SIP (Session Initiation Protocol) authentication method based on post-quantum and national secret hybrid signature algorithm

Abstract

The invention provides an SIP (Session Initiation Protocol) authentication method based on a post quantum and national secret mixed signature algorithm, which is applied to an SIP client, and comprises the following steps: sending a first registration message to an SIP server, the first registration message comprising a target authentication control parameter, so that the SIP server generates a first reply message according to the target authentication control parameter; receiving a first reply message; obtaining a first mixed signature certificate of the SIP client according to the first reply message, generating a first random number, and performing mixed signature on the first random number to generate a first signature value; sending a second registration message to the SIP server, so that the SIP server verifies the first mixed signature certificate by adopting a pre-stored root certificate of the SIP client, and verifies the first signature value; and receiving second reply information, and indicating whether the SIP client is successfully verified or not. By integrating a post-quantum algorithm, SIP authentication has the characteristic of quantum attack resistance.

Description

Technical Field

[0001] This invention relates to the field of cryptographic application technology, and more specifically, to a SIP authentication method based on a hybrid signature algorithm of post-quantum and Chinese cryptography. Background Technology

[0002] In today's increasingly complex cybersecurity landscape and with the rapid development of quantum computing technology, the Session Initiation Protocol (SIP) is a core protocol in multimedia data and control architectures. Its primary purpose is to address signaling control within IP networks and communication with softswitch platforms, thereby forming the next generation of value-added service platforms. However, current SIP authentication processes utilize asymmetric Chinese cryptographic signature algorithms, which are vulnerable to cracking and could easily lead to the leakage of the SIP authentication process. Summary of the Invention

[0003] The purpose of this invention is to address the shortcomings of the prior art by providing a SIP authentication method based on a hybrid signature algorithm of post-quantum and Chinese cryptographic methods. This method integrates the post-quantum algorithm into the SIP authentication process, enabling SIP authentication to resist quantum attacks and making the authentication process more secure.

[0004] To achieve the above objectives, the technical solutions adopted in the embodiments of this application are as follows: In a first aspect, embodiments of this application provide a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards, applied to a SIP client, the method comprising: Send a first registration message to the SIP server. The first registration message includes: target authentication control parameters. The first registration message is used to enable the SIP server to generate a first response message corresponding to the SIP server based on the target authentication control parameters. Receive the first reply message sent by the SIP server; Based on the first reply message, obtain the first hybrid signature certificate of the SIP client, generate the first random number corresponding to the SIP client, and use the national cryptographic signature algorithm and the post-quantum signature algorithm to perform hybrid signature on the first random number to generate the first signature value; A second registration message is sent to the SIP server. The second registration message includes: the first random number, the first signature value, and the first hybrid signature certificate. The second registration message is used to enable the SIP server to verify the first hybrid signature certificate using the pre-stored root certificate of the SIP client, and to verify the first signature value according to the hybrid signature public key of the SIP client. The client receives a second response message from the SIP server, which indicates whether the SIP client has successfully verified the message.

[0005] In an optional implementation, the target authentication control parameter is a two-way authentication control parameter, which includes a post-quantum algorithm identifier. The first registration message is used to enable the SIP server to obtain the second hybrid signature certificate of the SIP server when it determines that the target authentication control parameter is a two-way authentication control parameter, generate a second random number corresponding to the SIP server, and use the national cryptographic signature algorithm and the post-quantum signature algorithm to perform a hybrid signature on the second random number to generate a second signature value. The first response message includes: the second random number, the second signature value, and the second hybrid signature certificate; After receiving the first reply message sent by the SIP server, the method further includes: The second hybrid signature certificate is verified using the pre-stored root certificate of the SIP server. The second signature value is verified using the hybrid signature public key of the SIP server to obtain the verification result of the SIP server. The verification result of the SIP server is used to indicate whether the verification by the SIP server was successful.

[0006] In an optional implementation, the step of verifying the second signature value based on the hybrid signature public key of the SIP server to obtain the verification result of the SIP server includes: Based on the second post-quantum signature public key and the second national cryptographic signature public key in the hybrid signature public key of the SIP server, the second national cryptographic signature component and the second post-quantum signature component in the second signature value are verified respectively to obtain the verification result of the SIP server.

[0007] In an optional implementation, the step of generating a first signature value by mixing the first random number with the national cryptographic signature algorithm and the post-quantum signature algorithm includes: Obtain the hybrid signature private key of the SIP client, wherein the hybrid signature private key of the SIP client includes: a first national cryptographic signature private key and a first post-quantum signature private key; Based on the first national cryptographic signature private key and the first post-quantum signature private key, the first random number is signed using the national cryptographic signature algorithm and the post-quantum signature algorithm respectively, generating a first national cryptographic signature component and a first post-quantum signature component. The first signature value includes: the first national cryptographic signature component and the first post-quantum signature component.

[0008] In an optional implementation, the target authentication control parameter is a one-way authentication control parameter, which includes: a post-quantum algorithm identifier; The first registration message is used to enable the SIP server to generate the first reply message based on the post-quantum algorithm identifier when it determines that the target authentication control parameter is a one-way authentication control parameter.

[0009] Secondly, embodiments of this application also provide a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards, applied to a SIP server, the method comprising: Receive a first registration message sent by a SIP client, the first registration message including: target authentication control parameters; Generate the first response message corresponding to the SIP server based on the target authentication control parameters; Send the first reply message to the SIP client. The first reply message is used to enable the SIP client to obtain the first hybrid signature certificate of the SIP client, generate the first random number corresponding to the SIP client, and perform hybrid signature on the first random number using the national cryptographic signature algorithm and the post-quantum signature algorithm to generate the first signature value. Receive a second registration message sent by the SIP client, the second registration message including: the first random number, the first signature value and the first hybrid signature certificate; The first hybrid signature certificate is verified using the pre-stored root certificate of the SIP client, and the first signature value is verified based on the hybrid signature public key of the SIP client. A second response message is sent to the SIP client, which indicates whether the SIP client has successfully verified the data.

[0010] In an optional implementation, the target authentication control parameter is a two-way authentication control parameter, which includes a post-quantum algorithm identifier. Generating the first response message corresponding to the SIP server based on the target authentication control parameter includes: Obtain the second hybrid signature certificate of the SIP server, generate the second random number corresponding to the SIP server, and use the national cryptographic signature algorithm and the post-quantum signature algorithm to perform a hybrid signature on the second random number to generate a second signature value. The first reply message includes: the second random number, the second signature value and the second hybrid signature certificate.

[0011] In an optional implementation, the step of using the national cryptographic signature algorithm and the post-quantum signature algorithm to perform a mixed signature on the second random number to generate a second signature value includes: Obtain the hybrid signature private key of the SIP server, which includes: a second national cryptographic signature private key and a second post-quantum signature private key; Based on the second national cryptographic signature private key and the second post-quantum signature private key, the second random number is signed using the national cryptographic signature algorithm and the post-quantum signature algorithm respectively, generating a second national cryptographic signature component and a second post-quantum signature component. The second signature value includes: the second national cryptographic signature component and the second post-quantum signature component.

[0012] In an optional implementation, the target authentication control parameter is a one-way authentication control parameter, which includes a post-quantum algorithm identifier; when the target authentication control parameter is determined to be a one-way authentication control parameter, the first response message is generated based on the post-quantum algorithm identifier.

[0013] In an optional implementation, the step of verifying the first hybrid signature certificate using a pre-stored root certificate of the SIP client, and verifying the first signature value based on the hybrid signature public key of the SIP client, includes: The first hybrid signature certificate is verified using the pre-stored root certificate of the SIP client; The first signature value is verified using the hybrid signature public key of the SIP client to obtain the verification result of the SIP client. The verification result of the SIP client is used to indicate whether the SIP client has successfully verified the signature. The second reply message includes the verification result of the SIP client.

[0014] The beneficial effects of this application are: In summary, this application provides a SIP authentication method based on a hybrid signature algorithm combining post-quantum and Chinese cryptographic algorithms, applied to a SIP client. The method includes: sending a first registration message to a SIP server, the first registration message including target authentication control parameters, the first registration message causing the SIP server to generate a first response message corresponding to the SIP server based on the target authentication control parameters; receiving the first response message sent by the SIP server; obtaining a first hybrid signature certificate of the SIP client, generating a first random number corresponding to the SIP client based on the first response message, and performing a hybrid signature on the first random number using a Chinese cryptographic signature algorithm and a post-quantum signature algorithm to generate a first signature value; sending a second registration message to the SIP server, the second registration message including the first random number, the first signature value, and the first hybrid signature certificate, the second registration message causing the SIP server to verify the first hybrid signature certificate using a pre-stored root certificate of the SIP client, and verifying the first signature value based on the hybrid signature public key of the SIP client; and receiving a second response message sent by the SIP server, the second response message indicating whether the SIP client has successfully verified the signature. The method in this application incorporates a post-quantum algorithm into the SIP authentication process, making SIP authentication resistant to quantum attacks and thus more secure. Attached Figure Description

[0015] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 One of the flowcharts for a SIP authentication method based on a hybrid signature algorithm of post-quantum and Chinese cryptography provided in this application embodiment; Figure 2 A second schematic flowchart illustrating a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards provided for embodiments of this application; Figure 3 The third flowchart illustrates a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic methods provided in this application. Figure 4 The fourth flowchart illustrates a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards, provided for embodiments of this application. Figure 5 The fifth flowchart illustrates a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards, provided for embodiments of this application. Figure 6 A flowchart illustrating a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptography provided for embodiments of this application is shown in Figure 6. Figure 7 The seventh flowchart illustrates a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptography provided for embodiments of this application. Figure 8 This is the eighth flowchart illustrating a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards, provided for an embodiment of this application. Figure 9 A schematic diagram of a functional module for SIP authentication based on a hybrid signature algorithm of post-quantum and Chinese cryptography provided in this application embodiment; Figure 10 A schematic diagram of another SIP authentication functional module based on a hybrid signature algorithm of post-quantum and national cryptographic standards provided in this application embodiment. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.

[0018] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0019] In the description of this application, it should be noted that if the terms "upper", "lower", etc. appear to indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship that the product of this application is usually placed in, it is only for the convenience of describing this application and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this application.

[0020] Furthermore, the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Additionally, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0021] It should be noted that, where there is no conflict, the features in the embodiments of this application can be combined with each other.

[0022] The Session Initiation Protocol (SIP) is an application-layer control protocol used to establish, modify, and terminate multimedia sessions, which can be IP telephony, multimedia sessions, or multimedia conferencing. SIP is a core protocol of the IETF Multimedia Data and Control Architecture. Its primary purpose is to resolve signaling control issues in IP networks and communication with softswitch platforms, thereby forming a next-generation value-added service platform to provide better value-added services to industries such as telecommunications, banking, and finance.

[0023] Post-quantum cryptography (PQC) is a new type of encryption algorithm that can resist attacks from quantum computers. These algorithms can not only run securely on traditional computers, but also resist attacks from future quantum computers.

[0024] To make the SIP authentication process resistant to quantum attacks, this application provides a SIP authentication method based on a hybrid signature algorithm of post-quantum and Chinese cryptographic algorithms. The post-quantum algorithm is incorporated into the Chinese cryptographic algorithm, which improves the SIP authentication protocol and makes the SIP authentication process more secure.

[0025] The SIP authentication method based on a hybrid post-quantum and Chinese cryptographic signature algorithm provided in this application is explained in detail below with reference to the accompanying drawings and specific examples. It is applied to SIP clients. Figure 1 One of the flowcharts for a SIP authentication method based on a hybrid signature algorithm of post-quantum and Chinese cryptography provided in this application is illustrated below; Figure 1 As shown, the method includes: S101. Send the first registration message to the SIP server.

[0026] In this embodiment, the first registration message includes: target authentication control parameters. The first registration message is used to enable the SIP server to generate a first response message corresponding to the SIP server based on the target authentication control parameters.

[0027] Among them, the SIP client can be a terminal that uses the SIP protocol, such as an IP phone, security camera, or real-time communication client, while the SIP server can be a server that provides SIP protocol services, such as a SIP proxy server, video security management platform, or real-time communication server.

[0028] In the SIP authentication process between the SIP client and the SIP server, the SIP client sends a first registration message REGISTER to the SIP server. The Authentication header field of the first registration message carries the target authentication control parameters, so that the SIP server can generate the corresponding first response message based on the target authentication control parameters.

[0029] S102. Receive the first reply message sent by the SIP server.

[0030] S103. Based on the first reply message, obtain the first hybrid signature certificate of the SIP client, generate the first random number corresponding to the SIP client, and use the national cryptographic signature algorithm and the post-quantum signature algorithm to perform hybrid signature on the first random number to generate the first signature value.

[0031] Specifically, after generating the first reply message, the SIP server sends the first reply message to the SIP client so that the SIP client can receive the first reply message sent by the SIP server.

[0032] Obtain the first hybrid signature certificate cert1 from the SIP client. This certificate records the certificate issuer information, certificate subject, certificate validity period, certificate signing algorithm, hybrid signature public key, and certificate signature value. The certificate signing algorithm includes a Chinese national cryptographic signature algorithm and a post-quantum signature algorithm. The Chinese national cryptographic signature algorithm can be an asymmetric encryption algorithm (SM2) based on elliptic curve cryptography (ECC), used in digital signatures, key exchange, and public key encryption. The post-quantum signature algorithm can be the lattice-based post-quantum cryptography algorithm Dilithium, designed to resist future quantum computer attacks and used for data signing. Therefore, the hybrid signature public key includes the Chinese national cryptographic signature public key (SM2 public key) and the post-quantum signature public key (Dilithium public key).

[0033] The SIP client also generates a first random number random1 corresponding to the client, and uses the national cryptographic signature algorithm and the post-quantum signature algorithm to perform a mixed signature on the first random number random1 to generate the first signature value sign1.

[0034] S104. Send the second registration message to the SIP server.

[0035] The second registration message includes a first random number, a first signature value, and a first hybrid signature certificate. The second registration message is used to enable the SIP server to verify the first hybrid signature certificate using the pre-stored root certificate of the SIP client, and to verify the first signature value based on the hybrid signature public key of the SIP client.

[0036] S105. Receive the second reply information sent by the SIP server. The second reply information is used to indicate whether the SIP client has successfully verified the data.

[0037] Specifically, the root certificate rootCert1 of the SIP client is pre-imported during the SIP server configuration, and the root certificate rootCert2 of the SIP server is pre-imported during the SIP client configuration. This allows the SIP server, upon receiving the second registration message, to verify the first hybrid signature certificate cert1 using the pre-stored root certificate rootCert1 of the SIP client, and to verify the first signature value sign1 based on the hybrid signature public key of the SIP client.

[0038] Specifically, the root certificate rootCert1 of the pre-stored SIP client is used to verify the first hybrid signature certificate cert1, obtaining the hybrid signature public key of the SIP client. Since the first signature value sign1 includes a first national cryptographic signature component and a first post-quantum signature component, the first national cryptographic signature component is verified based on the first national cryptographic signature public key in the hybrid signature public key of the SIP client, obtaining the first national cryptographic verification result. The first post-quantum signature component is verified based on the post-quantum signature public key in the hybrid signature public key of the SIP client, obtaining the first post-quantum verification result. This result is then compared with the first random number random1 to obtain the verification result of the SIP client. If both the first national cryptographic verification result and the first post-quantum verification result indicate that they are consistent with the first random number random1, the verification result of the SIP client is successful. If both the first national cryptographic verification result and / or the first post-quantum verification result indicate that they are inconsistent with the first random number random1, the verification result of the SIP client is unsuccessful.

[0039] The second response message includes the verification result from the SIP client, and the success or failure of SIP authentication is determined based on the second response message.

[0040] In summary, this application provides a SIP authentication method based on a hybrid signature algorithm combining post-quantum and Chinese cryptographic algorithms, applied to a SIP client. The method includes: sending a first registration message to a SIP server, the first registration message including target authentication control parameters, the first registration message causing the SIP server to generate a first response message corresponding to the SIP server based on the target authentication control parameters; receiving the first response message sent by the SIP server; obtaining a first hybrid signature certificate of the SIP client, generating a first random number corresponding to the SIP client based on the first response message, and performing a hybrid signature on the first random number using a Chinese cryptographic signature algorithm and a post-quantum signature algorithm to generate a first signature value; sending a second registration message to the SIP server, the second registration message including the first random number, the first signature value, and the first hybrid signature certificate, the second registration message causing the SIP server to verify the first hybrid signature certificate using a pre-stored root certificate of the SIP client, and verifying the first signature value based on the hybrid signature public key of the SIP client; and receiving a second response message sent by the SIP server, the second response message indicating whether the SIP client has successfully verified the signature. The method in this application incorporates a post-quantum algorithm into the SIP authentication process, making SIP authentication resistant to quantum attacks and thus more secure.

[0041] This application also provides another possible implementation of a SIP authentication method based on a hybrid signature algorithm of post-quantum and Chinese cryptographic algorithms. The target authentication control parameter is a two-way authentication control parameter, which includes a post-quantum algorithm identifier. A first registration message is used to enable the SIP server to obtain a second hybrid signature certificate from the SIP server when it determines that the target authentication control parameter is a two-way authentication control parameter. The SIP server then generates a second random number corresponding to the second random number and uses both the Chinese cryptographic signature algorithm and the post-quantum signature algorithm to perform a hybrid signature on the second random number to generate a second signature value. A first response message includes the second random number, the second signature value, and the second hybrid signature certificate. Figure 2 This is the second flowchart illustrating a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards, provided as an embodiment of this application. Figure 2 As shown, after receiving the first reply message sent by the SIP server, the method further includes: S201. Verify the second hybrid signature certificate using the pre-stored root certificate of the SIP server.

[0042] S202. Verify the second signature value based on the hybrid signature public key of the SIP server to obtain the verification result of the SIP server. The verification result of the SIP server is used to indicate whether the SIP server has successfully verified the signature.

[0043] In this embodiment, based on the security level of the SIP client, it is determined that the SIP client requires two-way authentication, indicating that the SIP client needs to authenticate the SIP server, and the SIP server also needs to authenticate the SIP client. The target authentication control parameter is the two-way authentication control parameter, which includes a post-quantum algorithm identifier. Therefore, the value of the Authentication header field in the first registration message is Mutual-authentication, which carries an alg field. The alg field marks the post-quantum algorithm identifier used for authentication. The sending format of the first registration message is: Authentication: Mutual-authentication alg="PQC".

[0044] When the SIP server receives the first registration message and determines that the target authentication control parameter is the two-way authentication control parameter, it obtains the second hybrid signature certificate cert2 of the SIP server, generates the second random number random2 corresponding to the SIP server, and uses the national cryptographic signature algorithm and the post-quantum signature algorithm to perform hybrid signature on the second random number random2 to generate the second signature value sign2.

[0045] The SIP server sends a first reply message to the SIP client. This first reply message includes: a second random number (random2), a second signature value (sign2), and a second hybrid signature certificate (cert2). The format of the first reply message is: WWW-Authentication: Mutual-authenticationalg="PQC" random2="second random number" sign2="second signature value" cert2="second hybrid signature certificate". Upon receiving the first reply message, the SIP client needs to verify the SIP server.

[0046] Optionally, based on the second post-quantum signature public key and the second national cryptographic signature public key in the hybrid signature public key of the SIP server, the second national cryptographic signature component and the second post-quantum signature component in the second signature value are verified respectively to obtain the verification result of the SIP server.

[0047] Specifically, since the SIP client pre-stores the root certificate rootCert2 of the SIP server, it uses rootCert2 to verify the second hybrid signature certificate cert2, obtaining the hybrid signature public key of the SIP server. Since the second signature value sign2 includes a second national cryptographic signature component and a second post-quantum signature component, the second national cryptographic signature component is verified using the second national cryptographic signature public key in the hybrid signature public key of the SIP server, obtaining the second national cryptographic verification result. The second post-quantum signature component is verified using the second post-quantum signature public key in the hybrid signature public key of the SIP server, obtaining the second post-quantum verification result. This result is then compared with the second random number random2 to obtain the verification result of the SIP server. If both the second national cryptographic verification result and the second post-quantum verification result indicate consistency with the second random number random2, the verification result of the SIP server is successful. If both the second national cryptographic verification result and / or the second post-quantum verification result indicate inconsistency with the second random number random2, the verification result of the SIP server is unsuccessful.

[0048] In the method provided in this application embodiment, when the target authentication control parameter is a two-way authentication control parameter, the two-way authentication control parameter includes a post-quantum algorithm identifier. Since the SIP client needs to verify the SIP server, when the SIP server determines that the target authentication control parameter is a two-way authentication control parameter, it obtains the second hybrid signature certificate of the SIP server, generates a second random number corresponding to the SIP server, and uses the national cryptographic signature algorithm and the post-quantum signature algorithm to perform a hybrid signature on the second random number to generate a second signature value. The generated first reply message includes: the second random number, the second signature value, and the second hybrid signature certificate, so that the SIP client needs to authenticate the SIP server. The second hybrid signature certificate is verified using the pre-stored root certificate of the SIP server. The second signature value is verified according to the hybrid signature public key of the SIP server to obtain the verification result of the SIP server. The verification result of the SIP server is used to indicate whether the SIP server has successfully verified. Only when the SIP server has successfully verified, the SIP client obtains the first hybrid signature certificate of the SIP client, generates the first random number corresponding to the SIP client, and generates the first signature value. Since the second signature value of the first reply message is obtained by signing with a hybrid signature algorithm, the security of the first reply message transmission process is guaranteed. The SIP client can only verify the second signature value by using the hybrid signature public key of the SIP server, which also ensures the security of the entire SIP authentication process.

[0049] This application also provides another possible implementation of a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards. Figure 3This is the third flowchart illustrating a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards, provided as an embodiment of this application; Figure 3 As shown, the first signature value is generated by mixing the first random number with the national cryptographic signature algorithm and the post-quantum signature algorithm, including: S301. Obtain the hybrid signature private key from the SIP client.

[0050] The hybrid signature private key for the SIP client includes: the first national cryptographic signature private key and the first post-quantum signature private key.

[0051] S302. Based on the first national cryptographic signature private key and the first post-quantum signature private key, the first random number is signed using the national cryptographic signature algorithm and the post-quantum signature algorithm respectively, generating the first national cryptographic signature component and the first post-quantum signature component.

[0052] The first signature value includes: the first national cryptographic signature component and the first post-quantum signature component.

[0053] In this embodiment, the first random number is signed using the first national cryptographic signature private key to obtain the first national cryptographic signature component, and the first random number is signed using the first post-quantum signature private key to obtain the first post-quantum signature component. The first signature result consists of the first national cryptographic signature component and the first post-quantum signature component.

[0054] Therefore, it can be understood that when the SIP server verifies the SIP client, it needs to obtain the first national cryptographic signature public key and the first post-quantum signature public key, and verify the first national cryptographic signature component and the first post-quantum signature component respectively to obtain the verification results of the two signature components. Only when the verification results of the two signature components are both successful can the SIP server's verification of the SIP client be considered successful.

[0055] It should be noted that the second registration message at this time includes: the first random number random1, the first signature value sign1, and the first hybrid signature certificate cert1. The sending format of the second registration message is: Authentication: Mutual-authenticationalg="PQC" random1="first random number" sign1="first signature value" cert1="first hybrid signature certificate".

[0056] In the method provided in this application embodiment, a hybrid signature private key of the SIP client is obtained. The hybrid signature private key of the SIP client includes a first national cryptographic signature private key and a first post-quantum signature private key. Based on the first national cryptographic signature private key and the first post-quantum signature private key, a first random number is signed using a national cryptographic signature algorithm and a post-quantum signature algorithm, respectively, to generate a first national cryptographic signature component and a first post-quantum signature component. The first signature value includes the first national cryptographic signature component and the first post-quantum signature component. The first random number is hybrid-signed using a hybrid signature algorithm, so that the SIP authentication process has quantum resistance characteristics.

[0057] This application also provides another possible implementation of a SIP authentication method based on a hybrid signature algorithm of post-quantum and Chinese cryptographic algorithms. The target authentication control parameter is a one-way authentication control parameter, which includes: a post-quantum algorithm identifier; the first registration message is used to enable the SIP server to generate a first reply message based on the post-quantum algorithm identifier when it determines that the target authentication control parameter is a one-way authentication control parameter.

[0058] In this embodiment, based on the security level of the SIP client, it is determined that the SIP client requires one-way authentication, indicating that the SIP client does not need to authenticate the SIP server, but only the SIP server needs to authenticate the SIP client. Therefore, the target authentication control parameter is the one-way authentication control parameter, which includes a post-quantum algorithm identifier. The value of the Authentication header field in the first registration message is One-way authentication, which carries an alg field. The alg field marks the post-quantum algorithm identifier used for authentication. In this case, the format of the first registration message is: Authentication: One-way authentication alg="PQC".

[0059] When the SIP server receives the first registration message and determines that the target authentication control parameter is a one-way authentication control parameter, it generates a first reply message based on the post-quantum algorithm identifier. The first reply message includes the one-way authentication control parameter, which includes the post-quantum algorithm identifier. At this time, the sending format of the first reply message is: WWW-Authentication:One-way-authenticationalg="PQC".

[0060] In the method provided in this application embodiment, the target authentication control parameter is a one-way authentication control parameter, which includes a post-quantum algorithm identifier. The first registration message is used to enable the SIP server to generate a first reply message based on the post-quantum algorithm identifier when it determines that the target authentication control parameter is a one-way authentication control parameter. At this time, the SIP client does not need to verify the SIP server, so the first reply message does not include information such as the SIP server's random number and signature value.

[0061] This application also provides another possible implementation of a SIP authentication method based on a hybrid post-quantum and Chinese cryptographic signature algorithm. Since SIP authentication is an authentication process between the SIP client and the SIP server, the hybrid post-quantum and Chinese cryptographic dual-certificate IKE key negotiation method provided in this application is also applied to the SIP server. Figure 4 This is the fourth flowchart illustrating a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards, provided as an embodiment of this application; Figure 4 As shown, the method includes: S401, Receive the first registration message sent by the SIP client.

[0062] The first registration message includes: target authentication control parameters.

[0063] S402. Generate the first response message corresponding to the SIP server based on the target authentication control parameters.

[0064] In this embodiment, during the SIP authentication process between the SIP client and the SIP server, the SIP client sends a first registration message REGISTER to the SIP server. The Authentication header field of the first registration message carries target authentication control parameters, which are used to enable the SIP server to generate a first response message corresponding to the SIP server based on the target authentication control parameters.

[0065] S403. Send a first reply message to the SIP client. The first reply message enables the SIP client to obtain the first hybrid signature certificate of the SIP client, generate the first random number corresponding to the SIP client, and use the national cryptographic signature algorithm and the post-quantum signature algorithm to perform hybrid signature on the first random number to generate the first signature value.

[0066] Specifically, after generating the first reply message, the SIP server sends the first reply message to the SIP client so that the SIP client can receive the first reply message sent by the SIP server.

[0067] This allows the SIP client to obtain the first hybrid signature certificate cert1. The first hybrid signature certificate records the certificate issuer information, certificate subject, certificate validity period, certificate signing algorithm, hybrid signature public key, and certificate signature value. The certificate signing algorithm includes a Chinese national cryptographic signature algorithm and a post-quantum signature algorithm. The Chinese national cryptographic signature algorithm can be an asymmetric encryption algorithm (SM2) based on elliptic curve cryptography (ECC), applied in fields such as digital signatures, key exchange, and public key encryption. The post-quantum signature algorithm can be the lattice-based post-quantum cryptography algorithm Dilithium, designed to resist future quantum computer attacks and used for data signing. Therefore, the hybrid signature public key includes: the Chinese national cryptographic signature public key (i.e., the SM2 public key) and the post-quantum signature public key (i.e., the Dilithium public key).

[0068] The SIP client also generates a first random number random1 corresponding to the client, and uses the national cryptographic signature algorithm and the post-quantum signature algorithm to perform a mixed signature on the first random number random1 to generate the first signature value sign1.

[0069] S404. Receive a second registration message sent by the SIP client. The second registration message includes: a first random number, a first signature value, and a first hybrid signature certificate.

[0070] S405. Using the pre-stored root certificate of the SIP client, verify the first hybrid signature certificate, and verify the first signature value according to the hybrid signature public key of the SIP client.

[0071] S406. Send a second reply message to the SIP client. The second reply message is used to indicate to the SIP client whether the verification was successful.

[0072] Specifically, the root certificate rootCert1 of the SIP client is pre-imported during the SIP server configuration, and the root certificate rootCert2 of the SIP server is pre-imported during the SIP client configuration. This allows the SIP server, upon receiving the second registration message, to verify the first hybrid signature certificate cert1 using the pre-stored root certificate rootCert1 of the SIP client, and to verify the first signature value sign1 and the first random number random1 based on the hybrid signature public key of the SIP client.

[0073] Optionally, the first hybrid signature certificate is verified using the pre-stored root certificate of the SIP client; the first signature value is verified using the hybrid signature public key of the SIP client to obtain the verification result of the SIP client. The verification result of the SIP client is used to indicate whether the SIP client has successfully verified the signature, and the second reply message includes the verification result of the SIP client.

[0074] Specifically, the root certificate rootCert1 of the pre-stored SIP client is used to verify the first hybrid signature certificate cert1, obtaining the hybrid signature public key of the SIP client. Since the first signature value sign1 includes a first national cryptographic signature component and a first post-quantum signature component, the first national cryptographic signature component is verified based on the first national cryptographic signature public key in the hybrid signature public key of the SIP client, obtaining the first national cryptographic verification result. The first post-quantum signature component is verified based on the post-quantum signature public key in the hybrid signature public key of the SIP client, obtaining the first post-quantum verification result. This result is then compared with the first random number random1 to obtain the verification result of the SIP client. If both the first national cryptographic verification result and the first post-quantum verification result indicate that they are consistent with the first random number random1, the verification result of the SIP client is successful. If both the first national cryptographic verification result and / or the first post-quantum verification result indicate that they are inconsistent with the first random number random1, the verification result of the SIP client is unsuccessful.

[0075] The second response message includes the verification result from the SIP client, and the success or failure of SIP authentication is determined based on the second response message.

[0076] In summary, this application provides a SIP authentication method based on a hybrid signature algorithm combining post-quantum and Chinese cryptographic algorithms, applied to a SIP server. The method includes: receiving a first registration message sent by a SIP client, the first registration message including target authentication control parameters; generating a first response message corresponding to the SIP server based on the target authentication control parameters; sending the first response message to the SIP client, the first response message enabling the SIP client to obtain a first hybrid signature certificate, generate a first random number corresponding to the SIP client, and perform a hybrid signature on the first random number using both Chinese cryptographic and post-quantum signature algorithms to generate a first signature value; receiving a second registration message sent by the SIP client, the second registration message including a first random number, a first signature value, and a first hybrid signature certificate; verifying the first hybrid signature certificate using a pre-stored root certificate of the SIP client, and verifying the first signature value based on the hybrid signature public key of the SIP client; and sending a second response message to the SIP client, the second response message indicating whether the verification was successful. The method in this application incorporates a post-quantum algorithm into the SIP authentication process, making SIP authentication resistant to quantum attacks and thus more secure.

[0077] This application also provides another possible implementation of a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards. The target authentication control parameter is a two-way authentication control parameter, which includes: a post-quantum algorithm identifier. A first response message corresponding to the SIP server is generated based on the target authentication control parameter, including: Obtain the second hybrid signature certificate from the SIP server, generate the second random number corresponding to the SIP server, and use the national cryptographic signature algorithm and the post-quantum signature algorithm to perform a hybrid signature on the second random number to generate a second signature value. The first reply message includes: the second random number, the second signature value, and the second hybrid signature certificate.

[0078] In this embodiment, based on the security level of the SIP client, it is determined that the SIP client requires two-way authentication, indicating that the SIP client needs to verify the SIP server, and the SIP server also needs to verify the SIP client. The SIP server then obtains its second hybrid signature certificate, cert2. This second hybrid signature certificate records the certificate issuer information, certificate subject, certificate validity period, certificate signing algorithm, hybrid signature public key, and certificate signature value. The certificate signing algorithm includes a Chinese national cryptographic signature algorithm and a post-quantum signature algorithm. The Chinese national cryptographic signature algorithm can be an asymmetric encryption algorithm (SM2) based on elliptic curve cryptography (ECC), applied in fields such as digital signatures, key exchange, and public key encryption. The post-quantum signature algorithm can be the lattice-based post-quantum cryptography algorithm Dilithium, designed to resist future quantum computer attacks and used for data signing. Therefore, the hybrid signature public key includes the Chinese national cryptographic signature public key (SM2 public key) and the post-quantum signature public key (Dilithium public key).

[0079] The SIP server also generates a second random number random2 corresponding to the SIP server, and uses the national cryptographic signature algorithm and the post-quantum signature algorithm to perform a mixed signature on the second random number random2 to generate a second signature value sign2.

[0080] In the method provided in this application embodiment, a second random number corresponding to the SIP server is generated by obtaining the second hybrid signature certificate of the SIP server, and a second signature value is generated by hybrid signing the second random number using a national cryptographic signature algorithm and a post-quantum signature algorithm. The first reply message includes: the second random number, the second signature value, and the second hybrid signature certificate. This enables the SIP client to verify the SIP server based on the first reply message.

[0081] This application also provides another possible implementation of a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards. Figure 5This is the fifth flowchart illustrating a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards, provided as an embodiment of this application. Figure 5 As shown, the second signature value is generated by mixing the national cryptographic signature algorithm and the post-quantum signature algorithm to sign the second random number, including: S501. Obtain the hybrid signature private key from the SIP server.

[0082] The hybrid signature private key of the SIP server includes: the second national cryptographic signature private key and the second post-quantum signature private key.

[0083] S502. Based on the second national cryptographic signature private key and the second post-quantum signature private key, the second random number is signed using the national cryptographic signature algorithm and the post-quantum signature algorithm respectively, generating the second national cryptographic signature component and the second post-quantum signature component. The second signature value includes: the second national cryptographic signature component and the second post-quantum signature component.

[0084] In this embodiment, the second random number is signed using the second national cryptographic signature private key to obtain the second national cryptographic signature component, and the second random number is signed using the second post-quantum signature private key to obtain the second post-quantum signature component. The second signature result is composed of the second national cryptographic signature component and the second post-quantum signature component.

[0085] Therefore, it can be understood that when a SIP client verifies a SIP server, it needs to obtain the second national cryptographic signature public key and the second post-quantum signature public key, and verify the second national cryptographic signature component and the second post-quantum signature component respectively to obtain the verification results of the two signature components. Only when the verification results of the two signature components are both successful can the SIP client's verification of the SIP server be considered successful.

[0086] In the method provided in this application embodiment, a hybrid signature private key of the SIP server is obtained. The hybrid signature private key of the SIP server includes a second national cryptographic signature private key and a second post-quantum signature private key. Based on the second national cryptographic signature private key and the second post-quantum signature private key, a second random number is signed using a national cryptographic signature algorithm and a post-quantum signature algorithm, respectively, to generate a second national cryptographic signature component and a second post-quantum signature component. The second signature value includes the second national cryptographic signature component and the second post-quantum signature component. By performing a hybrid signature on the second random number using a hybrid signature algorithm, the SIP authentication process acquires quantum resistance.

[0087] This application also provides another possible implementation of a SIP authentication method based on a hybrid signature algorithm of post-quantum and Chinese cryptographic algorithms. The target authentication control parameter is a one-way authentication control parameter, which includes a post-quantum algorithm identifier. When the target authentication control parameter is determined to be a one-way authentication control parameter, a first response message is generated based on the post-quantum algorithm identifier.

[0088] In this embodiment, based on the security level of the SIP client, it is determined that the SIP client requires one-way authentication, indicating that the SIP client does not need to authenticate the SIP server, but only the SIP server needs to authenticate the SIP client. Therefore, the target authentication control parameter is the one-way authentication control parameter, which includes a post-quantum algorithm identifier. The value of the Authentication header field in the first registration message is One-way authentication, which carries an alg field. The alg field marks the post-quantum algorithm identifier used for authentication. In this case, the format of the first registration message is: Authentication: One-way authentication alg="PQC".

[0089] When the SIP server receives the first registration message and determines that the target authentication control parameter is a one-way authentication control parameter, it generates a first reply message based on the post-quantum algorithm identifier. The first reply message includes the one-way authentication control parameter, which includes the post-quantum algorithm identifier. At this time, the sending format of the first reply message is: WWW-Authentication:One-way-authenticationalg="PQC".

[0090] In the method provided in this application embodiment, the target authentication control parameter is a one-way authentication control parameter, which includes a post-quantum algorithm identifier. The first registration message is used to enable the SIP server to generate a first reply message based on the post-quantum algorithm identifier when it determines that the target authentication control parameter is a one-way authentication control parameter. At this time, the SIP client does not need to verify the SIP server, so the first reply message does not include information such as the SIP server's random number and signature value.

[0091] This application also provides another possible implementation of a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards. Figure 6 A flowchart illustrating a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards, provided for embodiments of this application, is shown in Figure 6. Figure 6 As shown, the first hybrid signature certificate is verified using the pre-stored root certificate of the SIP client, and the first signature value is verified based on the hybrid signature public key of the SIP client, including: S601. Verify the first hybrid signature certificate using the pre-stored root certificate of the SIP client.

[0092] S602. Verify the first signature value based on the hybrid signature public key of the SIP client to obtain the verification result of the SIP client. The verification result of the SIP client is used to indicate whether the SIP client has successfully verified the signature. The second reply message includes the verification result of the SIP client.

[0093] In this embodiment, since the SIP server pre-stores the root certificate rootCert1 of the SIP client, the root certificate rootCert1 of the SIP client is used to verify the first hybrid signature certificate cert1 to obtain the hybrid signature public key of the SIP client. Since the first signature value sign1 includes a first national cryptographic signature component and a first post-quantum signature component, the first national cryptographic signature component is verified according to the first national cryptographic signature public key in the hybrid signature public key of the SIP client to obtain the first national cryptographic verification result. The first post-quantum signature component is verified according to the first post-quantum signature public key in the hybrid signature public key of the SIP client to obtain the first post-quantum verification result. This result is then compared with the first random number random1 to obtain the verification result of the SIP client. If both the first national cryptographic verification result and the first post-quantum verification result indicate that they are consistent with the first random number random1, the verification result of the SIP client is successful. If both the first national cryptographic verification result and / or the first post-quantum verification result indicate that they are inconsistent with the first random number random1, the verification result of the SIP client is unsuccessful.

[0094] In the method provided in this application embodiment, a pre-stored root certificate of the SIP client is used to verify the first hybrid signature certificate; the first signature value is verified according to the hybrid signature public key of the SIP client to obtain the verification result of the SIP client. The verification result of the SIP client is used to indicate whether the SIP client verification was successful, and the second reply message includes the verification result of the SIP client. Since the first signature value is obtained by signing with a hybrid signature algorithm, the SIP server can only verify the first signature value using the hybrid signature public key of the SIP client, thus ensuring the security of the entire SIP authentication process.

[0095] This application also explains the process of the method for hybrid dual-certificate IKE key negotiation using post-quantum and national cryptographic standards through two complete examples. Figure 7 This is the seventh flowchart illustrating a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards, as provided in this application. Figure 7 As shown, in the case of two-way authentication, the method includes: S701: The SIP client sends a first registration message to the SIP server. The first registration message includes: target authentication control parameters, which are two-way authentication control parameters, including: post-quantum algorithm identifier.

[0096] S702. Based on the first registration information, the SIP server obtains the second hybrid signature certificate of the SIP server, generates the second random number corresponding to the SIP server, and uses the national cryptographic signature algorithm and the post-quantum signature algorithm to perform hybrid signature on the second random number to generate the second signature value.

[0097] S703, the SIP server sends a first reply message to the SIP client. The first reply message includes: a second random number, a second signature value, and a second hybrid signature certificate.

[0098] S704. Based on the first reply message, the SIP client uses the pre-stored root certificate of the SIP server to verify the second hybrid signature certificate; it then verifies the second signature value based on the hybrid signature public key of the SIP server to obtain the verification result of the SIP server. The verification result of the SIP server is used to indicate whether the SIP server has successfully verified the certificate.

[0099] S705: The SIP client obtains the first hybrid signature certificate of the SIP client, generates the first random number corresponding to the SIP client, and uses the national cryptographic signature algorithm and the post-quantum signature algorithm to perform hybrid signature on the first random number to generate the first signature value.

[0100] S706, the SIP client sends a second registration message to the SIP server. The second registration message includes: a first random number, a first signature value, and a first hybrid signature certificate.

[0101] S707: The SIP server uses the pre-stored root certificate of the SIP client to verify the first hybrid signature certificate, and verifies the first signature value based on the hybrid signature public key of the SIP client.

[0102] S708: The SIP server sends a second response message to the SIP client, which indicates whether the SIP client has successfully verified the message.

[0103] In this embodiment, the specific contents of steps S701-S708 are described in detail in steps S101-S602 above, and will not be repeated here.

[0104] Figure 8 This is the eighth flowchart illustrating a SIP authentication method based on a hybrid signature algorithm of post-quantum and national cryptographic standards, as provided in this application. Figure 8 As shown, in the case of one-way authentication, the method includes: S801: The SIP client sends a first registration message to the SIP server. The first registration message includes: target authentication control parameters, which are one-way authentication control parameters, including: post-quantum algorithm identifier.

[0105] The S802 and SIP servers generate the first response message based on the target authentication control parameters.

[0106] S803, the SIP server sends the first reply message to the SIP client.

[0107] S804: Based on the first reply message, the SIP client obtains the first hybrid signature certificate of the SIP client, generates the first random number corresponding to the SIP client, and uses the national cryptographic signature algorithm and the post-quantum signature algorithm to perform hybrid signature on the first random number to generate the first signature value.

[0108] The S805 and SIP clients send a second registration message to the SIP server. The second registration message includes: a first random number, a first signature value, and a first hybrid signature certificate.

[0109] S806: The SIP server uses the pre-stored root certificate of the SIP client to verify the first hybrid signature certificate, and verifies the first signature value based on the hybrid signature public key of the SIP client.

[0110] S807. The SIP server sends a second response message to the SIP client, which indicates whether the SIP client has successfully verified the message.

[0111] In this embodiment, the specific contents of steps S801-S807 are described in detail in steps S101-S602 above, and will not be repeated here.

[0112] The following continues to explain the SIP authentication device based on the hybrid signature algorithm of post-quantum and national cryptography provided in any of the above embodiments of this application. Its specific implementation process and the resulting technical effects are the same as those in the corresponding method embodiments. For the sake of brevity, the parts not mentioned in this embodiment can be referred to the corresponding content in the method embodiment.

[0113] Figure 9 This diagram illustrates a functional module for SIP authentication based on a hybrid signature algorithm combining post-quantum and Chinese cryptographic methods, as provided in an embodiment of this application. It is applied to SIP clients, such as... Figure 9 As shown, the SIP authentication device 100 based on a hybrid signature algorithm of post-quantum and national cryptography includes: The first sending module 110 is used to send a first registration message to the SIP server. The first registration message includes: target authentication control parameters. The first registration message is used to enable the SIP server to generate a corresponding first reply message based on the target authentication control parameters. The first receiving module 120 is used to receive the first reply message sent by the SIP server; The first generation module 130 is used to obtain the first hybrid signature certificate of the SIP client according to the first reply message, generate the first random number corresponding to the SIP client, and use the national cryptographic signature algorithm and the post-quantum signature algorithm to perform hybrid signature on the first random number to generate the first signature value. The first sending module 110 is used to send a second registration message to the SIP server. The second registration message includes a first random number, a first signature value, and a first hybrid signature certificate. The second registration message is used to enable the SIP server to verify the first hybrid signature certificate using a pre-stored root certificate of the SIP client, and to verify the first signature value according to the hybrid signature public key of the SIP client. The first receiving module 120 is used to receive the second reply information sent by the SIP server. The second reply information is used to indicate whether the SIP client has successfully verified the message.

[0114] Optionally, the target authentication control parameter is a two-way authentication control parameter, which includes: a post-quantum algorithm identifier. The first registration message is used to enable the SIP server to obtain the second hybrid signature certificate of the SIP server when it determines that the target authentication control parameter is a two-way authentication control parameter, generate a second random number corresponding to the SIP server, and use the national cryptographic signature algorithm and the post-quantum signature algorithm to perform a hybrid signature on the second random number to generate a second signature value; the first reply message includes: the second random number, the second signature value, and the second hybrid signature certificate. The device further includes: a first verification module, used to verify the second hybrid signature certificate using a pre-stored root certificate of the SIP server; and to verify the second signature value according to the hybrid signature public key of the SIP server to obtain the verification result of the SIP server, the verification result of the SIP server being used to indicate whether the SIP server has successfully verified the certificate.

[0115] Optionally, the first verification module is further configured to verify the second national cryptographic signature component and the second post-quantum signature component in the second signature value based on the second post-quantum signature public key and the second national cryptographic signature public key in the hybrid signature public key of the SIP server, respectively, to obtain the verification result of the SIP server.

[0116] Optionally, the first generation module 130 is used to obtain the hybrid signature private key of the SIP client, which includes a first national cryptographic signature private key and a first post-quantum signature private key; based on the first national cryptographic signature private key and the first post-quantum signature private key, the first random number is signed using the national cryptographic signature algorithm and the post-quantum signature algorithm respectively, generating a first national cryptographic signature component and a first post-quantum signature component, and the first signature value includes the first national cryptographic signature component and the first post-quantum signature component.

[0117] Optionally, the target authentication control parameter is a one-way authentication control parameter, which includes: a post-quantum algorithm identifier; the first registration message is used to enable the SIP server to generate a first reply message based on the post-quantum algorithm identifier when it determines that the target authentication control parameter is a one-way authentication control parameter.

[0118] Figure 10 This diagram illustrates another functional module for SIP authentication based on a hybrid signature algorithm combining post-quantum and Chinese cryptographic standards, provided as an embodiment of this application. It is applied to SIP clients, such as… Figure 10 As shown, the SIP authentication device 200 based on a hybrid signature algorithm of post-quantum and national cryptography includes: The second receiving module 210 is used to receive a first registration message sent by the SIP client. The first registration message includes: target authentication control parameters. The second generation module 220 is used to generate the first response message corresponding to the SIP server based on the target authentication control parameters; The second sending module 230 is used to send a first reply message to the SIP client. The first reply message enables the SIP client to obtain the first hybrid signature certificate of the SIP client, generate the first random number corresponding to the SIP client, and use the national cryptographic signature algorithm and the post-quantum signature algorithm to perform hybrid signature on the first random number to generate a first signature value. The second receiving module 210 is used to receive a second registration message sent by the SIP client. The second registration message includes: a first random number, a first signature value, and a first hybrid signature certificate. The second verification module 240 is used to verify the first hybrid signature certificate using the pre-stored root certificate of the SIP client, and to verify the first signature value according to the hybrid signature public key of the SIP client. The second sending module 230 is used to send a second reply message to the SIP client, which indicates whether the SIP client has successfully verified the message.

[0119] Optionally, the target authentication control parameter is a two-way authentication control parameter, which includes: a post-quantum algorithm identifier. The second generation module 220 is also used to obtain the second hybrid signature certificate of the SIP server, generate the second random number corresponding to the SIP server, and use the national cryptographic signature algorithm and the post-quantum signature algorithm to perform a hybrid signature on the second random number to generate a second signature value. The first reply message includes: the second random number, the second signature value, and the second hybrid signature certificate.

[0120] Optionally, the second generation module 220 is further configured to obtain the hybrid signature private key of the SIP server, the hybrid signature private key of the SIP server including: a second national cryptographic signature private key and a second post-quantum signature private key; and to sign the second random number using the national cryptographic signature algorithm and the post-quantum signature algorithm respectively based on the second national cryptographic signature private key and the second post-quantum signature private key, thereby generating a second national cryptographic signature component and a second post-quantum signature component, the second signature value including: the second national cryptographic signature component and the second post-quantum signature component.

[0121] Optionally, the target authentication control parameter is a one-way authentication control parameter, which includes a post-quantum algorithm identifier. When the target authentication control parameter is determined to be a one-way authentication control parameter, a first response message is generated based on the post-quantum algorithm identifier.

[0122] Optionally, the second verification module 240 is further configured to verify the first hybrid signature certificate using a pre-stored root certificate of the SIP client; verify the first signature value according to the hybrid signature public key of the SIP client to obtain the verification result of the SIP client, the verification result of the SIP client being used to indicate whether the SIP client has successfully verified, and the second reply message including the verification result of the SIP client.

[0123] The above-described device is used to execute the method provided in the foregoing embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.

[0124] These modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more microprocessors, or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together as a system-on-a-chip (SOC).

[0125] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A SIP authentication method based on a hybrid signature algorithm of post-quantum and Chinese cryptography, characterized in that, Applied to SIP clients, the method includes: Send a first registration message to the SIP server. The first registration message includes: target authentication control parameters. The first registration message is used to enable the SIP server to generate a first response message corresponding to the SIP server based on the target authentication control parameters. Receive the first reply message sent by the SIP server; Based on the first reply message, obtain the first hybrid signature certificate of the SIP client, generate the first random number corresponding to the SIP client, and use the national cryptographic signature algorithm and the post-quantum signature algorithm to perform hybrid signature on the first random number to generate the first signature value; A second registration message is sent to the SIP server. The second registration message includes: the first random number, the first signature value, and the first hybrid signature certificate. The second registration message is used to enable the SIP server to verify the first hybrid signature certificate using the pre-stored root certificate of the SIP client, and to verify the first signature value according to the hybrid signature public key of the SIP client. The client receives a second response message from the SIP server, which indicates whether the SIP client has successfully verified the message.

2. The method according to claim 1, characterized in that, The target authentication control parameter is a two-way authentication control parameter, which includes a post-quantum algorithm identifier. The first registration message is used to enable the SIP server to obtain the second hybrid signature certificate of the SIP server when it determines that the target authentication control parameter is a two-way authentication control parameter, generate the second random number corresponding to the SIP server, and use the national cryptographic signature algorithm and the post-quantum signature algorithm to perform a hybrid signature on the second random number to generate a second signature value. The first response message includes: the second random number, the second signature value, and the second hybrid signature certificate; After receiving the first reply message sent by the SIP server, the method further includes: The second hybrid signature certificate is verified using the pre-stored root certificate of the SIP server. The second signature value is verified using the hybrid signature public key of the SIP server to obtain the verification result of the SIP server. The verification result of the SIP server is used to indicate whether the verification by the SIP server was successful.

3. The method according to claim 2, characterized in that, The step of verifying the second signature value based on the hybrid signature public key of the SIP server to obtain the verification result of the SIP server includes: Based on the second post-quantum signature public key and the second national cryptographic signature public key in the hybrid signature public key of the SIP server, the second national cryptographic signature component and the second post-quantum signature component in the second signature value are verified respectively to obtain the verification result of the SIP server.

4. The method according to claim 1, characterized in that, The step of generating a first signature value by mixing the first random number with the national cryptographic signature algorithm and the post-quantum signature algorithm includes: Obtain the hybrid signature private key of the SIP client, wherein the hybrid signature private key of the SIP client includes: a first national cryptographic signature private key and a first post-quantum signature private key; Based on the first national cryptographic signature private key and the first post-quantum signature private key, the first random number is signed using the national cryptographic signature algorithm and the post-quantum signature algorithm respectively, generating a first national cryptographic signature component and a first post-quantum signature component. The first signature value includes: the first national cryptographic signature component and the first post-quantum signature component.

5. The method according to claim 1, characterized in that, The target authentication control parameter is a one-way authentication control parameter, which includes: a post-quantum algorithm identifier; The first registration message is used to enable the SIP server to generate the first reply message based on the post-quantum algorithm identifier when it determines that the target authentication control parameter is a one-way authentication control parameter.

6. A SIP authentication method based on a hybrid signature algorithm of post-quantum and Chinese cryptography, characterized in that, Applied to SIP servers, the method includes: Receive a first registration message sent by a SIP client, the first registration message including: target authentication control parameters; Generate the first response message corresponding to the SIP server based on the target authentication control parameters; Send the first reply message to the SIP client. The first reply message is used to enable the SIP client to obtain the first hybrid signature certificate of the SIP client, generate the first random number corresponding to the SIP client, and perform hybrid signature on the first random number using the national cryptographic signature algorithm and the post-quantum signature algorithm to generate the first signature value. Receive a second registration message sent by the SIP client, the second registration message including: the first random number, the first signature value and the first hybrid signature certificate; The first hybrid signature certificate is verified using the pre-stored root certificate of the SIP client, and the first signature value is verified based on the hybrid signature public key of the SIP client. A second response message is sent to the SIP client, which indicates whether the SIP client has successfully verified the data.

7. The method according to claim 6, characterized in that, The target authentication control parameters are two-way authentication control parameters, which include: a post-quantum algorithm identifier. Generating the first response message corresponding to the SIP server based on the target authentication control parameters includes: Obtain the second hybrid signature certificate of the SIP server, generate the second random number corresponding to the SIP server, and use the national cryptographic signature algorithm and the post-quantum signature algorithm to perform a hybrid signature on the second random number to generate a second signature value. The first reply message includes: the second random number, the second signature value and the second hybrid signature certificate.

8. The method according to claim 7, characterized in that, The step of generating a second signature value by mixing the second random number with the national cryptographic signature algorithm and the post-quantum signature algorithm includes: Obtain the hybrid signature private key of the SIP server, which includes: a second national cryptographic signature private key and a second post-quantum signature private key; Based on the second national cryptographic signature private key and the second post-quantum signature private key, the second random number is signed using the national cryptographic signature algorithm and the post-quantum signature algorithm respectively, generating a second national cryptographic signature component and a second post-quantum signature component. The second signature value includes: the second national cryptographic signature component and the second post-quantum signature component.

9. The method according to claim 6, characterized in that, The target authentication control parameter is a one-way authentication control parameter, which includes a post-quantum algorithm identifier. When the target authentication control parameter is determined to be a one-way authentication control parameter, the first response message is generated based on the post-quantum algorithm identifier.

10. The method according to claim 6, characterized in that, The step of verifying the first hybrid signature certificate using the pre-stored root certificate of the SIP client and verifying the first signature value based on the hybrid signature public key of the SIP client includes: The first hybrid signature certificate is verified using the pre-stored root certificate of the SIP client; The first signature value is verified using the hybrid signature public key of the SIP client to obtain the verification result of the SIP client. The verification result of the SIP client is used to indicate whether the SIP client has successfully verified the signature. The second reply message includes the verification result of the SIP client.

Images