SM2 key exchange method and system resistant to quantum attacks

Abstract

The application relates to the technical field of key exchange, in particular to an SM2 key exchange method and system resisting quantum attacks. The method comprises the following steps: an initiating user establishes an algorithm strategy set according to algorithm feedback parameters of a responding user; a first-level algorithm strategy is set according to the algorithm strategy set, and an interactive key set of the initiating user and the responding user is constructed according to the first-level algorithm strategy; communication monitoring data is acquired, and whether the first-level algorithm strategy is corrected is judged according to the communication monitoring data. Through the fusion of the algorithms of the initiating user and the responding user, a plurality of algorithm sub-strategies are established, and the best algorithm sub-strategy is selected according to a performance optimization result, so that the SM2 key exchange efficiency and safety are improved; meanwhile, the communication state is periodically monitored, the quantum attack risk is timely warned, the algorithm sub-strategy is corrected, the invasion risk in the communication process is reduced, and through the modular design, different types of quantum algorithms can be added at any time, and the adaptability to different communication scenes is improved.

Description

Technical Field

[0001] This application relates to the field of key exchange technology, and in particular to an SM2 key exchange method and system resistant to quantum attacks. Background Technology

[0002] Public-key cryptography is the cornerstone of modern information security systems, widely used in critical areas such as digital identity authentication, secure data transmission, and virtual private networks (VPNs). With the rapid development of quantum computing technology, these cryptographic systems based on traditional number theory problems are facing unprecedented existential threats.

[0003] Quantum computers utilize the properties of quantum superposition and entanglement to achieve exponential speedups in computation of specific mathematical problems. Quantum algorithms such as Shor's algorithm can effectively solve large integer factorization and discrete logarithm problems. This means that once a large-scale general-purpose quantum computer is successfully developed, existing widely deployed public-key cryptosystems such as RSA, ECC, and SM2 will be completely cracked, rendering the confidentiality of communication and the authenticity of identity guaranteed by these algorithms completely ineffective. Summary of the Invention

[0004] The purpose of this application is to provide a quantum-resistant SM2 key exchange method and system to solve the above-mentioned technical problems, thereby improving the security of SM2 key exchange and reducing the harm of quantum attacks.

[0005] In some embodiments of this application, multiple algorithm sub-strategies are established by fusing the algorithms of the initiating user and the responding user, and the best algorithm sub-strategy is selected based on the performance optimization results to improve the efficiency and security of SM2 key exchange. At the same time, by periodically monitoring the communication status, the risk of quantum attacks is warned in a timely manner, and the algorithm sub-strategy is corrected, thereby reducing the harm of quantum attacks.

[0006] In some embodiments of this application, by constructing a dual-cryptography encryption model, the security of communication can be guaranteed and the risk of intrusion during the communication process can be reduced when a single cryptographic type is cracked. Through modular design, different types of quantum algorithms can be added at any time to improve adaptability to different communication scenarios.

[0007] In some embodiments of this application, a quantum-resistant SM2 key exchange method is provided, including:

[0008] The initiating user establishes an algorithm strategy set based on the algorithm feedback parameters from the responding user;

[0009] Set a primary algorithm strategy based on the algorithm strategy set, and construct an interaction key set for the initiating user and the responding user based on the primary algorithm strategy;

[0010] Acquire communication monitoring data and determine whether to adjust the primary algorithm strategy based on the communication monitoring data.

[0011] In some embodiments of this application, an algorithm strategy set is established, including:

[0012] The initiating user constructs a second algorithm set based on the algorithm feedback parameters from the responding user;

[0013] Obtain the first algorithm set of the initiating user;

[0014] The first-level SM2 algorithm and quantum algorithm sequence A are generated based on the fusion results of the first algorithm set and the second algorithm set;

[0015] A=(a1, a2…a…) i …a n ), where a i Let be the i-th first-order quantum algorithm; n is the number of first-order quantum algorithms;

[0016] Establish an algorithm strategy set B based on the first-level SM2 algorithm and the quantum algorithm sequence A;

[0017] B = (b1, b2, ..., bb) i …b n ), where b i Let be the i-th algorithmic sub-policy; n is the number of algorithmic sub-policies; algorithmic sub-policy b i It includes the first-level SM2 algorithm and the i-th first-level quantum algorithm.

[0018] In some embodiments of this application, a first-level algorithm strategy is defined, including:

[0019] b is set sequentially according to algorithm strategy set B. i For the target sub-strategy;

[0020] The performance evaluation value c of the generated target sub-strategy;

[0021] c=[ β i ×j i ];

[0022] Where θ1 represents the number of performance indicators; β i Let j be the influencing factor of the i-th performance index; i This is the expected reference value for the i-th performance metric in the target sub-strategy;

[0023] Generate performance evaluation values ​​for each algorithm sub-strategy in sequence;

[0024] Establish a performance evaluation value sequence C, C=(c1, c2…c i …c n ), where c iThis represents the performance evaluation value of the i-th algorithm sub-strategy;

[0025] The algorithm sub-strategy corresponding to the maximum value in the performance evaluation value sequence C is defined as the first-level algorithm strategy;

[0026] The first-level quantum algorithm in the first-level algorithm strategy is designated as the auxiliary quantum algorithm.

[0027] Generate synchronization instructions for the primary algorithm strategy;

[0028] The first-level algorithm strategy includes:

[0029] The auxiliary quantum algorithm, the first-level algorithm strategy includes:

[0030] The system consists of a Level 1 SM2 algorithm, a Level 1 initiating SM2 public key, a Level 1 responding SM2 public key, an auxiliary quantum algorithm, and a Level 1 responding quantum public key.

[0031] In some embodiments of this application, the construction of the interaction key set between the initiating user and the responding user includes:

[0032] The user obtains the primary algorithm strategy according to the synchronization command;

[0033] The initiating user generates an initial interaction packet based on the first-level algorithm strategy and sends the initial interaction packet to the responding user;

[0034] Respond to the user's request for the initial interaction packet and generate the verification value f of the initial interaction packet;

[0035] Preset verification threshold F1;

[0036] If f > F1, the responding user generates a feedback interaction packet and sends the feedback data packet to the initiating user;

[0037] Obtain the first shared secret based on the initial interaction packet;

[0038] Obtain the second shared secret based on the feedback data packet;

[0039] Processing the first shared secret and the second shared secret

[0040] Construct an interactive key set based on the processing results.

[0041] In some embodiments of this application, generating an initial interaction package includes:

[0042] Initiate user to generate first shared secret;

[0043] The first shared secret is encapsulated using a first-level response quantum public key, and a first-level encapsulation is generated.

[0044] The user initiates the generation of a secondary initiator SM2 public key, a redundant tag, and a primary initiator quantum public key;

[0045] Generate an initial interaction package, which includes:

[0046] The first-level encapsulation component, the second-level initiation public key, the redundant tag, and the first-level initiation quantum public key;

[0047] Set the first-level verification structure for the initial interaction package.

[0048] In some embodiments of this application, the response to a user-generated feedback interaction package includes:

[0049] The user generates a second shared secret in response;

[0050] The second shared secret is encapsulated using a quantum public key initiated at the first level, and a second-level encapsulation is generated.

[0051] The user responds by generating a secondary response containing the SM2 public key;

[0052] Generate a feedback interaction package, the feedback interaction package including:

[0053] A two-level encapsulation component, a two-level response SM2 public key, and a one-level response quantum public key;

[0054] Configure a two-level verification structure for the feedback data packet.

[0055] In some embodiments of this application, determining whether to modify the first-level algorithm strategy includes:

[0056] Establish multiple monitoring cycles and set the end time node of each monitoring cycle as the monitoring time node;

[0057] Obtain communication monitoring data at the current monitoring time point;

[0058] Multiple time intervals are set within the current monitoring period;

[0059] Establish a time interval sequence T, T=(t1, t2, ..., t3). i …t m ), where t i This represents the i-th time interval of the current monitoring period; m represents the number of time intervals in the current monitoring period.

[0060] Generate communication risk values ​​for each time interval;

[0061] Generate a revised evaluation value d for the current time point based on all communication risk values;

[0062] d=[ Y(i)×(k i -k')];

[0063] Among them, \(k_i\) is the communication risk value of the \(i\)-th time interval; \(k'\) is the communication risk value threshold; \(Y(i)\) is the selection coefficient; if \((k i - k')>0\); \(Y(i)=1\); if \((k i - k')<0\); \(Y(i)=0\); \(m\) is the number of time intervals in the current monitoring period;

[0064] A preset corrected evaluation value threshold \(D1\);

[0065] If \(d > D1\), generate a correction instruction for the first-level algorithm strategy.

[0066] In some embodiments of the present application, generating the communication risk value of each time interval includes:

[0067] According to the time interval sequence \(T\), set \(t i as the target time interval;

[0068] Generate the communication risk value \(k\) of the target time interval according to the communication monitoring data;

[0069] k = g× η i ×s i ;

[0070] g = U× β i ×v i ;

[0071] Among them, \(g\) is the risk correction coefficient; \(θ2\) is the number of attack risk indicators; \(η i is the influence factor of the \(i\)-th attack risk indicator; \(s i is the reference value of the \(i\)-th attack risk indicator of the target time interval generated based on the communication monitoring data; \(U\) is the conversion coefficient; \(θ1\) is the number of performance evaluation indicators; \(β i is the influence factor of the \(i\)-th performance evaluation indicator; \(v i is the deviation value of the \(i\)-th performance evaluation indicator;

[0072] Generate the communication risk value of each time interval in sequence.

[0073] In some embodiments of the present application, a quantum-resistant SM2 key exchange system is provided, including:

[0074] A central control unit, including a first processing module and a second processing module;

[0075] The initiating user obtains the algorithm feedback parameters of the responding user through the first processing module and establishes an algorithm policy set;

[0076] The second processing module is used to set the first-level algorithm policy according to the algorithm policy set;

[0077] The second processing module is also used to construct the interaction key set of the initiating user and the responding user according to the first-level algorithm strategy;

[0078] The monitoring unit is used to acquire communication monitoring data and determine whether to correct the primary algorithm strategy based on the communication monitoring data.

[0079] The first processing module is also used for:

[0080] A second algorithm set is constructed based on the algorithm feedback parameters from the responding users;

[0081] Obtain the first algorithm set of the initiating user;

[0082] The first-level SM2 algorithm and quantum algorithm sequence A are generated based on the fusion results of the first algorithm set and the second algorithm set;

[0083] A=(a1, a2…a…) i …a n ), where a i Let be the i-th first-order quantum algorithm; n is the number of first-order quantum algorithms;

[0084] Establish an algorithm strategy set B based on the first-level SM2 algorithm and the quantum algorithm sequence A;

[0085] B = (b1, b2, ..., bb) i …b n ), where b i Let be the i-th algorithmic sub-policy; n is the number of algorithmic sub-policies; algorithmic sub-policy b i It includes the first-level SM2 algorithm and the i-th first-level quantum algorithm.

[0086] In some embodiments of this application, the second processing module is further configured to:

[0087] b is set sequentially according to algorithm strategy set B. i For the target sub-strategy;

[0088] The performance evaluation value c of the generated target sub-strategy;

[0089] c=[ β i ×j i ];

[0090] Where θ1 represents the number of performance indicators; β i Let j be the influencing factor of the i-th performance index; i This is the expected reference value for the i-th performance metric in the target sub-strategy;

[0091] Generate performance evaluation values ​​for each algorithm sub-strategy in sequence;

[0092] Establish a performance evaluation value sequence C, C=(c1, c2…c i …c n ), where c i This represents the performance evaluation value of the i-th algorithm sub-strategy;

[0093] The algorithm sub-strategy corresponding to the maximum value in the performance evaluation value sequence C is defined as the first-level algorithm strategy;

[0094] The first-level quantum algorithm in the first-level algorithm strategy is designated as the auxiliary quantum algorithm.

[0095] Generate synchronization instructions for the primary algorithm strategy;

[0096] The first-level algorithm strategy includes:

[0097] The auxiliary quantum algorithm, the first-level algorithm strategy includes:

[0098] The system consists of a Level 1 SM2 algorithm, a Level 1 initiating SM2 public key, a Level 1 responding SM2 public key, an auxiliary quantum algorithm, and a Level 1 responding quantum public key.

[0099] Compared with existing technologies, the SM2 key exchange method and system resistant to quantum attacks described in this application have the following advantages:

[0100] By fusing the algorithms for initiating and responding users, multiple algorithmic sub-strategies are established. Based on the performance optimization results, the optimal algorithmic sub-strategy is selected to improve the efficiency and security of SM2 key exchange. At the same time, by periodically monitoring the communication status, timely warnings of quantum attack risks are issued, and algorithmic sub-strategies are corrected, thereby reducing the harm of quantum attacks.

[0101] By constructing a dual-cryptography encryption model, the security of communication can be guaranteed and the risk of intrusion during communication can be reduced when a single cryptographic type is cracked. Through modular design, different types of quantum algorithms can be added at any time to improve adaptability to different communication scenarios. Attached Figure Description

[0102] Figure 1 This is a flowchart illustrating a quantum-resistant SM2 key exchange method in a preferred embodiment of this application. Detailed Implementation

[0103] The specific embodiments of this application will be described in further detail below with reference to the accompanying drawings and examples. The following examples are used to illustrate this application, but are not intended to limit the scope of this application.

[0104] In the description of this application, it should be understood that the terms "center", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.

[0105] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0106] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0107] like Figure 1 As shown, a preferred embodiment of this application provides a quantum-resistant SM2 key exchange method, comprising:

[0108] S101: The initiating user establishes an algorithm strategy set based on the algorithm feedback parameters from the responding user;

[0109] S102: Set the first-level algorithm strategy according to the algorithm strategy set, and construct the interaction key set of the initiating user and the responding user according to the first-level algorithm strategy;

[0110] S103: Obtain communication monitoring data and determine whether to correct the first-level algorithm strategy based on the communication monitoring data.

[0111] Specifically, the initiating user refers to the party that initiates the communication, and the responding user refers to the party that receives the communication. The number of both the initiating user and the responding user in a single communication process is preferably one.

[0112] Specifically, the algorithm strategy set is established, including:

[0113] The initiating user constructs a second algorithm set based on the algorithm feedback parameters from the responding user;

[0114] Obtain the first algorithm set of the initiating user;

[0115] The first-level SM2 algorithm and quantum algorithm sequence A are generated based on the fusion results of the first algorithm set and the second algorithm set;

[0116] A=(a1, a2…a…) i …a n ), where a i Let be the i-th first-order quantum algorithm; n is the number of first-order quantum algorithms;

[0117] Establish an algorithm strategy set B based on the first-level SM2 algorithm and the quantum algorithm sequence A;

[0118] B = (b1, b2, ..., bb) i …b n ), where b i Let be the i-th algorithmic sub-policy; n is the number of algorithmic sub-policies; algorithmic sub-policy b i It includes the first-level SM2 algorithm and the i-th first-level quantum algorithm.

[0119] Specifically, the second algorithm set includes the types of quantum algorithms that can be run by the responding user and the parameters of the SM2 algorithm to be run.

[0120] Specifically, the first algorithm set includes the types of quantum algorithms that can be run by the initiating user and the parameters of the SM2 algorithm to be run.

[0121] Specifically, quantum algorithm types include, but are not limited to, lattice-based quantum algorithms, hash-based quantum algorithms, encoding-based quantum algorithms, multivariate polynomial-based quantum algorithms, and homologous quantum algorithms.

[0122] And the first-level initiating SM2 public key (i.e., the long-term SM2 public key for initiating user filing).

[0123] Specifically, by fusing the two sets of algorithms, all quantum algorithms that can be run by both the initiating and responding users are extracted, and a first-level quantum algorithm sequence A is constructed. Each first-level quantum algorithm represents a quantum algorithm, and both the initiating and responding users can support the operation of that quantum algorithm.

[0124] Specifically, a first-level SM2 algorithm is generated based on the fusion result of the SM2 algorithm parameters of the initiating user and the responding user. The first-level SM2 algorithm includes a first-level response SM2 public key (i.e., the long-term SM2 public key registered by the responding user) and a first-level initiating SM2 public key (i.e., the long-term SM2 public key registered by the initiating user).

[0125] Specifically, the first-level SM2 algorithm is randomly combined with various first-level quantum algorithms, and multiple algorithm sub-policies are generated based on the combination results.

[0126] Specifically, the first-level algorithm strategy is defined, including:

[0127] b is set sequentially according to algorithm strategy set B. i For the target sub-strategy;

[0128] The performance evaluation value c of the generated target sub-strategy;

[0129] c=[ β i ×j i ];

[0130] Where θ1 represents the number of performance indicators; β i Let j be the influencing factor of the i-th performance index; i This is the expected reference value for the i-th performance metric in the target sub-strategy;

[0131] Generate performance evaluation values ​​for each algorithm sub-strategy in sequence;

[0132] Establish a performance evaluation value sequence C, C=(c1, c2…c i …c n ), where c i This represents the performance evaluation value of the i-th algorithm sub-strategy;

[0133] The algorithm sub-strategy corresponding to the maximum value in the performance evaluation value sequence C is defined as the first-level algorithm strategy;

[0134] The first-level quantum algorithm in the first-level algorithm strategy is designated as the auxiliary quantum algorithm.

[0135] Generate synchronization instructions for the primary algorithm strategy;

[0136] The first-level algorithm strategy includes:

[0137] The auxiliary quantum algorithm, the first-level algorithm strategy includes:

[0138] The system consists of a Level 1 SM2 algorithm, a Level 1 initiating SM2 public key, a Level 1 responding SM2 public key, an auxiliary quantum algorithm, and a Level 1 responding quantum public key.

[0139] Specifically, performance evaluation metrics include, but are not limited to, several parameters related to communication efficiency and security, such as algorithm signature efficiency, key exchange speed, resource consumption, and security confidence.

[0140] Specifically, by quantifying each performance evaluation indicator, all indicators are brought to the same value range. Furthermore, the higher the reference value of each performance evaluation indicator, the greater its corresponding advantage.

[0141] Specifically, the influence factors of each performance evaluation index are set according to the actual communication needs of the initiating and responding users, thereby achieving optimal processing for different communication scenarios.

[0142] Specifically, the higher the performance evaluation index, the better the adaptability of the current algorithm sub-strategy to the communication needs of the initiating and responding users.

[0143] Specifically, a temporary quantum key pair for the initiating user and the responding user is generated based on an auxiliary quantum algorithm, thereby setting a first-level response quantum public key (i.e., the temporary quantum public key generated for the responding user).

[0144] It is understood that in the above embodiments, by fusing the algorithms of the initiating user and the responding user, multiple algorithm sub-policies are established, and the best algorithm sub-policy is selected based on the performance optimization results, thereby improving the efficiency and security of SM2 key exchange.

[0145] In a preferred embodiment of this application, the construction of the interaction key set for the initiating user and the responding user includes:

[0146] The system responds to the user by obtaining the primary algorithm strategy based on the synchronization command.

[0147] The initiating user generates an initial interaction packet based on the first-level algorithm strategy and sends the initial interaction packet to the responding user;

[0148] Respond to the user's request for the initial interaction packet and generate the verification value f of the initial interaction packet;

[0149] Preset verification threshold F1;

[0150] If f > F1, the responding user generates a feedback interaction packet and sends the feedback data packet to the initiating user;

[0151] Obtain the first shared secret based on the initial interaction packet;

[0152] Obtain the second shared secret based on the feedback data packet;

[0153] Processing the first shared secret and the second shared secret

[0154] Construct an interactive key set based on the processing results.

[0155] Specifically, the initiating and responding users use the same key derivation function to perform mixed calculations on the first shared secret and the second common secret to construct the session master key. They also generate various types of temporary subkeys according to session requirements, and securely destroy each temporary subkey immediately after it has completed its corresponding task. An interaction key set is then constructed based on the session master key and all temporary subkeys.

[0156] Specifically, a verification value f is generated based on the parsing results of the first-level verification structure. If a single component is at risk of tampering, its verification sub-value is set to zero; if there is no risk of tampering, its verification sub-value is set to 1. The verification value f is then generated based on the sum of the verification sub-values ​​of all components.

[0157] Specifically, the preset verification value threshold F1 is preferably 3.

[0158] Specifically, the components of the first-level verification structure include a first-level encapsulation component, a second-level initiating public key, a redundant tag, and four digital signatures on the first-level initiating quantum public key.

[0159] Specifically, generating the initial interaction package includes:

[0160] Initiate user to generate first shared secret;

[0161] The first shared secret is encapsulated using a first-level response quantum public key, and a first-level encapsulation is generated.

[0162] The user initiates the generation of a secondary initiator SM2 public key, a redundant tag, and a primary initiator quantum public key;

[0163] Generate an initial interaction package, which includes:

[0164] The first-level encapsulation component, the second-level initiation public key, the redundant tag, and the first-level initiation quantum public key;

[0165] Set the first-level verification structure for the initial interaction package.

[0166] Specifically, the first shared secret is a temporary secret randomly generated by the initiating user. It is encapsulated and processed using the first-level response quantum public key to generate a first-level encapsulated component. This first-level encapsulated component can only be decapsulated using the corresponding quantum private key of the responding user.

[0167] Specifically, the redundant label did not initiate the generation of random numbers by the user based on the needs of this session.

[0168] Specifically, the primary initiating quantum public key is the quantum public key in the initiating user's temporary quantum key pair generated based on an auxiliary quantum algorithm.

[0169] Specifically, the long-term SM2 private key used to initiate user registration is used to digitally sign all data in the initial data packet, thereby constructing a first-level verification structure.

[0170] Specifically, responding to user-generated feedback interaction packages includes:

[0171] The user generates a second shared secret in response;

[0172] The second shared secret is encapsulated using a quantum public key initiated at the first level, and a second-level encapsulation is generated.

[0173] The user responds by generating a secondary response containing the SM2 public key;

[0174] Generate a feedback interaction package, which includes:

[0175] A two-level encapsulation component, a two-level response SM2 public key, and a one-level response quantum public key;

[0176] Configure a two-level verification structure for the feedback data packet.

[0177] Specifically, the second shared secret is a temporary secret randomly generated by the user. It is encapsulated and processed using the first-level initiating quantum public key to generate a second-level encapsulation. This second-level encapsulation can only be decapsulated using the corresponding quantum private key of the initiating user.

[0178] Specifically, the long-term SM2 private key used in response to user registration is used to digitally sign all data in the initial data packet, thereby constructing a two-level verification structure.

[0179] It is understandable that, in the above embodiments, by constructing a dual-password encryption model, the security of communication can be guaranteed and the risk of intrusion during the communication process can be reduced when a single password type is cracked.

[0180] In a preferred embodiment of this application, determining whether to modify the first-level algorithm strategy includes:

[0181] Establish multiple monitoring cycles and set the end time node of each monitoring cycle as the monitoring time node;

[0182] Obtain communication monitoring data at the current monitoring time point;

[0183] Multiple time intervals are set within the current monitoring period;

[0184] Establish a time interval sequence T, T=(t1, t2, ..., t3). i …t m ), where t i This represents the i-th time interval of the current monitoring period; m represents the number of time intervals in the current monitoring period.

[0185] Generate communication risk values ​​for each time interval;

[0186] Generate a revised evaluation value d for the current time point based on all communication risk values;

[0187] d=[ Y(i)×(k i -k')];

[0188] Where ki is the communication risk value for the i-th time interval; k' is the communication risk value threshold; Y(i) is the selection coefficient; if (ki - k') > 0; Y(i) = 1; If (k i - k') < 0; Y(i) = 0; m is the number of time intervals within the current monitoring period;

[0189] Preset the corrected evaluation value threshold D1;

[0190] If d > D1, generate a correction instruction for the primary algorithm strategy.

[0191] Specifically, the corrected evaluation value threshold can be set according to historical parameters.

[0192] Specifically, the communication risk value threshold can be set according to historical parameters.

[0193] Specifically, the duration of a single monitoring period can be set according to the historical communication attack frequency. The higher the attack frequency, the shorter the duration of the corresponding monitoring period.

[0194] Specifically, set the duration of a single time interval according to the corrected evaluation value at the previous monitoring time node. The larger the corrected evaluation value, the shorter the duration of the corresponding time interval. The mapping relationship between the two can be set according to historical parameters.

[0195] Specifically, divide the current monitoring period according to the set duration of the time interval to generate multiple time intervals.

[0196] Specifically, the larger the corrected evaluation value, the worse the efficiency and security of the current primary algorithm strategy during key interaction. When the corrected evaluation value is greater than the preset corrected evaluation value threshold, the current primary algorithm strategy needs to be corrected.

[0197] Specifically, generate the communication risk value for each time interval, including:

[0198] Set t in sequence according to the time interval sequence T i as the target time interval;

[0199] Generate the communication risk value k for the target time interval according to the communication monitoring data;

[0200] k = g × η i × s i ;

[0201] g = U × β i × v i ;

[0202] Among them, g is the risk correction coefficient; θ2 is the number of attack risk indicators; η i is the influence factor of the i-th attack risk indicator; si θ1 is the reference value of the i-th attack risk indicator in the target time interval, generated based on communication monitoring data; U is the conversion coefficient; θ1 is the number of performance evaluation indicators; β i v is the influence factor of the i-th performance evaluation index; i This represents the deviation value of the i-th performance evaluation index;

[0203] The communication risk values ​​for each time interval are generated sequentially.

[0204] Specifically, by using conversion coefficients, the risk correction coefficient g is made to fall within a preset range, and [ β i ×v i The larger the value of ], the larger the value of the risk correction coefficient g, and the mapping relationship between the two can be set according to historical parameters.

[0205] Specifically, attack risk indicators include, but are not limited to, multiple parameters related to transmission risk, such as the number of attacks, the number of times the password has been cracked, and the scope of password cracking. By quantifying each attack risk indicator, the indicators are made to be within the same value range. The larger the reference value of each attack risk indicator, the more transmission risks occur within the target time interval, and the worse the corresponding key interaction efficiency and security.

[0206] Specifically, the impact factor of each attack risk indicator can be set according to its degree of mapping to transmission risk; the greater the degree of mapping, the greater the corresponding impact factor.

[0207] Specifically, the higher the communication risk value, the worse the efficiency and security of key interaction within the current time interval.

[0208] It is understandable that in the above embodiments, by periodically monitoring the communication status, timely warnings of quantum attack risks can be issued, and algorithm sub-strategies can be corrected, thereby reducing the harm of quantum attacks.

[0209] In another preferred embodiment of the quantum-resistant SM2 key exchange method based on any of the above preferred embodiments, this preferred embodiment provides a quantum-resistant SM2 key exchange method, comprising:

[0210] The central control unit includes a first processing module and a second processing module;

[0211] The initiating user obtains the algorithm feedback parameters from the responding user through the first processing module and establishes an algorithm strategy set;

[0212] The second processing module is used to set the first-level algorithm strategy according to the algorithm strategy set;

[0213] The second processing module is also used to construct the interaction key set between the initiating user and the responding user according to the first-level algorithm strategy;

[0214] The monitoring unit is used to acquire communication monitoring data and determine whether to correct the primary algorithm strategy based on the communication monitoring data.

[0215] The first processing module is also used for:

[0216] A second algorithm set is constructed based on the algorithm feedback parameters from the responding users;

[0217] Obtain the first algorithm set of the initiating user;

[0218] The first-level SM2 algorithm and quantum algorithm sequence A are generated based on the fusion results of the first algorithm set and the second algorithm set;

[0219] A=(a1, a2…a…) i …a n ), where a i Let be the i-th first-order quantum algorithm; n is the number of first-order quantum algorithms;

[0220] Establish an algorithm strategy set B based on the first-level SM2 algorithm and the quantum algorithm sequence A;

[0221] B = (b1, b2, ..., bb) i …b n ), where b i Let be the i-th algorithmic sub-policy; n is the number of algorithmic sub-policies; algorithmic sub-policy b i It includes the first-level SM2 algorithm and the i-th first-level quantum algorithm.

[0222] In a preferred embodiment of this application, the second processing module is further configured to:

[0223] b is set sequentially according to algorithm strategy set B. i For the target sub-strategy;

[0224] The performance evaluation value c of the generated target sub-strategy;

[0225] c=[ β i ×j i ];

[0226] Where θ1 represents the number of performance indicators; β i Let j be the influencing factor of the i-th performance index; i This is the expected reference value for the i-th performance metric in the target sub-strategy;

[0227] Generate performance evaluation values ​​for each algorithm sub-strategy in sequence;

[0228] Establish a performance evaluation value sequence C, C=(c1, c2…ci …c n ), where c i This represents the performance evaluation value of the i-th algorithm sub-strategy;

[0229] The algorithm sub-strategy corresponding to the maximum value in the performance evaluation value sequence C is defined as the first-level algorithm strategy;

[0230] The first-level quantum algorithm in the first-level algorithm strategy is designated as the auxiliary quantum algorithm.

[0231] Generate synchronization instructions for the primary algorithm strategy;

[0232] The first-level algorithm strategy includes:

[0233] The auxiliary quantum algorithm, the first-level algorithm strategy includes:

[0234] The system consists of a Level 1 SM2 algorithm, a Level 1 initiating SM2 public key, a Level 1 responding SM2 public key, an auxiliary quantum algorithm, and a Level 1 responding quantum public key.

[0235] Based on the first concept of this application, multiple algorithm sub-strategies are established by fusing the algorithms of the initiating user and the responding user. The best algorithm sub-strategy is selected based on the performance optimization results to improve the efficiency and security of SM2 key exchange. At the same time, by periodically monitoring the communication status, the risk of quantum attacks can be warned in a timely manner, and the algorithm sub-strategies can be corrected to reduce the harm of quantum attacks.

[0236] According to the second concept of this application, by constructing a dual-cryptographic encryption model, the security of communication can be guaranteed and the risk of intrusion during the communication process can be reduced when a single cryptographic type is cracked. Through modular design, different types of quantum algorithms can be added at any time to improve adaptability to different communication scenarios.

[0237] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and substitutions can be made without departing from the technical principles of this application, and these improvements and substitutions should also be considered within the scope of protection of this application.

Claims

1. A quantum-resistant SM2 key exchange method, characterized in that, include: The initiating user establishes an algorithm strategy set based on the algorithm feedback parameters from the responding user; Set a primary algorithm strategy based on the algorithm strategy set, and construct an interaction key set for the initiating user and the responding user based on the primary algorithm strategy; Acquire communication monitoring data and determine whether to adjust the primary algorithm strategy based on the communication monitoring data; The set of algorithm strategies includes: The initiating user constructs a second algorithm set based on the algorithm feedback parameters from the responding user; Obtain the first algorithm set of the initiating user; The first-level SM2 algorithm and quantum algorithm sequence A are generated based on the fusion results of the first algorithm set and the second algorithm set; A=(a1, a2…a…) i …a n ), where a i Let be the i-th first-order quantum algorithm; n is the number of first-order quantum algorithms; Establish an algorithm strategy set B based on the first-level SM2 algorithm and the quantum algorithm sequence A; B = (b1, b2, ..., bb) i …b n ), where b i Let be the i-th algorithmic sub-policy; n is the number of algorithmic sub-policies; algorithmic sub-policy b i It includes the first-level SM2 algorithm and the i-th first-level quantum algorithm.

2. The quantum-resistant SM2 key exchange method as described in claim 1, characterized in that, Define the primary algorithm strategy, including: b is set sequentially according to algorithm strategy set B. i For the target sub-strategy; The performance evaluation value c of the generated target sub-strategy; c=[ b i ×j i ]; Where θ1 represents the number of performance indicators; β i Let j be the influencing factor of the i-th performance index; i This is the expected reference value for the i-th performance metric in the target sub-strategy; Generate performance evaluation values ​​for each algorithm sub-strategy in sequence; Establish a performance evaluation value sequence C, C=(c1, c2…c i …c n ), where c i This represents the performance evaluation value of the i-th algorithm sub-strategy; The algorithm sub-strategy corresponding to the maximum value in the performance evaluation value sequence C is defined as the first-level algorithm strategy; The first-level quantum algorithm in the first-level algorithm strategy is designated as the auxiliary quantum algorithm. Generate synchronization instructions for the primary algorithm strategy; The first-level algorithm strategy includes: The auxiliary quantum algorithm, the first-level algorithm strategy includes: The system consists of a Level 1 SM2 algorithm, a Level 1 initiating SM2 public key, a Level 1 responding SM2 public key, an auxiliary quantum algorithm, and a Level 1 responding quantum public key.

3. The quantum-resistant SM2 key exchange method as described in claim 2, characterized in that, Construct the interaction key set for the initiating user and the responding user, including: The user obtains the primary algorithm strategy according to the synchronization command; The initiating user generates an initial interaction packet based on the first-level algorithm strategy and sends the initial interaction packet to the responding user; Respond to the user's request for the initial interaction packet and generate the verification value f of the initial interaction packet; Preset verification threshold F1; If f > F1, the responding user generates a feedback interaction packet and sends the feedback data packet to the initiating user; Obtain the first shared secret based on the initial interaction packet; Obtain the second shared secret based on the feedback data packet; Processing the first shared secret and the second shared secret Construct an interactive key set based on the processing results.

4. The quantum-resistant SM2 key exchange method as described in claim 3, characterized in that, Generate the initial interactive package, including: Initiate user to generate first shared secret; The first shared secret is encapsulated using a first-level response quantum public key, and a first-level encapsulation is generated. The user initiates the generation of a secondary initiator SM2 public key, a redundant tag, and a primary initiator quantum public key; Generate an initial interaction package, which includes: The first-level encapsulation component, the second-level initiation public key, the redundant tag, and the first-level initiation quantum public key; Set the first-level verification structure for the initial interaction package.

5. The quantum-resistant SM2 key exchange method as described in claim 4, characterized in that, Respond to user-generated feedback interaction packages, including: The user generates a second shared secret in response; The second shared secret is encapsulated using a quantum public key initiated at the first level, and a second-level encapsulation is generated. The user responds by generating a secondary response with the SM2 public key; Generate a feedback interaction package, the feedback interaction package including: A two-level encapsulation component, a two-level response SM2 public key, and a one-level response quantum public key; Configure a two-level verification structure for the feedback data packet.

6. The quantum-resistant SM2 key exchange method as described in claim 5, characterized in that, Determining whether to modify the first-level algorithm strategy includes: Establish multiple monitoring cycles and set the end time node of each monitoring cycle as the monitoring time node; Obtain communication monitoring data at the current monitoring time point; Multiple time intervals are set within the current monitoring period; Establish a time interval sequence T, T=(t1, t2, ..., t3). i …t m ), where t i This represents the i-th time interval of the current monitoring period; m represents the number of time intervals in the current monitoring period. Generate communication risk values ​​for each time interval; Generate a revised evaluation value d for the current time point based on all communication risk values; d=[ Y(i)×(k i -k')]; Among them, ki is the communication risk value in the i-th time interval; k' is the communication risk value threshold; Y(i) is the selection coefficient; if (k i - k') > 0; Y(i) = 1; if (k i - k') < 0; Y(i) = 0; m is the number of time intervals in the current monitoring period; Preset correction evaluation value threshold D1; If d > D1, generate correction instructions for the first-level algorithm strategy.

7. The quantum-resistant SM2 key exchange method as described in claim 6, characterized in that, Generate communication risk values ​​for each time interval, including: Based on the time interval sequence T, t is set sequentially. i The target time interval; A communication risk value k for the target time interval is generated based on communication monitoring data; k=g×[ or i ×s i ]; g=U×[ b i ×v i ]; Where g is the risk correction coefficient; θ2 is the number of attack risk indicators; η i s is the influencing factor of the i-th attack risk indicator; i θ1 is the reference value of the i-th attack risk indicator in the target time interval, generated based on communication monitoring data; U is the conversion coefficient; θ1 is the number of performance evaluation indicators; β i v is the influence factor of the i-th performance evaluation index; i This represents the deviation value of the i-th performance evaluation index; The communication risk values ​​for each time interval are generated sequentially.

8. A quantum-resistant SM2 key exchange system, employing the quantum-resistant SM2 key exchange method according to any one of claims 1-7, characterized in that, include: The central control unit includes a first processing module and a second processing module; The initiating user obtains the algorithm feedback parameters from the responding user through the first processing module and establishes an algorithm strategy set; The second processing module is used to set the first-level algorithm strategy according to the algorithm strategy set; The second processing module is also used to construct the interaction key set of the initiating user and the responding user according to the first-level algorithm strategy; The monitoring unit is used to acquire communication monitoring data and determine whether to correct the primary algorithm strategy based on the communication monitoring data. The first processing module is also used for: A second algorithm set is constructed based on the algorithm feedback parameters from the responding users; Obtain the first algorithm set of the initiating user; The first-level SM2 algorithm and quantum algorithm sequence A are generated based on the fusion results of the first algorithm set and the second algorithm set; A=(a1, a2…a…) i …a n ), where a i Let be the i-th first-order quantum algorithm; n is the number of first-order quantum algorithms; Establish an algorithm strategy set B based on the first-level SM2 algorithm and the quantum algorithm sequence A; B = (b1, b2, ..., bb) i …b n ), where b i Let be the i-th algorithmic sub-policy; n is the number of algorithmic sub-policies; algorithmic sub-policy b i It includes the first-level SM2 algorithm and the i-th first-level quantum algorithm.

9. The quantum-resistant SM2 key exchange system as described in claim 8, characterized in that, The second processing module is also used for: b is set sequentially according to algorithm strategy set B. i For the target sub-strategy; The performance evaluation value c of the generated target sub-strategy; c=[ b i ×j i ]; Where θ1 represents the number of performance indicators; β i Let j be the influencing factor of the i-th performance index; i This is the expected reference value for the i-th performance metric in the target sub-strategy; Generate performance evaluation values ​​for each algorithm sub-strategy in sequence; Establish a performance evaluation value sequence C, C=(c1, c2…c i …c n ), where c i This represents the performance evaluation value of the i-th algorithm sub-strategy; The algorithm sub-strategy corresponding to the maximum value in the performance evaluation value sequence C is defined as the first-level algorithm strategy; The first-level quantum algorithm in the first-level algorithm strategy is designated as the auxiliary quantum algorithm. Generate synchronization instructions for the primary algorithm strategy; The first-level algorithm strategy includes: The auxiliary quantum algorithm, the first-level algorithm strategy includes: The system consists of a Level 1 SM2 algorithm, a Level 1 initiating SM2 public key, a Level 1 responding SM2 public key, an auxiliary quantum algorithm, and a Level 1 responding quantum public key.

Images