Quantum computing threat-oriented full-link identity authentication method and system

Abstract

The invention discloses a quantum computing threat-oriented full-link identity authentication method, which remarkably improves the security and reliability of a mobile phone number password-free login process, has high system compatibility and expansibility, adapts to a multi-service scene, can effectively resist security challenges brought by quantum computing, and improves the security and reliability of the mobile phone number password-free login process. And a solid technical guarantee is provided for quantum threat-oriented next-generation trusted identity authentication. Through fusion of a quantum security mechanism and an authentication process, a high-security password-free authentication solution with innovativeness and feasibility is provided around multiple dimensions of quantum resistance enhancement, authentication process optimization, system compatibility and the like, the defects of insufficient quantum resistance and the like in the prior art are overcome, and the security of the authentication process is improved. And the method has remarkable technical advancement and application and popularization values.

Description

Technical Field

[0001] This invention relates to the field of information security, and in particular to a full-link identity authentication method and system for addressing quantum computing threats. Background Technology

[0002] In recent years, the rapid development of quantum computing has posed unprecedented challenges to existing network security systems. Traditional public-key cryptography systems (such as RSA and ECC) rely heavily on the computational complexity of mathematical problems to ensure security. However, these systems will no longer be reliable in the face of quantum computers. The introduction of Shor's algorithm in 1994 enabled the efficient solution of large integer factorization and elliptic curve discrete logarithm problems under quantum computing conditions, theoretically shaking the security foundation of current encryption systems. In view of this, security agencies and standards organizations around the world are paying close attention to this threat and have launched "quantum-resistant" cryptographic migration projects. The National Institute of Standards and Technology (NIST) in the United States officially released the first batch of post-quantum encryption standards in 2024. China is also actively promoting the research and deployment of new security technologies such as quantum key distribution (QKD, a secure communication method that uses the properties of quantum mechanics to realize cryptographic protocols, enabling both parties to generate and share a random, secure key to encrypt and decrypt messages) and post-quantum cryptography (PQC, encryption algorithms that can resist cryptanalysis attacks by quantum computers). With "Q-Day" (the time when quantum computers will be able to crack traditional cryptography) approaching, building a future-oriented quantum-safe system has become a key direction for global cybersecurity development.

[0003] Quantum communication, as an important technological path to resist future quantum computing threats and achieve unconditionally secure networks, takes the "physical laws" themselves as the foundation of security, so that key distribution and information exchange have inherently detectable confidentiality. It mainly covers two major technologies: quantum key distribution (QKD) and post-quantum cryptography (PQC). The current mainstream quantum communication architecture generally adopts a fusion implementation of "QKD+PQC", as shown in Figure 1. In this architecture, the Certificate Authority (CA) constructs a PQC-CA certificate using the PQC algorithm, which enables identity authentication and non-repudiation between various quantum security infrastructures. The quantum security infrastructures then use QKD technology to complete key distribution and sharing, thereby constructing a secure and trustworthy quantum key distribution architecture. If applications A, B, and C at the application layer need to implement quantum communication, they only need to access the nearest quantum security infrastructure through an SDK (Software Development Kit, a set of software development tools provided by software developers to provide necessary components when developers create new applications within a specific product and its ecosystem), call the quantum session key provided by the facility to encrypt business data, and finally achieve secure transmission of quantum-encrypted business data.

[0004] In the field of internet identity authentication, passwordless login via mobile phone number is a widely used and convenient authentication method. It uses mobile operators as a key source of trust, leveraging their network capabilities and user data management advantages to provide efficient and secure identity authentication services and build a reliable authentication foundation. This technology typically includes two core processes: pre-retrieval of a phone number and one-click login. Furthermore, the accessing app must integrate a passwordless login SDK to perform passwordless login operations via mobile phone number.

[0005] Pre-fetching number process: When the app loads, it sends an authentication request to the operator's authentication platform via the integrated passwordless login SDK. The operator's network equipment uses DPI (Deep Packet Inspection, a network traffic analysis technology that can inspect the complete data packet content transmitted over the network (not only the IP header, but also application layer data) technology to identify the pre-fetching number authentication request, extracting information such as the mobile phone number, International Mobile Subscriber Identity (IMSI, a globally unique user identifier bound to the SIM card), and International Mobile Equipment Identity (IMEI, a globally unique device identifier bound to the mobile phone) contained in the request. It also uses HTTPS header enhancement technology (a technique used by telecom operators to insert additional information into the HTTP / HTTPS request message header on gateway devices such as UPF / PGW) to insert the above key information into the authentication request. After receiving the authentication request, the operator's authentication platform verifies the inserted information. If the verification is successful, it returns the mobile phone number mask and access code, which are then cached by the app. In the above context, PGW (Packet Data Network Gateway) is a crucial component of the core network in mobile communication networks, serving as the exit gateway for user data and connecting to the public or private network. UPF (User Plane Function) is a dedicated network function component in the 5G core network responsible for tasks such as user data packet forwarding, routing, quality of service management, and traffic billing.

[0006] One-click login process: After completing the pre-number retrieval process, when a user initiates the login operation, the app prompts the user to authorize one-click login. After authorization, the app triggers a one-click mobile number authentication process via the passwordless login SDK, sending the cached access code to the operator's authentication platform. The operator's authentication platform authenticates the access code and request message; if authentication is successful, it returns an access token to the app. The accessing app sends the access token to the accessing server, which then forwards it to the operator's authentication platform for user identity verification. After successful verification, the operator's authentication platform returns the user's mobile number to the accessing server, which then returns login success information to the accessing app. The app then enters the login state, completing the entire one-click login process.

[0007] However, existing mobile phone number passwordless login technology has significant security flaws: its core relies on the HTTPS protocol to build a secure channel for transmitting sensitive information (such as mobile phone number, IMSI, IMEI, access code, access token, etc.), while the security foundation of the HTTPS protocol is still the traditional public key cryptography system. With the increasing maturity of quantum computing technology, this type of traditional cryptography system is easily cracked by quantum computers, which leads to the risk of leakage of sensitive data such as user identity information and authentication credentials transmitted in the passwordless login process. As a result, the security of the entire identity authentication process cannot be guaranteed, and it is difficult to resist the security threats brought by quantum computing. Summary of the Invention

[0008] The following provides a brief overview of one or more aspects to offer a basic understanding of them. This overview is not an exhaustive summary of all conceived aspects, nor is it intended to identify key or decisive elements of all aspects, nor to define the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form to prepare for the more detailed descriptions that follow.

[0009] The purpose of this invention is to solve the above-mentioned problems and provide a full-link identity authentication method and system for quantum computing threats. It significantly improves the security and reliability of the mobile phone number passwordless login process. The overall solution has high system compatibility and scalability, adapts to multiple business scenarios, and can effectively resist the security challenges brought by quantum computing, providing a solid technical guarantee for the next generation of trusted identity authentication for quantum threats.

[0010] The technical solution of this invention is as follows: This invention discloses a full-link identity authentication method for quantum computing threats, the method comprising:

[0011] Step S1: The access party submits access party information to the operator's authentication platform and initiates a pre-number retrieval request;

[0012] Step S2: Quantum head-resistant enhancement processing for telecom gateways;

[0013] Step S3: Quantum decryption and verification header enhancement information by the operator authentication platform;

[0014] Step S4: The operator authentication platform uses quantum decryption and verification to check the access party information;

[0015] Step S5: The operator authentication platform responds to the number retrieval request and returns the number retrieval information;

[0016] Step S6: The access party caches the pre-fetched number information;

[0017] Step S7: Access the software development kit and request the login page;

[0018] Step S8: The access party displays the pre-selection number information on the login page;

[0019] Step S9: The access party sends a login request to the access party server carrying the pre-acquisition number information;

[0020] Step S10: The access party's server uses quantum encryption to encrypt and forward the login information;

[0021] Step S11: The operator authentication platform decrypts the pre-fetched number information and verifies it.

[0022] Step S12: The operator authentication platform generates the first login information and returns it to the access party's server in quantum encryption form;

[0023] Step S13: The access server performs quantum decryption on the first login information and generates the second login information based on the authentication result;

[0024] Step S14: The access party receives the second login information, confirms the user's login status, and enters the business process.

[0025] According to one embodiment of the end-to-end identity authentication method for quantum computing threats according to the present invention, the access party information includes an application identifier and an application key. The access party information is obtained by the access party after registering a developer account on the operator's authentication platform and is used for identity verification, access control and service call authorization.

[0026] According to an embodiment of the end-to-end authentication method for quantum computing threats of the present invention, step S2 further includes:

[0027] The first step is that after receiving a request from the access party, the telecom gateway inserts specific quantum-encrypted header enhancement information into the message header before forwarding it to the operator's authentication platform. The quantum encryption method is as follows:

[0028]

[0029] M represents head enhancement information, K c For quantum key ciphertext, H x A charging key handle obtained by a telecommunications gateway from a quantum-safe infrastructure; QENC stands for quantum encryption, and C stands for quantum ciphertext;

[0030] The second step involves enhancing the quantum encryption header information, then concatenating the quantum ciphertext and the session identifier (sessionId) together, and performing a quantum signature:

[0031] ,

[0032] QSIGN is a quantum signature algorithm;

[0033] The third step is to insert the quantum ciphertext C, the session identifier sessionId, and the quantum signature sign into the request header. middle.

[0034] According to an embodiment of the end-to-end authentication method for quantum computing threats of the present invention, step S3 further includes:

[0035] The verification header enhancement information is as follows:

[0036]

[0037] H y To fill the key handle, K c Quantum key ciphertext;

[0038] If the above equation is true, the signature verification passes, and the process continues:

[0039]

[0040] Where C represents quantum ciphertext and QDEC represents quantum decryption.

[0041] According to one embodiment of the end-to-end identity authentication method for quantum computing threats according to the present invention, the pre-fetched number information includes two fields: an access code and a de-identified mobile phone number.

[0042] According to an embodiment of the end-to-end identity authentication method for quantum computing threats of the present invention, the verification method of the pre-fetched number information in step S11 includes: integrity verification, authenticity verification and timeliness verification; the first login information includes an access token and a mobile phone number, and the second login information is used to guide the access party to complete the subsequent business process.

[0043] According to an embodiment of the end-to-end authentication method for quantum computing threats based on the present invention, the method further includes a quantum-resistant secure channel establishment process, the establishment process further including:

[0044] Step 1: Initialization phase;

[0045] Step 2: Apply for a quantum session key. Before the session begins, the communication initiator calls the software development kit for quantum-resistant passwordless login and applies to the quantum security infrastructure to generate a quantum session key by carrying a token. The quantum security infrastructure returns the key ciphertext, session identifier, and first charging key handle for the session.

[0046] Step 3: Transmit key identifier;

[0047] Step 4: Session key query. Based on the received session identifier, the communication receiver calls the session key query interface of the quantum security infrastructure through the software development kit for quantum-safe passwordless login, and initiates a key query request with the token. After the quantum security infrastructure completes the authentication of the communication receiver, it returns the corresponding session key ciphertext and the second filling key handle.

[0048] Step 5: Secure channel construction. Based on their respective obtained session key ciphertexts and corresponding charging key handles, the two communicating parties complete the parsing and loading of quantum keys in their local secure media, thus completing the construction of a quantum-resistant secure communication channel.

[0049] This invention also discloses a full-link identity authentication system for quantum computing threats, including service modules, security media, and software development kits deployed in the communicating parties, as well as quantum security infrastructure deployed on the operator's authentication platform.

[0050] The business module is used to process the business logic of both communicating parties, realize the interaction of business data, and transmit business data between the business modules of different communicating parties.

[0051] The software development kit (SDK) is used to handle data processing functions. The business modules and the SSD complete the conversion between business data and data to be encrypted / decrypted.

[0052] Secure medium is used to perform data encryption and decryption operations. The software development kit of the communicating party and the secure medium realize the encryption or decryption of data.

[0053] The quantum security infrastructure includes a key management system, which manages the quantum session keys of the corresponding communication parties through different key management systems. The quantum key distribution network enables the sharing and synchronization of quantum keys between different key management systems. The software development kits of different communication parties establish connections with the quantum security infrastructure to obtain quantum session keys, which are used for encryption and decryption operations of data by the secure medium.

[0054] The system also runs the full-link identity authentication method for quantum computing threats, as described above.

[0055] This invention also discloses a full-link identity authentication system for quantum computing threats, comprising:

[0056] Memory; and

[0057] A processor, connected to the memory, is configured to implement the end-to-end authentication method for quantum computing threats as described above.

[0058] The present invention also discloses a computer-readable storage medium storing computer instructions that, when executed by a processor, implement the end-to-end authentication method for quantum computing threats as described above.

[0059] Compared with existing technologies, this invention offers the following advantages: Based on quantum-safe infrastructure, it successfully establishes a full-link quantum-resistant secure communication channel covering the access party's app, the operator's authentication platform, and the access party's server. This channel significantly enhances the security and reliability of the mobile phone number-based passwordless login process. In the key management stage, this invention utilizes encrypted transmission of quantum session keys, combined with a dedicated key management mechanism within the secure medium. This not only achieves complete isolation and control over the key's lifecycle but also eliminates the need for users to be aware of the key's generation, transmission, use, and destruction processes, fundamentally reducing the risk of key leakage and effectively resisting the threat of quantum attacks.

[0060] In the one-click login process, this invention employs a multi-segment quantum encryption strategy to provide dual protection for the confidentiality and integrity of information during transmission and processing. All critical encryption and decryption operations are confined to a trusted and secure medium, and the scheme supports mainstream symmetric cryptographic algorithms such as AES-CBC and SM4-CBC, further ensuring the security of keys and sensitive data. From a system adaptability perspective, this scheme possesses high compatibility and scalability, flexibly adapting to the needs of various business scenarios. In summary, this invention effectively addresses the security challenges posed by quantum computing technology, providing solid technical support for building a next-generation trusted identity authentication system resistant to quantum threats. Attached Figure Description

[0061] The above-described features and advantages of the present invention will be better understood after reading the following detailed description of embodiments of the present disclosure in conjunction with the accompanying drawings. In the drawings, components are not necessarily drawn to scale, and components having similar related characteristics or features may have the same or similar reference numerals.

[0062] Figure 1 A schematic diagram of a traditional quantum communication architecture based on QKD and PQC is shown.

[0063] Figure 2 The diagram shows the architecture module diagram adapted to the end-to-end identity authentication method for quantum computing threats of the present invention.

[0064] Figure 3 A schematic diagram of the process for establishing a quantum-secure channel according to the present invention is shown.

[0065] Figure 4 A schematic diagram of the quantum-safe passwordless authentication process of the present invention is shown.

[0066] Figure 5 A schematic diagram of the quantum encryption / decryption process of the present invention is shown.

[0067] Figure 6 A schematic diagram of the end-to-end identity authentication system for quantum computing threats of the present invention is shown. Detailed Implementation

[0068] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. It should be noted that the aspects described below with reference to the accompanying drawings and specific embodiments are merely exemplary and should not be construed as limiting the scope of protection of the present invention in any way.

[0069] The end-to-end authentication method for quantum computing threats of this invention involves various secure media and access components with quantum-resistant capabilities. The access party's user terminal deploys embedded secure media, such as quantum SIM cards and quantum software modules, for local key management and encryption / decryption operations. The operator's authentication platform and the access party's business server respectively interface with a quantum cloud service cryptographic machine to provide remote quantum security support. The aforementioned quantum SIM card, quantum software module, and quantum cloud service cryptographic machine all serve as a quantum-resistant secure computing environment, constituting the information security facility of this invention. The overall architecture modules are as follows: Figure 2 As shown, the communication parties (such as communication party A and communication party B in the figure) include service modules, security media, and SDK.

[0070] The business module is used to process the business logic of both parties, realize the interaction of business data, and transmit business data between the business modules of different communication parties.

[0071] The SDK (Software Development Kit) is used to handle data processing functions. The business modules and the SDK complete the conversion between business data and data to be encrypted / decrypted.

[0072] The secure medium is used to perform data encryption and decryption operations. The SDK of the communicating party and the secure medium implement data encryption or decryption processing.

[0073] Quantum security infrastructure includes a KMS (Key Management System): which is used to manage the quantum session keys of corresponding communication parties through different KMSs, including key generation, distribution, and storage. Furthermore, quantum key sharing and synchronization are achieved between different KMSs through a quantum key distribution network, ensuring the consistency and security of quantum session keys.

[0074] The SDKs of different communication parties establish connections with the quantum security infrastructure to obtain quantum session keys, which are used for encryption and decryption operations on data by the secure medium.

[0075] Before accessing the passwordless login service, the accessing party needs to register a developer account on the operator's authentication platform to obtain access credentials, including a unique application identifier, for subsequent business calls and identity verification. Simultaneously, the accessing party must integrate a quantum-resistant passwordless login SDK into its application. This SDK embeds a quantum security capability module, enabling interaction with local secure media and remote quantum security infrastructure to complete functions such as quantum key retrieving, data encryption / decryption, and identity authentication, ensuring the entire passwordless login process possesses quantum attack resistance and a high level of security.

[0076] The end-to-end authentication method for quantum computing threats in this invention includes, for example: Figure 3 The illustrated process for establishing a quantum-secure channel strengthens the data transmission of application identifiers, access codes, access tokens, mobile phone numbers, and other identity-verification and sensitive information by introducing a quantum-secure channel. This ensures the data is resistant to quantum attacks during transmission, thereby guaranteeing the overall security of the pre-number retrieval and one-click login processes. In this invention, the pre-number retrieval process relies on a quantum-secure communication channel established between the access party's mobile application and the operator's authentication platform; the one-click login process involves the collaborative construction and use of multiple quantum-secure channels between the access party's mobile application and the access party's server, and between the access party's server and the operator's authentication platform. Through this mechanism, this invention effectively enhances the security protection capabilities of the passwordless login process against quantum computing threats, ensuring the confidentiality and integrity of critical identity information during transmission and processing.

[0077] Combination Figure 3 The specific steps for establishing a quantum-resistant secure channel are detailed below.

[0078] Step 1: Initialization phase.

[0079] During device startup or application initialization, both parties in the communication (i.e., the communication initiator and the communication receiver) establish a connection with the quantum-safe infrastructure through the anti-quantum-safe passwordless login SDK to complete identity authentication and security capability initialization.

[0080] Step 2: Apply for a quantum session key.

[0081] Before the session begins, the initiator calls the quantum-safe passwordless login SDK to request a quantum session key from the quantum secure infrastructure by sending a token. The quantum secure infrastructure returns the encrypted form (ciphertext) of the key, a unique session identifier (sessionId), and a key handle A.

[0082] A token serves as a credential for identity authentication and authorization verification. Its functions include identity verification, access control, and consistency of communication. Identity verification ensures that the entity (SDK) initiating the "request session key" or "query session key" request is an authorized and legitimate object, preventing malicious entities from forging requests. Access control, based on the validity of the token, allows the quantum security infrastructure to determine whether to allow the request, avoiding the risk of unauthorized acquisition of session keys. Consistency of communication ensures that the "request" and "query" processes are based on the same authentication logic, guaranteeing that the session keys ultimately obtained by the sender and receiver are matched and secure, thereby supporting the reliability of subsequent encrypted communication.

[0083] Step 3: Transmit the key identifier.

[0084] The initiator transmits the session identifier (sessionId) to the receiver, eliminating the need to transmit the quantum session key ciphertext and preventing the key from being exposed during transmission.

[0085] Step 4: Session key lookup.

[0086] The receiving party, based on the received session identifier (sessionId), invokes the session key query interface of the quantum-safe infrastructure via the quantum-safe passwordless login SDK, sending a key query request along with the token. After authenticating the receiving party, the quantum-safe infrastructure returns the corresponding ciphertext of the session key and the handle to the charging key (B).

[0087] Step 5: Secure channel construction.

[0088] Based on their respective obtained session key ciphertext and corresponding charging key handle, the two communicating parties complete the parsing and loading of the quantum key in their local secure medium, thus completing the construction of a quantum-resistant secure communication channel and providing security for the subsequent encryption and decryption transmission of passwordless login data.

[0089] After the aforementioned quantum-safe communication channel is constructed, the two stages of "pre-retrieval number" and "one-click login" in the mobile phone number password-free login process of this invention are both executed within the quantum-safe communication channel to ensure the quantum-safe security and integrity of user identity information and authentication data during transmission.

[0090] refer to Figure 4 As shown, the pre-number retrieval process is initiated by the access party application and mainly completes the secure identity interaction with the operator's authentication platform. The specific steps are as follows:

[0091] Step S1: The access party's APP submits the access party information to the operator's authentication platform and initiates a pre-number retrieval request.

[0092] The access party information includes the application identifier and application key. This access party information is obtained by the access party after registering a developer account on the operator's authentication platform. It serves as a legitimate credential for accessing the authentication platform services and is used for identity verification, access control, and business call authorization.

[0093] Step S2: Quantum head enhancement processing for telecom gateway.

[0094] To enable the operator authentication platform to effectively identify and process number retrieval requests, an HTTPS header enhancement technology based on the UPF / PGW architecture is adopted. After receiving an HTTPS request from the access party's APP, the telecom gateway device inserts specific quantum-encrypted header enhancement information into the message header before forwarding it to the operator authentication platform. The quantum encryption method is as follows:

[0095]

[0096] Where M represents header enhancement information, mainly including: user mobile phone number, IMSI, IMEI, terminal IP address and other key device and user identification data; K c For quantum key ciphertext, H x This refers to the key handle obtained by the telecommunications gateway from the quantum security infrastructure; QENC represents quantum encryption, which can be standard algorithms such as AES-CBC and SM4-CBC; C represents quantum ciphertext. After enhancing the quantum encryption header, the quantum ciphertext and the session identifier (sessionId) are concatenated and then quantum-signed. :

[0097]

[0098] QSIGN is a quantum signature algorithm, which can be a standard algorithm such as HMAC-SHA256 or HMAC-SM3, and the symbol... This refers to string concatenation, which involves joining two or more data segments sequentially into a new string or data block.

[0099] Finally, the quantum ciphertext C, the session identifier sessionId, and the quantum signature sign are inserted into the request header. among:

[0100] .

[0101] Step S3: Quantum decryption and verification header enhancement information by the operator authentication platform.

[0102] The verification header enhancement information is as follows:

[0103]

[0104] Among them, H y To fill the key handle, the server submits the sessionId obtained from the quantum security infrastructure query, K. c This is the quantum key ciphertext. If the above equation holds true, the signature verification passes, and then execution proceeds:

[0105]

[0106] QDEC stands for Quantum Decryption. This is the result of quantum decryption.

[0107] Step S4: The operator authentication platform uses quantum decryption and verification to check the access party information.

[0108] Step S5: The operator's authentication platform responds to the number retrieval request and returns the number retrieval information.

[0109] The pre-fetched number information includes two fields: an access code and a masked mobile phone number. The access code is a random and unique string generated by the operator's authentication platform, used for identity association and verification in subsequent login requests, and is valid for 60 minutes. The masked mobile phone number is the user's mobile phone number displayed in a partially masked form, such as "136****0000", used to display on the login interface without revealing the complete user identity.

[0110] Step S6: The access party's APP caches the pre-fetched number information.

[0111] The one-click login process completes user identity authentication and business login based on the pre-acquired number. The specific steps are as follows:

[0112] Step S7: The access party's APP requests the login page from the SDK.

[0113] Step S8: The access party's APP displays the pre-selection number information on the login page.

[0114] Step S9: The access party's APP sends a login request to the access party's server, carrying the pre-acquired number information.

[0115] Step S10: The access party's server uses quantum encryption to encrypt and forward the login information.

[0116] Step S11: The operator authentication platform decrypts the pre-fetched number information and verifies the pre-fetched number information.

[0117] The verification methods for pre-fetched numbers are integrity verification, authenticity verification, and timeliness verification. Integrity verification refers to comparing the quantum signature of the information; authenticity verification refers to verifying the consistency between the data and the database data; and timeliness verification refers to checking whether the pre-fetched number information has expired.

[0118] Step S12: The operator authentication platform generates login information 1 and returns it to the access party's server in quantum encryption form.

[0119] The login information returned by the operator's authentication platform includes an access token and a mobile phone number. The access token, used for subsequent user authentication and authorization calls, is random and time-sensitive, with a validity period of 30 days. The mobile phone number is used by the access provider's server to confirm the user's identity and match it with the local account system.

[0120] Step S13: The access server performs quantum decryption on login information 1 and generates login information 2 based on the authentication result.

[0121] The login information 2 generated by the access party's server is used to guide the APP to complete subsequent business processes. Its format and content are defined by the access party according to its own business logic, and the operator platform does not participate in the processing.

[0122] Step S14: Business Processing Completed - Login: The access party APP receives login information 2, confirms the user's login status, and enters the business process.

[0123] All data that needs to be encrypted, decrypted, or signed in the above steps shall be as follows: As shown, this is accomplished through the collaboration of a quantum-resistant, passwordless login SDK and a local secure medium. Symmetric cryptography can use algorithms such as AES-CBC and SM4-CBC, and signature algorithms can use algorithms such as HMAC-SHA256 and HMAC-SM3. Alternatively, authentication encryption algorithms with associated data, such as ASCON and AES-GCM, can be used, providing both confidentiality and integrity. Therefore, both communicating parties must agree to use the same cryptographic algorithm to ensure data consistency and decryption compatibility.

[0124] like As shown, the business application (receiver / sender) is used to initiate cryptographic operation requests and receive the final operation results, serving as the carrier of business logic.

[0125] The quantum-resistant passwordless login SDK (receiver / sender) acts as a bridge between the business application and the secure medium. It receives the cryptographic operation call request from the business application and forwards it to the secure medium. At the same time, it receives the operation result returned by the secure medium and sends it back to the business application.

[0126] Secure media (receiver / sender) are used to perform specific cryptographic operations, such as encryption, decryption, signing, and signature verification, to ensure the security of cryptographic operations.

[0127] The receiving process is as follows:

[0128] The receiving party's business application sends a request to the quantum-resistant, passwordless login SDK to perform cryptographic operations.

[0129] The recipient's quantum-safe passwordless login SDK forwards the request to the secure medium and initiates a cryptographic operation.

[0130] After the secure medium of the receiver performs cryptographic operations, it returns the operation result to the SDK for quantum-resistant secure passwordless login.

[0131] The recipient's quantum-resistant, passwordless login SDK sends the computation results back to the business application.

[0132] The receiving application transmits the calculation results to the sending application.

[0133] The sender's process is as follows:

[0134] After receiving the computation result from the receiver, the sending application sends a request to the quantum-resistant passwordless login SDK to perform cryptographic computation.

[0135] The sender's quantum-safe passwordless login SDK forwards the request to the secure medium and initiates the cryptographic operation.

[0136] After the sender's secure medium performs cryptographic operations, it returns the results to the SDK for quantum-resistant secure passwordless login.

[0137] The sender's quantum-resistant, passwordless login SDK sends the computation results back to the business application.

[0138] Based on the above description of the embodiments, the technical features and corresponding technical effects of the present invention are as follows:

[0139] (1) Implementation of the fusion of quantum cryptography and head enhancement mechanism under the UPF / PGW architecture:

[0140] To ensure the deployability and low modification cost of this invention in a real-world commercial environment, compatibility with existing operator authentication systems has been fully considered. Regarding the header enhancement mechanism, this invention proposes a quantum-integrated encryption / decryption strategy based on the existing UPF / PGW HTTPS header enhancement technology framework. A quantum-resistant secure channel is established at the transport and application layers, achieving the integration of the quantum encryption mechanism with the existing network header enhancement scheme, ensuring a stable and reliable authentication process.

[0141] (2) Construct a quantum-safe infrastructure-based mechanism to resist quantum key negotiation and encryption / decryption:

[0142] This invention constructs a quantum-resistant key distribution and encryption / decryption mechanism based on quantum-safe infrastructure between the client, the operator's authentication platform, and the access server. By introducing secure media such as quantum SIM cards, quantum software modules, and cloud cryptographic machines, and in conjunction with a unified quantum-resistant security SDK, the key generation, encryption / decryption, and negotiation processes are completed within the secure media. This scheme avoids the exposure of plaintext keys during transmission, possesses quantum forward security, significantly improves the security of the entire authentication process under quantum computing threats, and overcomes the dependence of traditional passwordless login schemes on classical encryption algorithms.

[0143] (3) Construction of a full-link quantum-resistant communication channel and sensitive data protection mechanism:

[0144] This invention establishes a quantum-resistant communication channel for the entire authentication process, ensuring that sensitive data such as application identifiers, access codes, and access tokens transmitted during the authentication process are encrypted and protected throughout the entire process. Sensitive data is processed by calling encryption algorithms within a secure medium, and the encryption key is generated through a quantum key negotiation process, guaranteeing the confidentiality and integrity of data transmission. This technology achieves end-to-end quantum-resistant protection from the terminal to the authentication platform, effectively preventing man-in-the-middle attacks and the risk of sensitive information leakage.

[0145] In summary, this invention integrates quantum security mechanisms with the authentication process, and proposes an innovative and feasible high-security passwordless authentication solution that addresses the shortcomings of existing technologies, such as insufficient quantum resistance, authentication process optimization, and system compatibility. It demonstrates significant technological advancement and application promotion value.

[0146] In addition, such as Figure 6 As shown, this invention also discloses a full-link authentication system for quantum computing threats, including a memory and a processor. The processor is connected to the memory and configured to implement an embodiment of the full-link authentication method for quantum computing threats as described above. Embodiments of the full-link authentication method for quantum computing threats have been described in detail above and will not be repeated here.

[0147] This invention also discloses a computer-readable storage medium storing computer instructions that, when executed by a processor, implement an embodiment of the end-to-end authentication method for quantum computing threats as described above. Embodiments of the end-to-end authentication method for quantum computing threats have been described in detail above and will not be repeated here.

[0148] Although the methods described above are illustrated and depicted as a series of actions for the sake of simplicity, it should be understood and appreciated that these methods are not limited by the order of the actions, as some actions may occur in a different order and / or concurrently with other actions from the illustrations and descriptions herein or not illustrated and described herein but which may be understood by those skilled in the art, according to one or more embodiments.

[0149] Those skilled in the art will further appreciate that the various illustrative logic blocks, modules, circuits, and algorithm steps described in conjunction with the embodiments disclosed herein can be implemented as electronic hardware, computer software, or a combination of both. To clearly illustrate this interchangeability between hardware and software, the various illustrative components, blocks, modules, circuits, and steps are described above in a generalized manner in terms of their functionality. Whether such functionality is implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system. Those skilled in the art may implement the described functionality in different ways for each specific application, but such implementation decisions should not be construed as departing from the scope of the invention.

[0150] The various illustrative logic blocks, modules, and circuits described in conjunction with the embodiments disclosed herein can be implemented or performed using a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. The general-purpose processor may be a microprocessor, but in alternatives, it may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors cooperating with a DSP core, or any other such configuration.

[0151] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of both. The software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor such that the processor can read and write information to / from the storage medium. In an alternative, the storage medium may be integrated into the processor. The processor and storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In an alternative, the processor and storage medium may reside as discrete components in the user terminal.

[0152] In one or more exemplary embodiments, the described functionality may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software as a computer program product, the functionality may be stored or transmitted as one or more instructions or code on or through a computer-readable medium. A computer-readable medium includes both computer storage media and communication media, encompassing any medium that facilitates the transfer of a computer program from one location to another. A storage medium may be any available medium accessible to a computer. By way of example and not limitation, such a computer-readable medium may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and is accessible to a computer. Any connection is also legitimately referred to as a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of a medium. As used in this article, disk and disc include compact discs (CDs), laser discs, optical discs, digital multi-purpose discs (DVDs), floppy disks, and Blu-ray discs. Disks typically reproduce data magnetically, while discs reproduce data optically using lasers. Combinations of these should also be included within the scope of computer-readable media.

[0153] The prior description of this disclosure is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to this disclosure will be apparent to those skilled in the art, and the general principles defined herein may be applied to other variations without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not intended to be limited to the examples and designs described herein, but should be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A full-link authentication method for quantum computing threats, characterized in that, The methods include: Step S1: The access party submits access party information to the operator's authentication platform and initiates a pre-number retrieval request; Step S2: Quantum head-resistant enhancement processing for telecom gateways; Step S3: Quantum decryption and verification header enhancement information by the operator authentication platform; Step S4: The operator authentication platform uses quantum decryption and verification to check the access party information; Step S5: The operator authentication platform responds to the number retrieval request and returns the number retrieval information; Step S6: The access party caches the pre-fetched number information; Step S7: Access the software development kit and request the login page; Step S8: The access party displays the pre-selection number information on the login page; Step S9: The access party sends a login request to the access party server carrying the pre-acquisition number information; Step S10: The access party's server uses quantum encryption to encrypt and forward the login information; Step S11: The operator authentication platform decrypts the pre-fetched number information and verifies it. Step S12: The operator authentication platform generates the first login information and returns it to the access party's server in quantum encryption form; Step S13: The access server performs quantum decryption on the first login information and generates the second login information based on the authentication result; Step S14: The access party receives the second login information, confirms the user's login status, and enters the business process.

2. The end-to-end authentication method for quantum computing threats according to claim 1, characterized in that, The access party information includes the application identifier and application key. The access party information is obtained by the access party after registering a developer account on the operator's authentication platform and is used for identity verification, access control and business call authorization.

3. The end-to-end authentication method for quantum computing threats according to claim 1, characterized in that, Step S2 further includes: The first step is that after receiving a request from the access party, the telecom gateway inserts specific quantum-encrypted header enhancement information into the message header before forwarding it to the operator's authentication platform. The quantum encryption method is as follows: M represents head enhancement information, K c For quantum key ciphertext, H x A charging key handle obtained by a telecommunications gateway from a quantum-safe infrastructure; QENC stands for quantum encryption, and C stands for quantum ciphertext; The second step involves enhancing the quantum encryption header information, then concatenating the quantum ciphertext and the session identifier (sessionId) together, and performing a quantum signature: ， QSIGN is a quantum signature algorithm; The third step is to insert the quantum ciphertext C, the session identifier sessionId, and the quantum signature sign into the request header. middle.

4. The end-to-end authentication method for quantum computing threats according to claim 3, characterized in that, Step S3 further includes: The verification header enhancement information is as follows: H y To fill the key handle, K c Quantum key ciphertext; If the above equation is true, the signature verification passes, and the process continues: Where C represents quantum ciphertext and QDEC represents quantum decryption.

5. The end-to-end authentication method for quantum computing threats according to claim 1, characterized in that, The pre-fetched number information includes two fields: access code and de-identified mobile phone number.

6. The end-to-end authentication method for quantum computing threats according to claim 1, characterized in that, The verification methods for the pre-fetched number information in step S11 include: integrity verification, authenticity verification, and timeliness verification; the first login information includes an access token and a mobile phone number, and the second login information is used to guide the access party to complete the subsequent business process.

7. The end-to-end authentication method for quantum computing threats according to claim 1, characterized in that, The method also includes a process for establishing a quantum-resistant secure channel, which further includes: Step 1: Initialization phase; Step 2: Apply for a quantum session key. Before the session begins, the communication initiator calls the software development kit for quantum-resistant passwordless login and applies to the quantum security infrastructure to generate a quantum session key by carrying a token. The quantum security infrastructure returns the key ciphertext, session identifier, and first charging key handle for the session. Step 3: Transmit key identifier; Step 4: Session key query. Based on the received session identifier, the communication receiver calls the session key query interface of the quantum security infrastructure through the software development kit for quantum-safe passwordless login, and initiates a key query request with the token. After the quantum security infrastructure completes the authentication of the communication receiver, it returns the corresponding session key ciphertext and the second filling key handle. Step 5: Secure channel construction. Based on their respective obtained session key ciphertexts and corresponding charging key handles, the two communicating parties complete the parsing and loading of quantum keys in their local secure media, thus completing the construction of a quantum-resistant secure communication channel.

8. A full-link identity authentication system for quantum computing threats, comprising a service module, a security medium, and a software development kit deployed in the communicating party, and a quantum security infrastructure deployed on the operator's authentication platform, wherein, The business module is used to process the business logic of both communicating parties, realize the interaction of business data, and transmit business data between the business modules of different communicating parties. The software development kit (SDK) is used to handle data processing functions. The business modules and the SSD complete the conversion between business data and data to be encrypted / decrypted. Secure medium is used to perform data encryption and decryption operations. The software development kit of the communicating party and the secure medium realize the encryption or decryption of data. The quantum security infrastructure includes a key management system, which manages the quantum session keys of the corresponding communication parties through different key management systems. The quantum key distribution network enables the sharing and synchronization of quantum keys between different key management systems. The software development kits of different communication parties establish connections with the quantum security infrastructure to obtain quantum session keys, which are used for encryption and decryption operations of data by the secure medium. The system also runs a full-link identity authentication method for quantum computing threats as described in any one of claims 1 to 7.

9. A full-link identity authentication system for quantum computing threats, characterized in that, include: Memory; as well as A processor, connected to the memory, and configured to implement a full-link authentication method for quantum computing threats as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing computer instructions thereon, characterized in that, When the computer instructions are executed by the processor, the end-to-end authentication method for quantum computing threats as described in any one of claims 1 to 7 is implemented.

Images