functions performed by the server and the client correspond. Although the re-encryption verification process is generally performed by the client, the server should actually be configured with corresponding processing logic. For example, when the client executes the data communication method provided in this application (such as P600), it can be inferred without a doubt that the corresponding server uses the data communication method executed on the server in this application.

[0180] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0181] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0182] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0183] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0184] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0185] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program verification codes, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0186] It should be noted that in the description of this application, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0187] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications or equivalent substitutions made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A data communication method based on post-quantum cryptography, characterized in that, Applied to a communication system, for a server and a client in a communication connection within the system, the data communication method includes: The server generates first data in response to the client's communication request, and performs a first hash function based on the first data to determine at least one encryption seed; The server uses a first encryption algorithm and a second encryption algorithm to perform chain encryption on the first data based on at least one encryption seed to determine the target encryption result of the first data. In this case, one of the first encryption algorithm and the second encryption algorithm is configured as a post-quantum cryptography-based encryption algorithm, and the other is configured as a classical encryption algorithm. The server sends the target encryption result to the client; The client decrypts the target encryption result to determine the decrypted data; The client executes the first hash function based on the decrypted data to determine at least one verification seed corresponding to the at least one encryption seed; The client uses the first encryption algorithm and the second encryption algorithm to perform chain encryption on the decrypted data based on the at least one verification seed, and determines the verification value of the encrypted result of the decrypted data. The client responds to the fact that the target encryption result matches the encryption result verification value and uses the first data.

2. The data communication method according to claim 1, characterized in that, The at least one encryption seed includes a first encryption seed and a second encryption seed that are independent of each other. The step of performing chain encryption on the first data based on the at least one encryption seed using the first encryption algorithm and the second encryption algorithm to determine the target encryption result of the first data includes: The first encryption seed is configured as a random perturbation of the first encryption algorithm, and the first encryption algorithm is executed on the first data based on the public key of the first encryption algorithm to determine the intermediate encryption result of the first data after being encrypted by the first encryption algorithm. The first encryption algorithm is configured as an asymmetric encryption algorithm based on post-quantum cryptography. The second encryption seed is configured as a random number of the second encryption algorithm, and the second encryption algorithm is executed using the public key of the second encryption algorithm to determine the target encryption result, wherein the second encryption algorithm is configured as an asymmetric encryption algorithm based on elliptic curve cryptography.

3. The data communication method according to claim 2, characterized in that, The data communication method further includes: The client generates the public and private keys of the first encryption algorithm and the second encryption algorithm, wherein the public key of the first encryption algorithm and the public key of the second encryption algorithm are obtained by the server. The client generates the communication request and sends it to the server; The client decrypts the target encryption result to determine the decrypted data, including: The target encryption result is decrypted based on the private key of the second encryption algorithm to determine the intermediate decryption result after the target encryption result is decrypted; The intermediate decryption result is decrypted using the private key of the first encryption algorithm to determine the decrypted data after the intermediate decryption result is decrypted.

4. The data communication method according to claim 3, characterized in that, The generation of the public and private keys for the first encryption algorithm and the second encryption algorithm includes: The second data is generated by using a random number generation algorithm to generate a seed based on random numbers. Based on the second data, execute the key generation algorithm of the first encryption algorithm and the key generation algorithm of the second encryption algorithm to determine the public and private keys of the first encryption algorithm and the public and private keys of the second encryption algorithm.

5. The data communication method according to claim 2, characterized in that, The data communication method further includes: The communication system responds to the post-quantum transfer instruction by configuring the intermediate encryption result as the target encryption result; Specifically, the first encryption algorithm and the second encryption algorithm are used to perform chain encryption on the first data based on the at least one encryption seed, and the target encryption result of the first data after encryption is determined as follows: Based on the first encryption seed and the public key of the first encryption algorithm, the first encryption algorithm is executed on the first data to determine the target encryption result of the first data after being encrypted by the first encryption algorithm; The step of decrypting the target encryption result to determine the decrypted data includes: The private key of the first encryption algorithm decrypts the target encryption result, determines the decryption value of the target encryption result, and configures it as decrypted data.

6. The data communication method according to claim 1, characterized in that, The use of the first data includes: A second hash function is executed on the first data to determine the key and generate a seed value, wherein the first data is configured as a true random number generated by the server based on a quantum entropy source; The symmetric encryption key for communication data between the client and the server is generated based on the symmetric key generation algorithm and the key generation seed value.

7. The data communication method according to claim 6, characterized in that, The process of generating a symmetric encryption key for communication data between the client and the server based on a symmetric key generation algorithm and a key generation seed value includes: The target encryption result is input into a third hash function to determine the encrypted information; The key generation seed and the encryption information are input into the symmetric key generation algorithm to generate and determine the symmetric encryption key.

8. A data communication method based on post-quantum cryptography, characterized in that, The data communication method, applied to a client in a communication system, includes: The server of the communication system receives the target encryption result returned in response to the communication request of the client. The target encryption result is the result of chain encryption of the first data generated by the server through a first encryption algorithm and a second encryption algorithm based on at least one encryption seed. The at least one encryption seed is the result of inputting the first data into a first hash function. One of the first encryption algorithm and the second encryption algorithm is configured as a post-quantum cryptography-based encryption algorithm, and the other is configured as a classical encryption algorithm. The target encryption result is decrypted to determine the decrypted data; Based on the decrypted data, the first hash function is executed to determine at least one verification seed corresponding to the at least one encryption seed; The first encryption algorithm and the second encryption algorithm are used to perform chain encryption on the decrypted data based on the at least one verification seed to determine the verification value of the encrypted result of the decrypted data. In response to the target encryption result being consistent with the encryption result verification value, the first data is used.

9. A data communication method based on post-quantum cryptography, characterized in that, The data communication method, applied to a server in a communication system, includes: In response to a communication request from a client of the communication system, first data is generated, and a first hash function is executed based on the first data to determine at least one encryption seed; The first data is chain-encrypted using a first encryption algorithm and a second encryption algorithm based on at least one encryption seed to determine the target encryption result of the first data. In this case, one of the first encryption algorithm and the second encryption algorithm is configured as a post-quantum cryptography-based encryption algorithm, and the other is configured as a classical encryption algorithm. The target encryption result is sent to the client; the client decrypts the target encryption result to determine the decrypted data, then executes the first hash function based on the decrypted data to determine at least one verification seed corresponding to the at least one encryption seed, then uses the first encryption algorithm and the second encryption algorithm to perform chain encryption on the decrypted data based on the at least one verification seed to determine the encryption result verification value of the decrypted data; finally, in response to the target encryption result being consistent with the encryption result verification value, the first data is used.

10. An electronic device, characterized in that, The electronic device includes a memory and a processor, and is configured as a client or server in a communication system. The memory stores a computer program, and the processor executes the computer program to implement the steps performed by the server or client in the data communication method according to any one of claims 1 to 7.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps performed by the server or client in the data communication method of any one of claims 1 to 7, or the data communication method of claim 8 or 9.

Images