Cryptographic infrastructure system and method of communication based on a cryptographic infrastructure system

Abstract

The application provides a cryptographic infrastructure system and a communication method based on the cryptographic infrastructure system, relates to the technical field of quantum secure communication, and comprises a quantum communication layer, a cryptographic service layer and a service application layer.The quantum communication layer is used for performing a quantum key distribution protocol through a quantum key distribution link and generating a quantum key in combination with a key relay; the cryptographic service layer is used for acquiring the quantum key from the quantum communication layer and providing a cryptographic service for the service application layer; and the service application layer interacts with the cryptographic service layer through a security middleware.The embodiment of the application deeply fuses quantum key distribution and post-quantum cryptography, and bidirectional identity authentication is performed between a user and each network element of the cryptographic infrastructure, between each layer and each network element in the cryptographic infrastructure, and a bidirectional transmission layer security channel based on the bidirectional identity authentication is established between each two.

Description

Technical Field

[0001] This invention relates to the field of quantum secure communication technology, and in particular to a cryptographic infrastructure system and a communication method based on the cryptographic infrastructure system. Background Technology

[0002] With the rapid development of IP-based 4G and 5G mobile communication technologies, modern telecommunications operators are facing unprecedented information security challenges. Traditional cryptographic methods, such as public key infrastructure (PKI)-based encryption systems, while providing reliable security for data transmission over the past few decades, are now threatened by the rapid advancements in quantum computing technology.

[0003] The powerful computing capabilities of quantum computers could potentially break existing asymmetric encryption algorithms, such as RSA and ECC, in the future, putting traditional PKI systems that rely on these algorithms at risk of failure. Therefore, exploring a new generation of cryptographic infrastructure capable of withstanding quantum attacks has become a top priority.

[0004] Quantum key distribution (QKD), a novel key exchange technology based on the principles of quantum mechanics, offers an important approach to solving this problem with its core advantage of "unconditional security".

[0005] QKD leverages the non-cloning and measurement perturbation properties of quantum states to ensure the security of the key distribution process, making it difficult to crack even in the face of attacks from quantum computers. This technology not only provides long-term security guarantees in theory but also lays a solid foundation for building next-generation cryptographic infrastructure.

[0006] The core advantage of QKD lies in its "unconditional security," meaning that the key distribution process, based on quantum mechanics, is unaffected by computational power and cannot be cracked even by quantum computers. However, the practical application of QKD is limited by the physical dependence of quantum channels, and its applicability is mainly concentrated in key distribution for specific scenarios. In contrast, PQC (Post-Quantum Cryptography), through the design of quantum-resistant mathematical algorithms, can be widely deployed in traditional network architectures and is suitable for various communication needs. However, the security of PQC relies on the complexity of the mathematical problems, and although its design goal is to resist quantum computing attacks, theoretically, unknown vulnerabilities may still exist. Summary of the Invention

[0007] In view of the above problems, embodiments of the present invention are proposed to provide a cryptographic infrastructure system and a corresponding communication method based on the cryptographic infrastructure system to overcome or at least partially solve the above problems.

[0008] To address the aforementioned problems, embodiments of the present invention disclose a cryptographic infrastructure system, the system comprising:

[0009] A quantum communication layer is used to execute a quantum key distribution protocol via a quantum key distribution link, and to generate quantum keys in conjunction with a key relay; the quantum communication layer includes a quantum key distribution network (QKDN), which includes a quantum key manager (QKM), a quantum key distributor (QKD), and a quantum network controller (QKDNC);

[0010] A cryptographic service layer is used to obtain the quantum key from the quantum communication layer and to provide cryptographic services to the business application layer; the cryptographic service layer includes a key management system (KMS), a cryptographic management service platform (CMSP), a certificate authentication system (CAS), an identity and access management system (IAM), and a collaborative cryptographic operation system (CCS);

[0011] The business application layer interacts with the cryptographic service layer through a security middleware; the business application layer is equipped with cryptographic components, and the types of cryptographic components include: application APP-1 equipped with a secure SIM card, application APP-2 equipped with a secure TF card, application APP-3 equipped with a software cryptographic module, device DEV-1 equipped with a PCI cryptographic card, and device DEV-2 equipped with a cryptographic security chip.

[0012] In one or more embodiments, the Cryptography Management Service Platform (CMSP) runs processes for Cryptography Service Management (CSM), Cryptography Application Management (CAM), Cryptography Service Orchestration (CSO), Cryptography Compliance Monitoring (CCS), and Algorithm Agile Management (AAM). Through the Md, Ma, Mo, Mc, and Am call interfaces, it provides services such as cryptography service status monitoring, user account and application management, cryptography resource scheduling, algorithm correctness and random number quality compliance management, and PQC algorithm management via HTTP / REST, RPC, and SSH / SFTP remote calls. By running the AAM process, it updates the PQC algorithm configurations and algorithm libraries used by various components of the infrastructure and user terminals. These updates include algorithm replacement, security patches, and algorithm policy configuration.

[0013] In one or more embodiments, the Key Management System (KMS) connects to a server cryptographic machine or a cloud server cryptographic machine, establishes a QKD key pool and a PQC public key pool in the form of a memory KV database encrypted with the local master key of the cryptographic machine, uses the QKD key pool to store the quantum keys distributed by QKD, and the PQC public key pool generates and stores the user's PQC encrypted public key; runs the processes of Cryptographic Service Agent (CSA), Key Management Agent (KMA), and Key Injection Manager (KIM), and provides data encryption and decryption, key lifecycle management, and master key injection services to the external network through the Km call interface in the form of remote calls via HTTP / REST, RPC, and binary TLV encoding.

[0014] In one or more embodiments, the Certificate Authentication System (CAS) establishes a certificate store using a combination of an in-memory document database and a disk relational database, runs processes for online certificate registration and issuance (CEIS), certificate status query (CSP), and certificate directory service (LDAP), and provides hybrid certificate services using PQC and commercial cryptographic algorithms through Ce, Cq, and Cd call interfaces, based on ACME, SCEP, and EST digital certificate related protocols.

[0015] In one or more embodiments, the Identity and Access Management System (IAM) establishes a user identity database by combining in-memory and disk relational databases, runs the processes of User Identity Management (IDM), User Rights Management (UPM), and User Behavior Auditing (UBA), and provides user identity management services through Ia, Id, Pm, and Ua call interfaces in the form of HTTP / REST or RPC / XML remote calls.

[0016] In one or more embodiments, the collaborative cryptographic operation system CCS runs the processes of PQC collaborative signature PCS, PQC collaborative decryption PCC, and PQC public key generation PKG. It provides collaborative cryptographic operation services through Cs, Ck, and Cc call interfaces in the form of remote calls in HTTP / REST, RPC, and binary TLV encoding, and completes collaborative cryptographic operations with the client program of the user terminal.

[0017] In one or more embodiments, the system further includes managing class interaction relationships and corresponding calling interfaces, including:

[0018] a) Management orchestration interface Mo, including interface Mo-1 connecting Key Service Orchestration (CSO) with various business applications, and interface Mo-2 connecting Key Management Agent (KMA) for transmitting service orchestration information and data;

[0019] b) Device management interface Md, including interface Md-1 that connects the cryptographic service management (CSM) with cryptographic devices related to various business applications, used to transmit cryptographic device control information and data;

[0020] c) Application management interface Ma, including interface Ma-1 connecting cryptographic application management CAM with various business applications, and interface Ma-2 connecting with key management system KMS, used to transmit cryptographic application control information and data;

[0021] d) The password compliance check interface Mc includes the interface Mc-1 that connects the password compliance monitoring CCS with various business applications, and the interface Mc-2 that connects with the key management system KMS, for transmitting compliance control information and data;

[0022] e) Algorithm Agility Management Interface Reference Point Am, including interface reference point Am-1 connecting Algorithm Agility Management (AAM) with various business applications, and interface reference point Am-2 connecting with Key Management System (KMS), used to transmit algorithm updates, security patches, and algorithm policy data.

[0023] In one or more embodiments, the system further includes service-type interaction relationships and invocation interfaces, including:

[0024] a) Key management interface Km, including interface Km-1 connecting key management agent KMA with various business applications, interface Km-2 interconnecting key management system KMS, and interface Km-3 connecting key management agent KMA and quantum key manager QKM, used to transmit key management related information and data;

[0025] b) Quantum key distribution interface Kq, including interface Kq-1 connecting quantum key manager QKM and quantum key distributor QKD, and interface Kq-2 connecting quantum key manager QKM and quantum network controller QKDNC, used to transmit quantum key distribution related information and data;

[0026] c) Collaborative cryptographic operation call interface, including interfaces connecting the collaborative cryptographic operation modules of the Collaborative Cryptographic Operation System (CCS) and various business applications, including interface Cs-1 for PQC Collaborative Signature PCS, interface Cc-1 for PQC Collaborative Decryption PCS, and interface Ck-1 for PQC Public Key Generation PKG, used to transmit corresponding collaborative cryptographic algorithm calls and key management related commands and data.

[0027] d) Certificate service interfaces, including interfaces connecting various service modules of the Certificate Authentication System (CAS) with various network elements and user terminals. These include interface Ce-1 connecting the Key Management System (KMS) to the Certificate Online Registration and Issuance System (CEIS), interface Ce-2 connecting user terminals to CEIS, interface Ce-3 connecting the Collaborative Cryptographic System (CCS) to CEIS, and interface Ce-4 connecting various network elements of the quantum key distribution network with the CEIS. It also includes interface Cq-1 connecting the Key Management System (KMS) to the Certificate Status Query Service (CSP), interface Cq-2 connecting user terminals to the CSP, and interface Cq-3 connecting various network elements of the quantum key distribution network with the CSP. Furthermore, it includes interface Cd-1 connecting the Key Management System (KMS) to the Certificate Directory Service (LDAP), interface Cd-2 connecting user terminals to LDAP, and interface Cd-3 connecting various network elements of the quantum key distribution network with LDAP, used to transmit commands and data related to certificate services.

[0028] In one or more embodiments, the system further includes identity-based interaction relationships and invocation interfaces, including:

[0029] a) Identity authentication interface reference points Ia, including: Ia-1 (interface reference point connecting the Cryptography Management Service Platform (CMSP) with various business applications); Ia-2 (interface reference point connecting the Key Management System (KMS) with various business applications); Ia-3 (interface reference point connecting the Certificate Authentication System (CAS) with various business applications); Ia-4 (interface reference point connecting the Identity and Access Management System (IAM) with various business applications); Ia-5 (interface reference point connecting the Collaborative Cryptographic Operation System (CCS) with various business applications); Ia-6 (interface reference point connecting the Cryptography Management Service Platform (CMSP) with the Key Management System (KMS); Ia-7 (interface reference point connecting the Key Management System (KMS) with the Certificate Authentication System (CAS); Ia-8 (interface reference point connecting the Key Management System (KMS) with the Identity and Access Management System (IAM)); and Ia-9 (interface reference point connecting the Key Management System (KM) with the Key Management System (KM). Interface reference point Ia-9 between S, interface reference point Ia-10 between Collaborative Cryptographic Operation System CCS and Certificate Authentication System CAS, interface reference point Ia-11 between Cryptographic Management Service Platform CMSP and various network elements of Quantum Key Distribution Network, interface reference point Ia-12 between Key Management Agent KMA and Quantum Key Manager QKM, interface reference point Ia-13 between Certificate Authentication System CAS and various network elements of Quantum Key Distribution Network, interface reference point Ia-14 between Identity and Access Management System IAM and various network elements of Quantum Key Distribution Network, interface reference point Ia-15 between Quantum Key Distributor QKD and Quantum Key Manager QKM, and interface reference point Ia-16 between Quantum Key Manager QKM and Quantum Network Controller QKDNC, used for transmitting identity authentication information and data;

[0030] b) Identity management interface Id, including interface Id-1 connecting the key management system KMS and the user identity management IDM, interface Id-2 connecting various business applications and the user identity management IDM, and interface Id-3 connecting each network element of the quantum key distribution network and the user identity management IDM, used to transmit relevant information and data such as user identity identifiers and attributes;

[0031] c) Access control interface Pm, including interface Pm-1 connecting the key management system KMS and the user access control UPM, interface Pm-2 connecting various business applications and the user access control UPM, and interface Pm-3 connecting each network element of the quantum key distribution network and the user access control UPM, used to transmit user access permission related information and data.

[0032] d) Behavior auditing interface Ua, including interface Ua-1 connecting the Key Management System (KMS) and User Behavior Auditing (UBA), interface Ua-2 connecting various business applications and User Behavior Auditing (UBA), and interface Ua-3 connecting various network elements of the quantum key distribution network and User Behavior Auditing (UBA), used to transmit user behavior auditing related information and data.

[0033] In one or more embodiments, the system further includes communication-related interaction relationships and calling interfaces, including:

[0034] a) Communication protocol interface Ax between user applications, including interface Ax-1 for smart terminals, interface Ax-2 for dedicated terminals, and interface Ax-3 for interoperability between cryptographic applications on the cloud of SaaS, used for information and data exchange between cryptographic applications of the same type based on a specific transmission protocol.

[0035] b) Communication protocol interface Dx between user equipment, including gateway-type interface Dx-1 and terminal-type cryptographic device interface Dx-2 for interoperability between similar devices, used for information and data exchange between similar cryptographic devices based on specific transmission protocols.

[0036] Accordingly, embodiments of the present invention disclose a communication method based on a cryptographic infrastructure system, applied to the aforementioned cryptographic infrastructure system, the method comprising:

[0037] User terminal initialization, generating user signature key pair;

[0038] The user terminal registers with the Identity and Access Management System (IAM) to obtain a registered identity.

[0039] The user terminal uses the registered identity to obtain a user encryption key pair from the key management system (KMS);

[0040] The user terminal uses the user encryption key pair and the user signature key pair to generate the user's PQC encryption algorithm public encryption key and PQC signature algorithm public signature key through the Collaborative Cryptographic System (CCS).

[0041] The user terminal uses the user encryption key pair, the user signature key pair, the user's PQC encryption algorithm public encryption public key, and the PQC signature algorithm public signature public key to register and issue a hybrid certificate of commercial cryptography algorithm and PQC algorithm online through the Certificate Authentication System (CAS). The hybrid certificate includes: a hybrid encryption certificate of commercial cryptography algorithm + PQC encryption algorithm and a hybrid signature certificate of commercial cryptography signature algorithm + PQC signature algorithm.

[0042] The user terminal uses a hybrid encryption certificate (commercial cryptographic encryption algorithm + PQC encryption algorithm) and a hybrid signature certificate (commercial cryptographic signature algorithm + PQC signature algorithm) to authenticate its identity with the key management system (KMS).

[0043] The Key Management System (KMS) uses the hybrid signature certificate, PQC signature algorithm, user signature key pair, and commercial cryptographic signature algorithm for verification. It obtains the session key through the quantum key distributor (QKD). It then encrypts the session key using the hybrid encryption certificate, commercial cryptographic encryption algorithm, the user's PQC encryption algorithm public key, and PQC encryption algorithm to obtain session key ciphertext, and sends the session key ciphertext to the user terminal.

[0044] The user terminal decrypts the ciphertext of the session key using the Collaborative Cryptography System (CCS), the user encryption key pair, the commercial cryptography encryption algorithm, and the PQC encryption algorithm to obtain the session key.

[0045] In one or more embodiments, the user terminal initialization, generating a user signature key pair, includes:

[0046] The user terminal loads a secure medium and runs a secure middleware, which enables the secure medium to generate a private key for a commercial cryptographic signature algorithm, a private key for a PQC signature algorithm, a public key for a commercial cryptographic signature algorithm, and a public key for a PQC signature algorithm.

[0047] In one or more embodiments, the user encryption key pair includes a public key for the PQC encryption algorithm;

[0048] The user terminal uses the user encryption key pair and the user signature key pair to generate the user's PQC encryption algorithm public encryption key and PQC signature algorithm public signature key through the Collaborative Cryptography System (CCS), including:

[0049] The user terminal uses the PQC encryption algorithm public key and the PQC signature algorithm public key in the user signature key pair to generate the user's PQC encryption algorithm public encryption key and PQC signature algorithm public signature key through the Collaborative Cryptographic System (CCS).

[0050] In one or more embodiments, the user encryption key pair further includes a public key for a commercial cryptographic encryption algorithm;

[0051] The user terminal uses the user encryption key pair, the user signature key pair, the user's PQC encryption algorithm public encryption public key, and the PQC signature algorithm public signature public key to register and issue a hybrid certificate of commercial cryptography and PQC algorithm online through the Certificate Authentication System (CAS), including:

[0052] The user terminal uses the commercial cryptographic encryption algorithm public key, the commercial cryptographic signature algorithm public key in the user signature key pair, the user's PQC encryption algorithm public key, and the PQC signature algorithm public key to register and issue a hybrid certificate of commercial cryptographic algorithm and PQC algorithm online through the Certificate Authentication System (CAS).

[0053] In one or more embodiments, the Key Management System (KMS) uses the hybrid signature certificate, PQC signature algorithm, user signature key pair, and commercial cryptographic signature algorithm for verification, and obtains the session key through a quantum key distributor (QKD), including:

[0054] The Key Management System (KMS) uses the user's PQC signature algorithm public key, PQC signature algorithm, and the user's commercial cryptographic signature algorithm public key and commercial cryptographic signature algorithm in the hybrid signature certificate to verify the session key through the quantum key distributor (QKD).

[0055] The session key is encrypted using a hybrid encryption certificate, a commercial encryption algorithm, the user's PQC encryption algorithm public key, and the PQC encryption algorithm to obtain session key ciphertext, including:

[0056] The session key is encrypted using the commercial cryptographic encryption algorithm public key, the commercial cryptographic encryption algorithm, the user's PQC encryption algorithm public key, and the PQC encryption algorithm in the hybrid encryption certificate to obtain the session key ciphertext.

[0057] In one or more embodiments, the user encryption key pair further includes a commercial cryptographic encryption algorithm encryption private key and a PQC encryption algorithm encryption private key;

[0058] The user terminal decrypts the session key ciphertext using the Collaborative Cryptography System (CCS), the user encryption key pair, the commercial cryptography encryption algorithm, and the PQC encryption algorithm to obtain the session key, including:

[0059] The user terminal decrypts the PCD through PQC in the Collaborative Cryptographic System (CCS), and decrypts the session key ciphertext using the commercial cryptographic encryption algorithm, the PQC encryption algorithm, and the commercial cryptographic encryption algorithm and PQC encryption algorithm to obtain the session key.

[0060] The embodiments of the present invention have the following advantages:

[0061] Quantum key distribution and post-quantum cryptography are deeply integrated. Based on post-quantum cryptography algorithms and combined with classical commercial cryptography and public key infrastructure, a comprehensive identity-based security strategy is implemented for the entire cryptographic infrastructure. Both users and network elements of the cryptographic infrastructure, as well as between different layers and network elements within the cryptographic infrastructure, perform two-way identity authentication based on post-quantum digital certificates and post-quantum signature algorithms, and establish two-way secure transmission layer channels based on two-way identity authentication between each pair. Attached Figure Description

[0062] Figure 1 This is an architecture diagram of a cryptographic infrastructure system according to the present invention;

[0063] Figure 2 This is a flowchart illustrating the steps of an embodiment of a communication method based on a cryptographic infrastructure system according to the present invention. Detailed Implementation

[0064] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0065] One of the core concepts of this invention is the deep integration of quantum key distribution and post-quantum cryptography. Based on post-quantum cryptography algorithms and combined with classical commercial cryptography and public key infrastructure, a comprehensive identity-based security strategy is implemented for the entire cryptographic infrastructure. Both the user and each network element of the cryptographic infrastructure, as well as the various layers and network elements within the cryptographic infrastructure, are subject to bidirectional identity authentication based on post-quantum digital certificates and post-quantum signature algorithms. Furthermore, a bidirectional secure transmission layer channel based on bidirectional identity authentication is established between each pair of users.

[0066] Reference Figure 1 This diagram illustrates an architecture of a cryptographic infrastructure system according to the present invention. The cryptographic infrastructure is a collection of hardware, software, personnel, policies, and procedures used to implement functions such as key and digital certificate generation, management, storage, distribution, and revocation. Specifically, the system may include:

[0067] A quantum communication layer is used to execute a quantum key distribution protocol via a quantum key distribution link, and to generate quantum keys in conjunction with a key relay; the quantum communication layer includes a quantum key distribution network (QKDN), which includes a quantum key manager (QKM), a quantum key distributor (QKD), and a quantum key distribution network controller (QKDNC).

[0068] The cryptographic service layer is used to obtain the quantum key from the quantum communication layer and to provide cryptographic services to the business application layer; the cryptographic service layer includes a key management system (KMS), a cryptography management service platform (CMSP), a certificate authority system (CAS), an identity and access management system (IAM), and a co-crypto system (CCS).

[0069] The business application layer interacts with the cryptographic service layer through a security middleware. The business application layer is equipped with cryptographic components, which include the following types: smart terminal application APP-1 equipped with a secure SIM card, dedicated terminal application APP-2 equipped with a secure TF card, SaaS (Software as a Service) cloud application APP-3 equipped with a software cryptographic module, gateway device DEV-1 equipped with a PCI cryptographic card, and terminal device DEV-2 equipped with a cryptographic security chip.

[0070] In this embodiment of the invention, the Cryptography Management Service Platform (CMSP) runs the processes of Cryptography Service Management (CSM), Cryptography Application Management (CAM), Cryptography Service Orchestration (CSO), Cryptography Compliance Supervision (CCS), and Algorithm Agility Management (AAM). Through the Md, Ma, Mo, Mc, and Am call interfaces, it provides cryptography service status monitoring, user account and application management, cryptography resource scheduling, algorithm correctness and random number quality compliance management, and PQC (Post Quantum Computation) via remote calls using HTTP (Hypertext Transfer Protocol) / REST (Representational State Transfer), RPC (Remote Procedure Call Protocol), and SSH (Secure Shell) / SFTP (Secure File Transfer Protocol) remote call formats. Cryptography (post-quantum cryptography) algorithm management service updates the configuration of PQC algorithms used by various components of the infrastructure and user terminals and the algorithm library by running the AAM process. The updates include algorithm replacement, security patches and algorithm policy configuration.

[0071] In this embodiment of the invention, the Key Management System (KMS) is directly connected to the server cryptographic machine or cloud server cryptographic machine on the intranet. A QKD key pool and a PQC public key pool (KP) are established in the form of a memory KV database encrypted with the local master key of the cryptographic machine. The QKD key pool stores the quantum keys distributed by QKD, and the PQC public key pool generates and stores the user's PQC encrypted public key. The processes of the Cryptography Service Agent (CSA), Key Management Agent (KMA), and Key Injection Management (KIM) are running. Through the KM call interface, data encryption / decryption, key lifecycle management, and master key injection services are provided to the external network in the form of remote calls using HTTP / REST, RPC, and binary TLV (Type / Length / Value) encoding.

[0072] In this embodiment of the invention, the certificate authentication system CAS establishes a certificate store by combining an in-memory document database and a disk relational database. It runs processes for online certificate registration and issuance (CEIS, certificate enrollment and issuance), certificate status query (CSP, certificate status protocol), and certificate directory service (LDAP, providing certificate revocation lists and certificate file downloads). Through Ce, Cq, and Cd call interfaces, it provides hybrid certificate services using PQC and commercial cryptographic algorithms based on ACME (Automatic Certificate Management Environment), SCEP (Simple Certificate Enrollment Protocol), and EST (Enrollment over Secure Transport) digital certificate related protocols.

[0073] In this embodiment of the invention, the Identity and Access Management System (IAM) establishes a user identity database by combining memory and disk relational databases, runs the processes of User Identity Management (IDM), User Privilege Management (UPM), and User Behavior Audition (UBA), and provides user identity management services through Ia, Id, Pm, and Ua call interfaces in the form of HTTP / REST or RPC / XML (eXtensible Markup Language) remote calls.

[0074] In this embodiment of the invention, the collaborative cryptographic operation system CCS runs the processes of PQC collaborative signature PCS (pqc co-signature), PQC collaborative decryption PCC (pqc co-crypt), and PQC public key generation PKG (pqc keygeneration). Through the Cs, Ck, and Cc call interfaces, it provides collaborative cryptographic operation services in the form of remote calls in HTTP / REST, RPC, and binary TLV (Type / Length / Value) encoding, and completes collaborative cryptographic operations with the client program of the user terminal.

[0075] In this embodiment of the invention, the system further includes management class interaction relationships and corresponding calling interfaces, including:

[0076] a) Management orchestration interface Mo, including interface Mo-1 connecting Key Service Orchestration (CSO) with various business applications, and interface Mo-2 connecting Key Management Agent (KMA) for transmitting service orchestration information and data;

[0077] b) Device management interface Md, including interface Md-1 that connects the cryptographic service management (CSM) with cryptographic devices related to various business applications, used to transmit cryptographic device control information and data;

[0078] c) Application management interface Ma, including interface Ma-1 connecting cryptographic application management CAM with various business applications, and interface Ma-2 connecting with key management system KMS, used to transmit cryptographic application control information and data;

[0079] d) The password compliance check interface Mc includes the interface Mc-1 that connects the password compliance monitoring CCS with various business applications, and the interface Mc-2 that connects with the key management system KMS, for transmitting compliance control information and data;

[0080] e) Algorithm Agility Management Interface Reference Point Am, including interface reference point Am-1 connecting Algorithm Agility Management (AAM) with various business applications, and interface reference point Am-2 connecting with Key Management System (KMS), used to transmit algorithm updates, security patches, and algorithm policy data.

[0081] In this embodiment of the invention, the system further includes service-type interaction relationships and calling interfaces, including:

[0082] a) Key management interface Km, including interface Km-1 connecting key management agent KMA with various business applications, interface Km-2 interconnecting key management system KMS, and interface Km-3 connecting key management agent KMA and quantum key manager QKM, used to transmit key management related information and data;

[0083] b) Quantum key distribution interface Kq, including interface Kq-1 connecting quantum key manager QKM and quantum key distributor QKD, and interface Kq-2 connecting quantum key manager QKM and quantum network controller QKDNC, used to transmit quantum key distribution related information and data;

[0084] c) Collaborative cryptographic operation call interface, including interfaces connecting the collaborative cryptographic operation modules of the Collaborative Cryptographic Operation System (CCS) and various business applications, including interface Cs-1 for PQC Collaborative Signature PCS, interface Cc-1 for PQC Collaborative Decryption PCS, and interface Ck-1 for PQC Public Key Generation PKG, used to transmit corresponding collaborative cryptographic algorithm calls and key management related commands and data.

[0085] d) Certificate service interfaces, including interfaces connecting various service modules of the Certificate Authentication System (CAS) with various network elements and user terminals. These include interface Ce-1 connecting the Key Management System (KMS) to the Certificate Online Registration and Issuance System (CEIS), interface Ce-2 connecting user terminals to CEIS, interface Ce-3 connecting the Collaborative Cryptographic System (CCS) to CEIS, and interface Ce-4 connecting various network elements (QKD, QKDM, QKDNC) of the Quantum Key Distribution Network (QKD, QKDM, QKDNC) to CEIS. Interface Cq-1 also connects the Key Management System (KMS) to the Certificate Status Query Service (CSP), interface Cq-2 connecting user terminals to CSP, and interface Cq-3 connecting various network elements of the Quantum Key Distribution Network to CSP. Furthermore, interface Cd-1 connects the Key Management System (KMS) to the Certificate Directory Service (LDAP), interface Cd-2 connecting user terminals to LDAP, and interface Cd-3 connecting various network elements of the Quantum Key Distribution Network to LDAP, used for transmitting commands and data related to certificate services.

[0086] In this embodiment of the invention, the system further includes identity-based interaction relationships and calling interfaces, including:

[0087] a) Identity authentication interface reference points Ia, including: Ia-1 (interface reference point connecting the Cryptography Management Service Platform (CMSP) with various business applications); Ia-2 (interface reference point connecting the Key Management System (KMS) with various business applications); Ia-3 (interface reference point connecting the Certificate Authentication System (CAS) with various business applications); Ia-4 (interface reference point connecting the Identity and Access Management System (IAM) with various business applications); Ia-5 (interface reference point connecting the Collaborative Cryptographic Operation System (CCS) with various business applications); Ia-6 (interface reference point connecting the Cryptography Management Service Platform (CMSP) with the Key Management System (KMS); Ia-7 (interface reference point connecting the Key Management System (KMS) with the Certificate Authentication System (CAS); Ia-8 (interface reference point connecting the Key Management System (KMS) with the Identity and Access Management System (IAM)); and Ia-9 (interface reference point connecting the Key Management System (KM) with the Key Management System (KM). Interface reference point Ia-9 between S, interface reference point Ia-10 between Collaborative Cryptographic Operation System CCS and Certificate Authentication System CAS, interface reference point Ia-11 between Cryptographic Management Service Platform CMSP and various network elements of Quantum Key Distribution Network, interface reference point Ia-12 between Key Management Agent KMA and Quantum Key Manager QKM, interface reference point Ia-13 between Certificate Authentication System CAS and various network elements of Quantum Key Distribution Network, interface reference point Ia-14 between Identity and Access Management System IAM and various network elements of Quantum Key Distribution Network, interface reference point Ia-15 between Quantum Key Distributor QKD and Quantum Key Manager QKM, and interface reference point Ia-16 between Quantum Key Manager QKM and Quantum Network Controller QKDNC, used for transmitting identity authentication information and data;

[0088] b) Identity management interface Id, including interface Id-1 connecting the key management system KMS and the user identity management IDM, interface Id-2 connecting various business applications and the user identity management IDM, and interface Id-3 connecting each network element of the quantum key distribution network and the user identity management IDM, used to transmit relevant information and data such as user identity identifiers and attributes;

[0089] c) Access control interface Pm, including interface Pm-1 connecting the key management system KMS and the user access control UPM, interface Pm-2 connecting various business applications and the user access control UPM, and interface Pm-3 connecting each network element of the quantum key distribution network and the user access control UPM, used to transmit user access permission related information and data.

[0090] d) Behavior auditing interface Ua, including interface Ua-1 connecting the Key Management System (KMS) and User Behavior Auditing (UBA), interface Ua-2 connecting various business applications and User Behavior Auditing (UBA), and interface Ua-3 connecting various network elements of the quantum key distribution network and User Behavior Auditing (UBA), used to transmit user behavior auditing related information and data.

[0091] In this embodiment of the invention, the system further includes communication-related interaction relationships and calling interfaces, including:

[0092] a) Communication protocol interface Ax between user applications, including interface Ax-1 for smart terminals, interface Ax-2 for dedicated terminals, and interface Ax-3 for interoperability between cryptographic applications on the cloud of SaaS, used for information and data exchange between cryptographic applications of the same type based on a specific transmission protocol.

[0093] b) Communication protocol interface Dx between user equipment, including gateway-type interface Dx-1 and terminal-type cryptographic device interface Dx-2 for interoperability between similar devices, used for information and data exchange between similar cryptographic devices based on specific transmission protocols.

[0094] In this embodiment of the invention, quantum key distribution and post-quantum cryptography are deeply integrated. Based on the post-quantum cryptography algorithm and combined with classical commercial cryptography and public key infrastructure, a comprehensive identity security strategy is implemented for the entire cryptographic infrastructure. The user and each network element of the cryptographic infrastructure, as well as the various layers and network elements within the cryptographic infrastructure, are all subject to two-way identity authentication based on post-quantum digital certificates and post-quantum signature algorithms. A two-way transport layer security channel (mutual TLS) based on two-way identity authentication is established between each pair of users.

[0095] Reference Figure 2 The diagram illustrates a flowchart of an embodiment of a communication method based on a cryptographic infrastructure system according to the present invention. Applied to a cryptographic infrastructure system, the method may specifically include the following steps:

[0096] Step 201: Initialize the user terminal and generate a user signature key pair.

[0097] Step 202: The user terminal registers with the Identity and Access Management System (IAM) to obtain a registered identity.

[0098] Step 203: The user terminal uses the registered identity to obtain a user encryption key pair from the key management system (KMS).

[0099] Step 204: The user terminal uses the user encryption key pair and the user signature key pair to generate the user's PQC encryption algorithm public encryption key and PQC signature algorithm public signature key through the Collaborative Cryptographic System (CCS).

[0100] Step 205: The user terminal uses the user encryption key pair, the user signature key pair, the user's PQC encryption algorithm public encryption public key, and the PQC signature algorithm public signature public key to register and issue a hybrid certificate of commercial cryptography algorithm and PQC algorithm online through the Certificate Authentication System (CAS). The hybrid certificate includes: a hybrid encryption certificate of commercial cryptography algorithm + PQC encryption algorithm and a hybrid signature certificate of commercial cryptography signature algorithm + PQC signature algorithm.

[0101] Step 206: The user terminal uses a hybrid encryption certificate (commercial cryptographic encryption algorithm + PQC encryption algorithm) and a hybrid signature certificate (commercial cryptographic signature algorithm + PQC signature algorithm) to authenticate its identity with the key management system (KMS).

[0102] Step 207: The Key Management System (KMS) verifies the signature using the hybrid signature certificate, PQC signature algorithm, user signature key pair, and commercial cryptographic signature algorithm; obtains the session key through the quantum key distributor (QKD); and encrypts the session key using the hybrid encryption certificate, commercial cryptographic encryption algorithm, the user's PQC encryption algorithm public key, and PQC encryption algorithm to obtain the session key ciphertext, and sends the session key ciphertext to the user terminal.

[0103] Step 208: The user terminal decrypts the session key ciphertext using the Collaborative Cryptography System (CCS), the user encryption key pair, the commercial cryptography encryption algorithm, and the PQC encryption algorithm to obtain the session key.

[0104] Specifically, embodiments of the present invention may include four algorithms, each corresponding to a key pair (i.e., a key pair), each key pair including a public key and a private key. The four algorithms are as follows:

[0105] Commercial cryptographic signature algorithms, and corresponding commercial cryptographic signature algorithm signature key pairs, including commercial cryptographic signature algorithm signature private key and commercial cryptographic signature algorithm signature public key.

[0106] Commercial cryptographic algorithms, and corresponding encryption key pairs, including the private key and the public key of the commercial cryptographic algorithm.

[0107] The PQC signature algorithm, and the corresponding commercial cryptographic PQC signature algorithm signature key pair, include the PQC commercial cryptographic signature algorithm signature private key and the PQC commercial cryptographic signature algorithm signature public key.

[0108] The PQC encryption algorithm, and the corresponding PQC commercial encryption key pair, include the PQC commercial encryption private key and the PQC commercial encryption public key.

[0109] Furthermore, embodiments of the present invention may also include a hybrid encryption certificate and a hybrid signature certificate, used for key encapsulation and identity authentication (signature and verification), respectively. The hybrid encryption certificate contains a public key for a commercial cryptographic encryption algorithm and a public key for a PQC encryption algorithm, and the hybrid signature certificate contains a public key for a commercial cryptographic signature algorithm and a public key for a PQC signature algorithm.

[0110] Based on this, the user terminal performs initialization work, including loading the security medium (according to...). Figure 1 Different APPs (Applications) or DEVs load different media types (such as secure SIM cards, secure TF cards, software cryptographic modules, PCI cryptographic cards, and secure chips) and run secure middleware. The secure media generates user signature key pairs, including a private key for commercial cryptographic signature algorithms, a private key for PQC signature algorithms, a public key for commercial cryptographic signature algorithms, and a public key for PQC signature algorithms. Then, they register with the Identity and Access Management System (IAM) to obtain a registered identity.

[0111] After initialization, the user's encryption key pair is obtained offline from the cryptographic machine of the Key Management System (KMS) using the registered identity. This includes the private key for the commercial cryptographic algorithm and the private key for the PQC encryption algorithm, as well as the public key for the commercial cryptographic algorithm and the public key for the PQC encryption algorithm.

[0112] Using the user's PQC encryption algorithm public key and the user's signature algorithm public key from the signature key pair, the user's PQC encryption algorithm public encryption key and PQC signature algorithm public signature key are generated through the Collaborative Cryptographic System (CCS).

[0113] Next, the user's commercial cryptographic encryption algorithm public key, the user's commercial cryptographic signature algorithm public key in the signature key pair, the user's PQC encryption algorithm public encryption public key, and the PQC signature algorithm public signature public key are used to register and issue a hybrid certificate of PQC and commercial cryptographic algorithms online through the Certificate Authentication System (CAS).

[0114] Hybrid certificates include hybrid encryption certificates using both commercial cryptographic encryption algorithms and PQC encryption algorithms, and hybrid signature certificates using both commercial cryptographic signature algorithms and PQC signature algorithms. Specifically, a hybrid encryption certificate includes the public key for both the commercial cryptographic encryption algorithm and the PQC encryption algorithm; a hybrid signature certificate includes the public key for both the commercial cryptographic signature algorithm and the PQC signature algorithm.

[0115] The user terminal uses a commercial cryptographic signature algorithm and a commercial cryptographic signature algorithm to sign the private key, a PQC signature algorithm, and a PQC signature algorithm to sign the private key. It then calls the PQC collaborative signature PCS operation of the Collaborative Cryptographic Operation System (CCS) to form a commercial cryptographic signature algorithm signature and a PQC signature algorithm signature. Finally, it uses a hybrid signature certificate (combining commercial cryptographic signature algorithm and PQC signature algorithm) and a hybrid encryption certificate (combining commercial cryptographic encryption algorithm and PQC encryption algorithm) to authenticate its identity with the Key Management System (KMS).

[0116] The Key Management System (KMS) uses the user's PQC signature algorithm public key, PQC signature algorithm, and the user's commercial cryptographic signature algorithm public key and commercial cryptographic signature algorithm in the hybrid signature certificate to perform dual verification of the user's identity. Then, it obtains the session key through the quantum key distributor (QKD) in the quantum communication layer. The KMS then uses the commercial cryptographic encryption algorithm public key, commercial cryptographic encryption algorithm, and the user's PQC encryption algorithm public key and PQC encryption algorithm in the hybrid encryption certificate to perform dual encryption protection on the session key, resulting in the ciphertext session key, which is then sent to the user terminal.

[0117] The user terminal calls the PQC collaborative decryption PCS in the Collaborative Cryptographic System (CCS), and uses the commercial cryptographic encryption algorithm to encrypt the private key, the PQC encryption algorithm to encrypt the private key, and the commercial cryptographic encryption algorithm and PQC encryption algorithm to double decrypt the session key ciphertext to obtain the session key.

[0118] Furthermore, the Algorithm Agile Management (AAM) system running on the Cryptography Management Service Platform (CMSP) can update the algorithm library online based on the evolution of PQC algorithms and the PQC algorithm configurations used by various components of the cryptography infrastructure and user terminals. This includes algorithm replacement, security patches, algorithm policy configuration, and key and certificate attributes and formats, thus achieving cryptographic agility in the application of PQC algorithms.

[0119] In this embodiment of the invention, quantum key distribution and post-quantum cryptography are deeply integrated. Based on the post-quantum cryptography algorithm and combined with classical commercial cryptography and public key infrastructure, a comprehensive identity security strategy is implemented for the entire cryptographic infrastructure. The user and each network element of the cryptographic infrastructure, as well as the various layers and network elements within the cryptographic infrastructure, are all subject to bidirectional identity authentication based on post-quantum digital certificates and post-quantum signature algorithms. A bidirectional transmission layer secure channel based on bidirectional identity authentication is established between each pair of users.

[0120] Moreover, the combination of QKD and PQC can form a multi-layered security mechanism: QKD is responsible for providing security for the underlying key distribution, while PQC provides quantum-resistant encryption and authentication capabilities at a higher level.

[0121] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0122] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0123] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0124] Embodiments of the present invention are described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0125] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0126] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0127] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.

[0128] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0129] The foregoing has provided a detailed description of a cryptographic infrastructure system and a communication method based on the cryptographic infrastructure system provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A cryptographic infrastructure system, characterized by The system comprises: a quantum communication layer, configured to perform a quantum key distribution protocol through a quantum key distribution link and generate quantum keys in combination with key relaying; the quantum communication layer comprises a quantum key distribution network (QKDN) including a quantum key manager (QKM), a quantum key distributor (QKD), and a quantum network controller (QKDNC); a cryptographic service layer, configured to acquire the quantum keys from the quantum communication layer and provide cryptographic services for a service application layer; the cryptographic service layer comprises a key management system (KMS), a cryptographic management service platform (CMSP), a certificate authentication system (CAS), an identity and access management system (IAM), and a collaborative cryptographic operation system (CCS); the certificate authentication system CAS establishes a certificate library in a combination of an in-memory document database and a disk relational database, runs processes of certificate online registration and issuance (CEIS), certificate status query (CSP), and certificate directory service (LDAP), and provides hybrid certificate services of PQC and commercial cryptographic algorithms through ACME, SCEP, and EST digital certificate related protocols via Ce, Cq, and Cd calling interfaces; the service application layer interacts with the cryptographic service layer through a security middleware; the service application layer is equipped with cryptographic components, and forms of the cryptographic components include an application (APP-1) equipped with a secure SIM card, an application (APP-2) equipped with a secure TF card, an application (APP-3) equipped with a software cryptographic module, a device (DEV-1) equipped with a PCI cryptographic card, and a device (DEV-2) equipped with a cryptographic security chip.

2. The cryptographic infrastructure system of claim 1, wherein, The cryptographic management service platform (CMSP) runs processes of cryptographic service management (CSM), cryptographic application management (CAM), cryptographic service orchestration (CSO), cryptographic compliance monitoring (CCS), and algorithm agile management (AAM), provides cryptographic service state monitoring, user account and application management, cryptographic resource scheduling, algorithm correctness and random number quality compliance management, and PQC algorithm management services in the form of HTTP / REST, RPC, and SSH / SFTP remote calling via Md, Ma, Mo, Mc, and Am calling interfaces, and updates PQC algorithm configurations and algorithm libraries used by infrastructure components and user terminals by running the process of the AAM, wherein the update includes algorithm replacement, security patches, and configuration of algorithm strategies.

3. The cryptographic infrastructure system of claim 1, wherein, The key management system (KMS) connects a server cryptographic machine or a cloud server cryptographic machine to establish a QKD key pool and a PQC public key pool in the form of an in-memory KV database encrypted by a local master key of the cryptographic machine, stores quantum keys distributed by the QKD in the QKD key pool, and generates and stores PQC encryption public keys of users in the PQC public key pool; the KMS runs processes of a cryptographic service agent (CSA), a key management agent (KMA), and a key refilling manager (KIM), and provides data encryption and decryption, key full life cycle management, and master key refilling services to an external network in the form of HTTP / REST, RPC, and binary TLV encoded remote calling via a Km calling interface.

4. The cryptographic infrastructure system of claim 1, wherein, The identity and access management system IAM establishes a user identity library in the form of a memory and disk relational database, runs the processes of user identity management IDM, user permission management UPM and user behavior audit UBA, and provides user identity management services in the form of HTTP / REST or RPC / XML remote calls through Ia, Id, Pm and Ua calling interfaces.

5. The cryptographic infrastructure system of claim 1, wherein, The collaborative cryptographic operation system CCS runs the processes of PQC collaborative signature PCS, PQC collaborative decryption PCC and PQC public key generation PKG, provides collaborative cryptographic operation services in the form of HTTP / REST, RPC and binary TLV encoded remote calls through Cs, Ck and Cc calling interfaces, and completes collaborative cryptographic operations with the client program of the user terminal.

6. The cryptographic infrastructure system according to any one of claims 1 to 5, characterized in that, The system also includes management class interaction relationships and corresponding calling interfaces, including: a) management orchestration interface Mo, including interface Mo-1 connecting key service orchestration CSO and various types of business applications, and interface Mo-2 connecting key management agent KMA, for transmitting service orchestration information and data; b) device management interface Md, including interface Md-1 connecting cryptographic service management CSM and cryptographic devices related to various types of business applications, for transmitting cryptographic device management information and data; c) application management interface Ma, including interface Ma-1 connecting cryptographic application management CAM and various types of business applications, and interface Ma-2 connecting key management system KMS, for transmitting cryptographic application management information and data; d) cryptographic compliance checking interface Mc, including interface Mc-1 connecting cryptographic compliance monitoring CCS and various types of business applications, and interface Mc-2 connecting key management system KMS, for transmitting compliance management information and data; e) algorithm agility management interface reference point Am, including interface reference point Am-1 connecting algorithm agility management AAM and various types of business applications, and interface reference point Am-2 connecting key management system KMS, for transmitting algorithm update, security patch and algorithm policy data.

7. The cryptographic infrastructure system according to any one of claims 1 to 5, wherein, The system also includes service class interaction relationships and calling interfaces, including: a) key management interface Km, including interface Km-1, interface Km-2 and interface Km-3, the interface Km-1 is used to connect key management agent KMA and various types of business applications, the interface Km-2 is used for interconnection between key management systems KMS, and the interface Km-3 is used to connect key management agent KMA and quantum key manager QKM, for transmitting key management related information and data; b) quantum key distribution interface Kq, including interface Kq-1 connecting quantum key manager QKM and quantum key distributor QKD, and interface Kq-2 connecting quantum key manager QKM and quantum network controller QKDNC, for transmitting quantum key distribution related information and data; c) Cooperative cryptographic operation calling interface, including the interface connecting each module of the cooperative cryptographic operation system CCS and each type of business application, including the interface Cs-1 of the PQC cooperative signature PCS, the interface Cc-1 of the PQC cooperative decryption PCC and the interface Ck-1 of the PQC public key generation PKG, for transmitting the corresponding cooperative cryptographic algorithm calling and the key management related command and data; d) Certificate service interface, including the interface connecting each type of service module of the certificate authentication system CAS and each network element and user terminal, including the interface Ce-1 connecting the key management system KMS and the certificate online registration and issuance CEIS, the interface Ce-2 connecting the user terminal and the certificate online registration and issuance CEIS, the interface Ce-3 connecting the cooperative cryptographic operation system CCS and the certificate online registration and issuance CEIS, and the interface Ce-4 connecting each network element of the quantum key distribution network and the cooperative cryptographic operation system CEIS; further including the interface Cq-1 connecting the key management system KMS and the certificate status query CSP, the interface Cq-2 connecting the user terminal and the certificate status query CSP, and the interface Cq-3 connecting each network element of the quantum key distribution network and the certificate status query CSP; further including the interface Cd-1 connecting the key management system KMS and the certificate directory service LDAP, the interface Cd-2 connecting the user terminal and the certificate directory service LDAP, and the interface Cd-3 connecting each network element of the quantum key distribution network and the certificate directory service LDAP, for transmitting the command and data of the related certificate service.

8. The cryptographic infrastructure system according to any one of claims 1 to 5, wherein, The system further includes identity type interaction relationship and calling interface, including: a) identity authentication interface reference point Ia, including interface reference point Ia-1 connecting the cryptographic management service platform CMSP and various types of business applications, interface reference point Ia-2 connecting the key management system KMS and various types of business applications, interface reference point Ia-3 connecting the certificate authentication system CAS and various types of business applications, interface reference point Ia-4 connecting the identity and access management system IAM and various types of business applications, interface reference point Ia-5 connecting the collaborative cryptographic operation system CCS and various types of business applications, interface reference point Ia-6 connecting the cryptographic management service platform CMSP and the key management system KMS, interface reference point Ia-7 connecting the key management system KMS and the certificate authentication system CAS, interface reference point Ia-8 connecting the key management system KMS and the identity and access management system IAM, interface reference point Ia-9 between the key management systems KMS, interface reference point Ia-10 connecting the collaborative cryptographic operation system CCS and the certificate authentication system CAS, interface reference point Ia-11 connecting the cryptographic management service platform CMSP and various network elements of the quantum key distribution network, interface reference point Ia-12 connecting the key management agent KMA and the quantum key manager QKM, interface reference point Ia-13 connecting the certificate authentication system CAS and various network elements of the quantum key distribution network, interface reference point Ia-14 connecting the identity and access management system IAM and various network elements of the quantum key distribution network, interface reference point Ia-15 connecting the quantum key distributor QKD and the quantum key manager QKM, and interface reference point Ia-16 connecting the quantum key manager QKM and the quantum network controller QKDNC, for transmitting identity authentication information and data; b) identity management interface Id, including interface Id-1 connecting the key management system KMS and the user identity management IDM, interface Id-2 connecting various types of business applications and the user identity management IDM, and interface Id-3 connecting various network elements of the quantum key distribution network and the user identity management IDM, for transmitting user identity and attribute related information and data; c) permission management interface Pm, including interface Pm-1 connecting the key management system KMS and the user permission management UPM, interface Pm-2 connecting various types of business applications and the user permission management UPM, and interface Pm-3 connecting various network elements of the quantum key distribution network and the user permission management UPM, for transmitting user access permission related information and data; d) behavior audit interface Ua, including interface Ua-1 connecting the key management system KMS and the user behavior audit UBA, interface Ua-2 connecting various types of business applications and the user behavior audit UBA, and interface Ua-3 connecting various network elements of the quantum key distribution network and the user behavior audit UBA, for transmitting user behavior audit related information and data.

9. The cryptographic infrastructure system according to any one of claims 1 to 5, wherein, The system further comprises communication type interaction relationships and calling interfaces, including: a) a communication protocol interface Ax between user applications, including an interface Ax-1 of a smart terminal type, an interface Ax-2 of a special terminal type, and an interface Ax-3 between SaaS cloud type cryptographic applications for the same type of application interoperability, for information and data interaction between the same type of cryptographic applications based on a specific transmission protocol; b) a communication protocol interface Dx between user devices, including an interface Dx-1 of a gateway type and an interface Dx-2 between terminal type cryptographic devices for the same type of device interoperability, for information and data interaction between the same type of cryptographic devices based on a specific transmission protocol.

10. A method of communication based on a cryptographic infrastructure system, characterized by The method is applied to the cryptographic infrastructure system as claimed in any one of claims 1-9, and comprises: user terminal initialization to generate a user signature key pair; the user terminal registers with an identity and access management system IAM to obtain a registered identity: the user terminal obtains a user encryption key pair from a key management system KMS using the registered identity; the user terminal generates a PQC encryption algorithm public encryption key and a PQC signature algorithm public signature key of the user through a collaborative cryptographic operation system CCS using the user encryption key pair and the user signature key pair; the user terminal registers and issues a hybrid certificate of a commercial secret algorithm and a PQC algorithm online through a certificate authentication system CAS using the user encryption key pair, the user signature key pair, the PQC encryption algorithm public encryption key of the user, and the PQC signature algorithm public signature key, the hybrid certificate including a hybrid encryption certificate of a commercial secret encryption algorithm + a PQC encryption algorithm and a hybrid signature certificate of a commercial secret signature algorithm + a PQC signature algorithm; the user terminal performs identity authentication to a key management system KMS using the hybrid encryption certificate of a commercial secret encryption algorithm + a PQC encryption algorithm and the hybrid signature certificate of a commercial secret signature algorithm + a PQC signature algorithm; the key management system KMS verifies the hybrid signature certificate, a PQC signature algorithm, the user signature key pair, and a commercial secret signature algorithm, obtains a session key through a quantum key distributor QKD, encrypts the session key using a hybrid encryption certificate, a commercial secret encryption algorithm, the PQC encryption algorithm public encryption key of the user, and a PQC encryption algorithm to obtain a session key ciphertext, and sends the session key ciphertext to the user terminal; the user terminal decrypts the session key ciphertext through a collaborative cryptographic operation system CCS, the user encryption key pair, the commercial secret encryption algorithm, and the PQC encryption algorithm to obtain a session key.

11. The communication method based on a cryptographic infrastructure system according to claim 10, characterized by, The user terminal initialization to generate a user signature key pair comprises: the user terminal loads a secure medium and runs a secure middleware to enable the secure medium to generate a commercial secret signature algorithm signature private key, a PQC signature algorithm signature private key, a commercial secret signature algorithm signature public key, and a PQC signature algorithm signature public key.

12. The communication method based on a cryptographic infrastructure system according to claim 10, characterized by, the user encryption key pair includes a PQC encryption algorithm encryption public key; The user terminal uses the user encryption key pair and the user signature key pair to generate a PQC encryption algorithm public encryption key and a PQC signature algorithm public signature key of the user through a cooperative cryptographic system CCS, including: The user terminal uses the PQC encryption algorithm public encryption key and the PQC signature algorithm public signature key in the user signature key pair to generate a PQC encryption algorithm public encryption key and a PQC signature algorithm public signature key of the user through a cooperative cryptographic system CCS.

13. The communication method based on a cryptographic infrastructure system according to claim 10, wherein, The user encryption key pair further includes a commercial encryption algorithm encryption private key and a PQC encryption algorithm encryption private key; The user terminal uses the user encryption key pair, the user signature key pair, the PQC encryption algorithm public encryption key of the user, and the PQC signature algorithm public signature key to register and issue a hybrid certificate of the commercial algorithm and the PQC algorithm online through a certificate authentication system CAS, including: The user terminal uses the commercial encryption algorithm encryption private key, the commercial signature algorithm signature private key in the user signature key pair, the PQC encryption algorithm public encryption key of the user, and the PQC signature algorithm public signature key to register and issue a hybrid certificate of the commercial algorithm and the PQC algorithm online through a certificate authentication system CAS.

14. The communication method based on a cryptographic infrastructure system according to claim 10, wherein, The key management system KMS uses the hybrid signature certificate, the PQC signature algorithm, the user signature key pair, and the commercial signature algorithm to verify to obtain a session key through a quantum key distributor QKD, including: The key management system KMS uses the PQC signature algorithm public signature key of the user in the hybrid signature certificate, the PQC signature algorithm, the commercial signature algorithm signature private key of the user in the user signature key pair, and the commercial signature algorithm to verify to obtain a session key through a quantum key distributor QKD; The session key is encrypted using the hybrid encryption certificate, the commercial encryption algorithm, the PQC encryption algorithm public encryption key of the user, and the PQC encryption algorithm to obtain session key ciphertext, including: The session key is encrypted using the commercial encryption algorithm encryption private key in the hybrid encryption certificate, the commercial encryption algorithm, the PQC encryption algorithm public encryption key of the user, and the PQC encryption algorithm to obtain session key ciphertext.

15. The password infrastructure system-based communication method of claim 10, wherein, The user encryption key pair further includes a commercial encryption algorithm encryption private key and a PQC encryption algorithm encryption private key; The user terminal decrypts the session key ciphertext through a cooperative cryptographic system CCS, the user encryption key pair, the commercial encryption algorithm, and the PQC encryption algorithm to obtain a session key, including: The user terminal decrypts the session key ciphertext through a PQC cooperative decryption PCD in the cooperative cryptographic system CCS, and uses the commercial encryption algorithm encryption private key, the PQC encryption algorithm encryption private key, the commercial encryption algorithm, and the PQC encryption algorithm to obtain a session key.

Images