Quantum security identity authentication method and system for distributed intelligent agent

Abstract

The invention discloses a quantum security identity authentication method and system for a distributed intelligent agent, and relates to the technical field of information network security, a verification party is used for extracting a digital certificate of the distributed intelligent agent from an authentication request message after receiving the authentication request message, and verifying a first digital signature in the digital certificate, and verifying a second digital signature of the authentication request message by using a public key contained in the digital certificate, and if the second digital signature passes the verification, indicating that the authentication request message is sent by the distributed intelligent agent serving as the requester. And carrying out primary identity authentication confirmation on the distributed intelligent agent. The invention mainly solves the problem of how to provide an identity authentication method for a distributed intelligent agent. According to the method, the digital certificate with quantum security performance can be issued to the distributed intelligent agent, and the anti-attack capability and the long-term security of the system are remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information network security, in particular to a quantum secure identity authentication method and system for distributed intelligent agents. BACKGROUND

[0002] With the continuous development of computer technology, communication technology and Internet of Things technology, various types of distributed intelligent agents (such as unmanned aerial vehicles, intelligent terminals, video acquisition devices as described in the Chinese invention patent publication CN116389688A, Internet of Things sensors and Internet of Things execution units in industrial Internet of Things systems, etc.) are being widely popularized.

[0003] The massive distributed intelligent agents will have higher requirements for identity authentication of distributed intelligent agents in the process of mutual cooperation and mutual access to resources.

[0004] 1. The computing power of quantum computers can crack the authentication system provided by existing cryptographic algorithms in a short period of time. The RSA algorithm and the elliptic encryption algorithm (ECC) widely used by the traditional public key infrastructure (PKI) will face serious security threats after the popularization of quantum computers.

[0005] 2. Distributed intelligent agents are widely deployed and scattered, and will face complex network environments and unstable connections. Distributed intelligent agents may not be able to continuously communicate with authentication servers, or the communication link between distributed intelligent agents and authentication servers is extremely long. Traditional identity authentication schemes rely on authentication servers to check the certificate status of distributed intelligent agents online (such as the OCSP online certificate status protocol), which may result in the online checking of certificate status being unable to proceed due to network interruptions, thereby preventing distributed intelligent agents from completing identity authentication.

[0006] 3. In terms of revocation information distribution, under the framework of the public key infrastructure, distributed intelligent agents need to frequently download complete certificate revocation lists (CRLs) or frequently query certificate revocation lists. As the number of revoked certificates increases, the data volume of the certificate revocation list continues to increase, causing a burden on the computing resources and network resources of distributed intelligent agents.

[0007] 4、Distributed agents often have different roles, functions and permission requirements, so it is expected that the attribute information of the distributed agent can be carried in the identity authentication process of the distributed agent, so as to control the permission of the distributed agent. The traditional identity authentication scheme is to attach an extension field in the certificate or use attribute certificate to carry the attribute information of the distributed agent. After the identity authentication is completed, additional steps are needed to query the permission of the distributed agent, which increases the complexity and security risk of the system.

[0008] In summary, how to provide an efficient, easy, save computing resources and network resources and good security identity authentication method for distributed agents and systems composed of distributed agents has become one of the problems to be solved. SUMMARY

[0009] The purpose of the present application is to provide a quantum secure identity authentication method and system for distributed agents, which takes into account the characteristics of distributed agents and can provide an efficient, easy, save computing resources and network resources and good security identity authentication method and system for distributed agents.

[0010] To achieve the above purpose, the present application provides the following technical scheme: a quantum secure identity authentication method for distributed agents, comprising:

[0011] Registration stage: when registering, the distributed agent is connected with the authentication server, and the authentication server issues a digital certificate for the distributed agent, wherein the digital certificate at least includes the identification information, public key and permission policy label of the distributed agent, and a first digital signature from the authentication server;

[0012] Authentication request message construction stage: when the distributed agent as a request party needs to establish a connection with a verification party, the distributed agent constructs an authentication request message, adds a second digital signature to the authentication request message using its own private key, and attaches its own digital certificate in the authentication request message, and then sends the authentication request message to the verification party;

[0013] The preliminary identity authentication stage: after receiving the authentication request message, the verification party extracts the digital certificate of the distributed agent from the authentication request message, verifies the first digital signature in the digital certificate to confirm that the digital certificate is issued by the trusted authentication server, and then verifies the second digital signature of the authentication request message using the public key contained in the digital certificate. If the second digital signature is verified, it indicates that the authentication request message is sent by the distributed agent as the request party. The verification party preliminarily authenticates the distributed agent and enters the next stage;

[0014] The digital certificate revocation status verification stage: the verification party further verifies whether the digital certificate of the distributed agent has been revoked. If the digital certificate of the distributed agent has not been revoked, the next stage is entered.

[0015] The policy label checking and authorization stage: the verification party gives the distributed agent corresponding access rights and / or control rights according to the permission policy label of the distributed agent.

[0016] The session stage: the verification party sends a notification of authentication success to the distributed agent as the request party, and then the distributed agent as the request party establishes a session with the verification party.

[0017] In the above technical solution, the registration stage specifically includes: when registering, the distributed agent generates a pair of public key and private key based on the lattice problem, and submits its own identification information and the public key to the authentication server. The private key is stored by the distributed agent. The authentication server provides the permission policy label for the distributed agent according to the identification information of the distributed agent, and adds the first digital signature to the identification information, public key and permission policy label of the distributed agent to generate the digital certificate. Then, the authentication server returns the digital certificate to the distributed agent, and the distributed agent stores the digital certificate.

[0018] In the above technical solution, in the authentication request message construction stage, the authentication request message constructed by the distributed agent further includes a timestamp. In the preliminary identity authentication stage, after receiving the authentication request message, the verification party further verifies whether the timestamp in the authentication request message is within the allowed time range.

[0019] In the authentication request message construction stage, the authentication request message constructed by the distributed agent further includes a one-time random number; in the preliminary identity authentication stage, after receiving the authentication request message, the verifier further verifies whether the one-time random number in the authentication request message is reused.

[0020] In the above technical solution, for the distributed agent whose digital certificate has been revoked, the hash value of the identification information of the distributed agent is recorded by the authentication server as initial revocation information; the authentication server collects all the initial revocation information and takes all the initial revocation information as leaf nodes of a Merkle tree respectively; the authentication server performs layer-by-layer hash aggregation on the leaf nodes of the Merkle tree until the global root value of the Merkle tree is obtained; the authentication server broadcasts the global root value of the Merkle tree to all the verifiers; the digital certificate revocation state verification stage specifically includes: converting the identification information of the distributed agent into a verification hash value; if there is a Merkle path proof between the verification hash value and the global root value of the Merkle tree, it indicates that the digital certificate of the distributed agent has been revoked; if there is no Merkle path proof between the verification hash value and the global root value of the Merkle tree, it indicates that the digital certificate of the distributed agent has not been revoked.

[0021] In the above technical solution, whenever the digital certificate of the distributed agent is revoked, the hash value of the identification information of the distributed agent is recorded by the authentication server as new revocation information; the authentication server adds the new revocation information to the leaf nodes of the Merkle tree; the authentication server performs layer-by-layer hash aggregation on the leaf nodes of the Merkle tree until the global root value of the updated Merkle tree is obtained; when the global root value of the Merkle tree is updated, the authentication server broadcasts the updated global root value of the Merkle tree to all the verifiers.

[0022] In the above technical solution, the session stage specifically includes: the verifier sends a notification of authentication success to the distributed agent as a requestor; the verifier generates a temporary session key and encrypts the temporary session key using the public key of the distributed agent as a requestor, and then sends the encrypted temporary session key to the distributed agent as a requestor; the distributed agent as a requestor decrypts the temporary session key using its own private key; the distributed agent as a requestor and the verifier use the temporary session key for symmetric encryption session.

[0023] In the above technical solution, the permission policy label of the distributed agent includes at least one of the device type, the security level and the region of the distributed agent.

[0024] A quantum secure identity authentication system for distributed agents, which applies the quantum secure identity authentication method for distributed agents described above.

[0025] The system at least includes a device layer and a central authentication service layer, the device layer is deployed with a plurality of distributed agents and a plurality of verification parties, and the central authentication service layer is deployed with an authentication server.

[0026] The authentication server is used to issue a digital certificate for the distributed agent, and the digital certificate at least includes identification information, a public key, a permission policy label of the distributed agent, and a first digital signature from the authentication server.

[0027] The distributed agent is used to construct an authentication request message, add a second digital signature to the authentication request message using its own private key, attach its own digital certificate in the authentication request message, and send the authentication request message to the verification party.

[0028] The verification party is used to extract the digital certificate of the distributed agent from the authentication request message after receiving the authentication request message, verify the first digital signature in the digital certificate to confirm that the digital certificate is issued by the trusted authentication server, then the verification party verifies the second digital signature of the authentication request message using the public key contained in the digital certificate, if the second digital signature is verified, it indicates that the authentication request message is sent by the distributed agent as the request party, the verification party makes a preliminary identity authentication confirmation for the distributed agent, and further verifies whether the digital certificate of the distributed agent has been revoked, if the digital certificate of the distributed agent has not been revoked, and according to the permission policy label of the distributed agent, the distributed agent is given corresponding access rights and / or control rights.

[0029] In the above technical solution, the system further includes an edge gateway layer, and the edge gateway layer is used at least for forwarding and / or caching data between the device layer and the central authentication service layer.

[0030] Compared with the prior art, the beneficial effects of the present application are:

[0031] The quantum secure identity authentication method and system for distributed agents have the following characteristics:

[0032] 1. Quantum attack resistance, high security: If part or all of the algorithms for generating public and private keys by the distributed intelligent agent, the signature algorithm of the first digital signature, and the signature algorithm of the second digital signature use a signature algorithm that can resist quantum computing attacks (such as the Dilithium algorithm or the Falcon algorithm), the distributed intelligent agent can be issued a digital certificate with quantum security performance, making it difficult for attackers to forge or crack the device identity of the distributed intelligent agent, significantly improving the system's attack resistance and long-term security, and enabling it to respond to security threats from quantum computing;

[0033] 2. The permission policy label of the distributed intelligent agent is included in the digital certificate, which can embed access and / or control permissions into the identity authentication process of the distributed intelligent agent, allowing the verifier to obtain the access and / or control permissions of the distributed intelligent agent while verifying the authenticity of the distributed intelligent agent, facilitating automatic execution of permission and / or control permissions, improving the integration and real-time performance of the authentication and authorization process, and avoiding additional queries, thereby improving the degree of system security management. BRIEF DESCRIPTION OF DRAWINGS

[0034] Figure 1 The system structure diagram of the quantum secure identity authentication system for distributed intelligent agents of the present application.

[0035] Figure 2 The system structure diagram of the Merkle tree in the present application. DETAILED DESCRIPTION

[0036] The technical solutions in the embodiments of the present application will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor are within the scope of the present application.

[0037] The present embodiment provides a quantum secure identity authentication method for distributed intelligent agents, which can provide an identity authentication method for distributed intelligent agents (such as unmanned aerial vehicles, intelligent terminals, video acquisition devices as described in the disclosure of Chinese invention patent CN116389688A, Internet of Things sensors and Internet of Things execution units in industrial Internet of Things systems, etc.) as requestors and verifiers (such as another distributed intelligent agent, a communication node, and an application server, etc.) to establish a session securely between the requestor and the verifier.

[0038] Please refer to Figure 1 The quantum secure identity authentication method for distributed intelligent agents of the present embodiment includes:

[0039] Registration stage: when registering, the distributed agent connects with the authentication server, the authentication server issues a digital certificate for the distributed agent, the digital certificate at least includes the identification information (such as ID number) of the distributed agent, the public key, the permission policy label, and the first digital signature from the authentication server.

[0040] Authentication request message construction stage: when the distributed agent as a requestor needs to establish a connection with the verifier, the distributed agent constructs an authentication request message, adds a second digital signature to the authentication request message using its own private key, and attaches its own digital certificate in the authentication request message, and then the distributed agent sends the authentication request message to the verifier.

[0041] Preliminary identity authentication stage: after the verifier receives the authentication request message, the verifier extracts the digital certificate of the distributed agent from the authentication request message, verifies the first digital signature in the digital certificate to confirm that the digital certificate is issued by a trusted authentication server, and then the verifier uses the public key contained in the digital certificate to verify the second digital signature of the authentication request message. If the second digital signature is verified, it indicates that the authentication request message is sent by the distributed agent as a requestor, the verifier preliminarily confirms the identity of the distributed agent, and enters the next stage.

[0042] Digital certificate revocation status verification stage: the verifier further verifies whether the digital certificate of the distributed agent has been revoked. If the digital certificate of the distributed agent has not been revoked, the next stage is entered.

[0043] Policy label checking and authorization stage: the verifier grants the distributed agent corresponding access rights and / or control rights according to the permission policy label of the distributed agent.

[0044] Session stage: the verifier sends a notification of authentication success to the distributed agent as a requestor, and then the distributed agent as a requestor establishes a session with the verifier.

[0045] Specifically, the registration stage specifically includes: when registering (such as when the distributed agent first accesses the system or after the distributed agent is reset), the distributed agent generates a pair of public key and private key based on a lattice problem, and submits its own identification information and public key to the authentication server. The private key is stored by the distributed agent. The authentication server provides a permission policy label for the distributed agent according to the identification information of the distributed agent, and the authentication server adds a first digital signature to the identification information, the public key, and the permission policy label of the distributed agent, generates a digital certificate, and then the authentication server returns the digital certificate to the distributed agent, and the distributed agent stores the digital certificate.

[0046] It should be noted that the registration phase can be performed by a device manufacturer, a system administrator or a trusted third party; the generation and storage of the public key and the private key described above can be performed by a trusted platform module (TPM) or a special security chip of the distributed agent, which will serve as an identity credential module of the distributed agent; it can be understood that when the authentication server adds a first digital signature to the identification information, the public key and the permission policy label of the distributed agent, a signature algorithm resistant to quantum computing attacks can be used, such as the Dilithium algorithm or the Falcon algorithm.

[0047] After the registration phase is completed, each distributed agent accessing the system can obtain the digital certificate issued by the authentication server as a secure identity credential.

[0048] Further, in the authentication request message construction phase, the authentication request message constructed by the distributed agent further includes a timestamp; in the preliminary identity authentication phase, the verifier further verifies whether the timestamp in the authentication request message is within the allowed time range after receiving the authentication request message.

[0049] Further, in the authentication request message construction phase, the authentication request message constructed by the distributed agent further includes a one-time random number (Number once); in the preliminary identity authentication phase, the verifier further verifies whether the one-time random number (Number once) in the authentication request message has not been reused after receiving the authentication request message.

[0050] It can be understood that the timestamp and the one-time random number described above can be added with a second digital signature by the private key of the distributed agent; the addition of the timestamp and the one-time random number in the authentication request message enables the distributed agent and the system to resist basic threats such as replay attacks.

[0051] In the past, the verification of the revocation status of the digital certificate often required a complete search of the revocation status list. As the number of revoked digital certificates increases, the data volume of the revocation status list also increases, and the verification of the revocation status of the digital certificate occupies a large amount of computing resources and communication resources.

[0052] Please refer to Figure 2 , specifically, for a distributed agent whose digital certificate has been revoked, the hash value of its identification information is recorded by the authentication server as initial revocation information; the authentication server collects all the initial revocation information and takes all the initial revocation information as leaf nodes (i.e. L1~LN in Figure 2 ) of a Merkle tree respectively; the authentication server performs layer-by-layer hash aggregation on the leaf nodes of the Merkle tree (to obtain Figure 2the global root value of the Merkle tree is broadcasted by the authentication server to all the verifying parties; the digital certificate revocation status verification phase specifically includes: converting the identification information of the distributed agent into a verification hash value; if there is a Merkle path proof between the verification hash value and the global root value of the Merkle tree, it indicates that the digital certificate of the distributed agent has been revoked (i.e. the verification hash value is contained in the leaf node of the Merkle tree); if there is no Merkle path proof between the verification hash value and the global root value of the Merkle tree, it indicates that the digital certificate of the distributed agent has not been revoked (i.e. the verification hash value is not contained in the leaf node of the Merkle tree).

[0053] It can be understood that the revocation of the digital certificate of the distributed agent can be performed manually by the system administrator, or can be performed automatically by the authentication server after triggering certain system rules (e.g. the distributed agent executes a program outside the rules).

[0054] Further, whenever the digital certificate of a distributed agent is revoked, the hash value of the identification information of the distributed agent is recorded by the authentication server as new revocation information; the authentication server adds the new revocation information to the leaf node of the Merkle tree; the authentication server performs layer-by-layer hash aggregation on the leaf node of the Merkle tree until the global root value of the updated Merkle tree is obtained; when the global root value of the Merkle tree is updated, the authentication server broadcasts the global root value of the updated Merkle tree to all the verifying parties.

[0055] Whenever the digital certificate of a distributed agent is revoked, the above-mentioned way of updating the Merkle tree will only involve the corresponding leaf node, a small number of sub-tree nodes and a very small number of root nodes, which occupies a small amount of computing resources and communication resources, and can support high-frequency and large-scale revocation of digital certificates of distributed agents without significantly affecting the system performance.

[0056] The verifying party only needs to cache the global root value of the Merkle tree to achieve the digital certificate revocation status verification, and similarly, the occupying amount of computing resources and communication resources of the verifying party is small.

[0057] Specifically, the session phase specifically includes: the verifying party sends a notification of authentication passing to the distributed agent as the request party; the verifying party generates a temporary session key and encrypts the temporary session key using the public key of the distributed agent as the request party, and then sends the encrypted temporary session key to the distributed agent as the request party; the distributed agent as the request party decrypts the temporary session key using its own private key; the distributed agent as the request party and the verifying party use the temporary session key for symmetric encryption session.

[0058] In the above manner, a symmetric encryption session is established between the distributed agent as the requestor and the verifier, and the sensitive private key or other key materials are not exposed during the whole process, thereby effectively preventing man-in-the-middle attacks and fake identity attacks.

[0059] Specifically, the permission policy label of the distributed agent includes at least one of a device type, a security level, and a region where the distributed agent is located.

[0060] It should be noted that the registration phase, the authentication request message construction phase, the preliminary identity authentication phase, the digital certificate revocation status verification phase, the policy label checking and authorization phase, and the session phase are all executed through the SDK unit for the distributed agent.

[0061] The embodiment also provides a quantum security identity authentication system for a distributed agent, which applies the quantum security identity authentication method for the distributed agent.

[0062] Please refer to Figure 1 The system at least includes a device layer and a central authentication service layer, the device layer is deployed with a plurality of distributed agents and a plurality of verifiers, and the central authentication service layer is deployed with an authentication server.

[0063] The authentication server is configured to issue a digital certificate for the distributed agent, and the digital certificate at least includes identification information, a public key, a permission policy label of the distributed agent, and a first digital signature from the authentication server.

[0064] The distributed agent is configured to construct an authentication request message, add a second digital signature to the authentication request message by using a private key of the distributed agent, attach a digital certificate of the distributed agent to the authentication request message, and send the authentication request message to the verifier.

[0065] The verifier is configured to extract the digital certificate of the distributed agent from the authentication request message after receiving the authentication request message, verify the first digital signature in the digital certificate to confirm that the digital certificate is issued by a trusted authentication server, then verify the second digital signature of the authentication request message by using the public key contained in the digital certificate, if the second digital signature is verified, it indicates that the authentication request message is sent by the distributed agent as the requestor, the verifier performs preliminary identity authentication on the distributed agent, further verifies whether the digital certificate of the distributed agent is revoked, if the digital certificate of the distributed agent is not revoked, and according to the permission policy label of the distributed agent, the distributed agent is given corresponding access rights and / or control rights.

[0066] Further, the system further comprises an edge gateway layer (for example, a deployment edge gateway or an edge server); the edge gateway layer is at least used for forwarding and / or caching data between the device layer and the central authentication service layer.

[0067] The distributed intelligent agent-oriented quantum secure identity authentication method and system of the embodiment have the following characteristics:

[0068] 1. Quantum attack resistance, high security: if the algorithm for generating the public key and the private key of the distributed intelligent agent, the signature algorithm of the first digital signature, and the signature algorithm of the second digital signature partially or entirely use a signature algorithm capable of resisting quantum computing attacks (for example, Dilithium algorithm or Falcon algorithm), then a digital certificate with quantum security performance can be issued for the distributed intelligent agent, it is difficult for an attacker to forge or crack the device identity of the distributed intelligent agent, the anti-attack ability and long-term security of the system are significantly improved, and the security threat from quantum computing can be addressed;

[0069] 2. The permission policy label of the distributed intelligent agent is contained in the digital certificate, the access permission and / or control permission can be embedded into the identity authentication process of the distributed intelligent agent, the verifier can obtain the access permission and / or control permission of the distributed intelligent agent while confirming the authenticity of the identity of the distributed intelligent agent, the automatic execution of the permission and / or control permission control is facilitated, the integration and real-time performance of the authentication and authorization process are improved, additional queries are avoided, and the fine degree of system security management is improved.

[0070] Although the embodiments of the present application have been shown and described, it is to be understood that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the present application, the scope of the present application being defined by the appended claims and their equivalents.

Claims

1. A quantum-safe identity authentication method for distributed intelligent agents, characterized in that, include: Registration phase: When a distributed intelligent agent registers, it connects to an authentication server, which issues a digital certificate to the distributed intelligent agent. The digital certificate includes at least the distributed intelligent agent's identification information, public key, permission policy tag, and a first digital signature from the authentication server. Authentication request message construction phase: When the distributed intelligent agent, acting as the requester, needs to establish a connection with the verifier, the distributed intelligent agent constructs an authentication request message, adds a second digital signature to the authentication request message using its own private key, and attaches its own digital certificate to the authentication request message. Subsequently, the distributed intelligent agent sends the authentication request message to the verifier. Preliminary Identity Authentication Stage: After receiving the authentication request message, the verifier extracts the digital certificate of the distributed intelligent agent from the authentication request message. By verifying the first digital signature in the digital certificate, it confirms that the digital certificate was issued by the trusted authentication server. Subsequently, the verifier uses the public key contained in the digital certificate to verify the second digital signature of the authentication request message. If the second digital signature is verified, it indicates that the authentication request message was sent by the distributed intelligent agent as the requester. The verifier performs preliminary identity authentication confirmation on the distributed intelligent agent and proceeds to the next stage. Digital certificate revocation status verification stage: The verifier further verifies whether the digital certificate of the distributed intelligent agent has been revoked. If the digital certificate of the distributed intelligent agent has not been revoked, the process proceeds to the next stage. Policy tag verification and authorization phase: The verifier grants the distributed intelligent agent corresponding access and / or control permissions based on the permission policy tag of the distributed intelligent agent; Session Phase: The verification party sends a notification of successful authentication to the distributed agent acting as the requester. Subsequently, the distributed agent acting as the requester establishes a session with the verification party.

2. The quantum-secure identity authentication method for distributed intelligent agents according to claim 1, characterized in that, The registration phase specifically includes: During registration, the distributed intelligent agent generates a pair of public and private keys based on a lattice problem and submits its own identification information and the public key to the authentication server. The private key is stored by the distributed intelligent agent. The authentication server provides the distributed intelligent agent with the permission policy tag based on the distributed intelligent agent's identification information. After adding a first digital signature to the distributed intelligent agent's identification information, public key, and permission policy tag, the authentication server generates the digital certificate. Subsequently, the authentication server sends the digital certificate back to the distributed intelligent agent, which stores the digital certificate.

3. The quantum-secure identity authentication method for distributed intelligent agents according to claim 1, characterized in that, In the authentication request message construction phase, the authentication request message constructed by the distributed agent also includes a timestamp; In the initial identity authentication phase, after receiving the authentication request message, the authenticator also verifies whether the timestamp in the authentication request message is within the allowed time range.

4. The quantum-secure identity authentication method for distributed intelligent agents according to claim 1 or 3, characterized in that, In the authentication request message construction phase, the authentication request message constructed by the distributed agent also includes a one-time random number; In the initial identity authentication phase, after receiving the authentication request message, the verifier also verifies whether the one-time random number in the authentication request message has not been reused.

5. The quantum-secure identity authentication method for distributed intelligent agents according to claim 1, characterized in that, For the distributed intelligent agent whose digital certificate has been revoked, the hash value of its identification information is recorded by the authentication server as initial revocation information; The authentication server collects all the initial revocation information and uses each of the initial revocation information as a leaf node of a Merkle tree; The authentication server performs layer-by-layer hash aggregation on the leaf nodes of the Merkle tree until it obtains the global root value of the Merkle tree. The authentication server broadcasts the global root value of the Merkle tree to all the validators; The digital certificate revocation status verification phase specifically includes: Convert the identification information of the distributed intelligent agent into a verification hash value; If a Merkle path proof exists between the verification hash value and the global root value of the Merkle tree, it indicates that the digital certificate of the distributed agent has been revoked. If there is no Merkle path proof between the verification hash value and the global root value of the Merkle tree, it indicates that the digital certificate of the distributed agent has not been revoked.

6. The quantum-safe identity authentication method for distributed intelligent agents according to claim 5, characterized in that, Whenever a digital certificate of the distributed intelligent agent is revoked, the hash value of the identifier information of the distributed intelligent agent is recorded by the authentication server as newly added revocation information; The authentication server adds the new revocation information to the leaf node of the Merkle tree; The authentication server performs layer-by-layer hash aggregation on the leaf nodes of the Merkle tree until it obtains the updated global root value of the Merkle tree. When the global root value of the Merkle tree is updated, the authentication server broadcasts the updated global root value of the Merkle tree to all the validators.

7. The quantum-secure identity authentication method for distributed intelligent agents according to claim 1, characterized in that, The session phase specifically includes: The verification direction sends a notification of successful authentication to the distributed intelligent agent acting as the requester. The verifier generates a temporary session key and encrypts the temporary session key using the public key of the distributed agent acting as the requester. Subsequently, the verifier sends the encrypted temporary session key to the distributed agent acting as the requester. The distributed intelligent agent, acting as the requester, uses its own private key to decrypt the temporary session key; The distributed intelligent agent, acting as the requester, and the verifier, use the temporary session key to conduct a symmetric encrypted session.

8. The quantum-secure identity authentication method for distributed intelligent agents according to claim 1, characterized in that, The permission policy label of the distributed intelligent agent includes at least one of the device type, security level, and region of the distributed intelligent agent.

9. A quantum-safe identity authentication system for distributed intelligent agents, characterized in that, It applies the quantum-secure identity authentication method for distributed intelligent agents as described in any one of claims 1-8; The system includes at least a device layer and a central authentication service layer. The device layer is equipped with several distributed intelligent agents and several verification parties, and the central authentication service layer is equipped with an authentication server. The authentication server is used to issue digital certificates to the distributed intelligent agent. The digital certificate includes at least the identification information of the distributed intelligent agent, public key, permission policy label, and a first digital signature from the authentication server. The distributed intelligent agent is used to construct an authentication request message, add a second digital signature to the authentication request message using its own private key, attach its own digital certificate to the authentication request message, and send the authentication request message to the verifier. The verifier, upon receiving the authentication request message, extracts the digital certificate of the distributed agent from the message. It then verifies the first digital signature within the digital certificate to confirm that the certificate was issued by a trusted authentication server. Subsequently, it uses the public key contained in the digital certificate to verify the second digital signature of the authentication request message. If the second digital signature is verified, it indicates that the authentication request message was sent by the distributed agent as the requester. The verifier then performs preliminary identity authentication of the distributed agent and further verifies whether the digital certificate of the distributed agent has been revoked. If the digital certificate of the distributed agent has not been revoked, it grants the distributed agent corresponding access and / or control permissions based on the agent's permission policy tag.

10. The quantum-secure identity authentication system for distributed intelligent agents according to claim 9, characterized in that, The system also includes an edge gateway layer; The edge gateway layer is used at least for forwarding and / or caching data between the device layer and the central authentication service layer.

Images