Adaptive post quantum cryptography handshake method based on multi-dimensional cost perception

Abstract

The invention relates to the technical field of network security and communication protocols, and discloses a self-adaptive post quantum cryptography handshake method based on multi-dimensional cost perception. Based on a TLS1.3 protocol, a multi-dimensional cost function containing a non-linear risk penalty factor is constructed, the network state and the equipment computing power are sensed in real time, and an optimal KEM and signature algorithm combination is dynamically negotiated from an NIST standardized PQC algorithm pool. The problems of transmission bottleneck and poor static configuration adaptability caused by a large-size data packet of a PQC algorithm are solved, the balance of anti-quantum security, low delay and high availability is realized, the heterogeneous terminal and a complex network environment are adapted, and the connection robustness is improved.

Description

Technical Field

[0001] This invention relates to the field of network security and communication protocol technology, specifically to an adaptive post-quantum cryptographic handshake method based on multidimensional cost awareness. Background Technology

[0002] Transport layer security (TLS) protocols are the core foundation of modern internet communication security. Their core function is to provide authentication, data confidentiality, and integrity protection for both communicating parties. The current mainstream TLS 1.3 protocol mainly relies on traditional public-key cryptography in the key exchange and authentication process. The security of this type of system is based on the problems of large integer factorization and discrete logarithms. However, with the rapid development of quantum computing technology, especially the introduction of Shor's algorithm, traditional public-key cryptography algorithms face the "quantum threat" of being broken in polynomial time. Once quantum computers reach a practical level, the existing communication security system based on the TLS protocol will face the risk of collapse.

[0003] To address the quantum threat, the National Institute of Standards and Technology (NIST) led the standardization process for post-quantum cryptography, selecting a series of algorithms such as Kyber, Dilithium, Falcon, and SPHINCS+ that are resistant to quantum computer attacks. These algorithms are primarily based on lattice theory or hash functions, providing quantum-resistant solutions for communication security. However, in practical applications, new technical problems have arisen: the public key and signature sizes of post-quantum cryptography algorithms have increased significantly compared to traditional algorithms, causing severe transmission performance bottlenecks in heterogeneous and weak network environments. Specifically, large handshake messages are prone to exceeding the Ethernet MTU limit, leading to a sharp increase in the number of TCP fragments. In networks with high error rates or high latency, this can easily trigger congestion collapse, exponential backoff, and handshake timeout failures, severely reducing connection availability.

[0004] Meanwhile, existing post-TLS quantum migration schemes generally adopt a static algorithm configuration strategy, which ignores the significant differences in computing power among different terminal devices. In real-world applications, communication terminals include both high-performance workstations with powerful computing capabilities and IoT sensors and edge gateways with limited computing resources. Static configuration cannot dynamically adjust algorithm selection based on device performance, resulting in the failure to fully leverage computing advantages on high-performance devices, while forcing the execution of high-complexity algorithms on low-end devices can lead to handshake timeouts. Furthermore, some schemes have not completely eliminated traditional non-quantum-resistant algorithms, posing a risk of downgrade attacks exploited by attackers. Even if traditional algorithms are eliminated, the negotiation mechanism lacks integrity verification, and the system may still be forced to use a combination of algorithms with lower security by forging network states. These problems make it difficult for existing schemes to achieve a balance between "high security," "low latency," and "high availability," severely restricting the large-scale application of post-quantum cryptography in heterogeneous network environments. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides an adaptive post-quantum cryptographic handshake method based on multidimensional cost awareness, which solves the problems mentioned in the background section.

[0006] To achieve the above objectives, this invention provides the following technical solution: a multi-dimensional cost-aware adaptive post-quantum cryptography handshake method, applied between a client and server in a heterogeneous network environment, which implements adaptive negotiation and key exchange of post-quantum cryptography (PQC) based on the TLS 1.3 protocol. The specific steps are as follows:

[0007] S1. The server performs system initialization and algorithm pool construction, integrates NIST-standardized post-quantum cryptography algorithms to build a candidate algorithm pool, eliminates non-quantum-resistant traditional algorithms, and pre-stores core parameters such as public key size, ciphertext size, signature size and average hardware processing time for each algorithm.

[0008] S2. The client sends a list of PQC algorithms it supports and performance scaling factors to the server. The ClientHello message allows the server to obtain network status parameters such as round-trip latency, link bandwidth, and bit error rate in real time through the underlying TCP / IP protocol stack.

[0009] S3, Server-side traversal of candidate algorithm pool ( Algorithm combination ( For the KEM algorithm, (For signature algorithms), the total payload, number of TCP fragments, transmission failure probability, and final total cost of each combination are calculated using a multi-dimensional cost function, and the optimal algorithm combination with the minimum total cost is selected. ;

[0010] S4, Server-side usage Encapsulate the client's public key to generate a shared key and ciphertext, and use... The private key is used to sign the handshake hash containing ClientNonce and ServerNonce, and a response message containing KEM ciphertext, PQC certificate chain and PQC signature is sent to the client.

[0011] S5, after the client receives the message, it uses To obtain the shared key, decapsulate the private key and then... The public key verifies the validity of the signature and certificate chain. Once the verification is successful, both parties send a Finished message to complete the TLS 1.3 handshake and begin encrypted communication.

[0012] Optionally, step S1, which involves server-side system initialization and algorithm pool construction, specifically includes:

[0013] A candidate algorithm pool is constructed, which integrates only NIST-standardized post-quantum cryptographic algorithms, including a key encapsulation mechanism set and a digital signature set. The KEM set includes the Kyber algorithm, and the digital signature set includes the bandwidth-optimized Falcon algorithm and the computationally balanced Dilithium algorithm. Non-quantum-resistant traditional algorithms in the candidate algorithm pool are strictly eliminated. The core parameters of each algorithm in the candidate algorithm pool are pre-stored.

[0014] Optionally, step S2 is the network and device status awareness phase, which specifically includes:

[0015] The client sends a ClientHello message to the server, which contains a list of PQC algorithms supported by the client and a performance scaling factor used to quantify the difference in computing power between the client and a standard processor. The server measures the physical status parameters of the current link in real time through the underlying TCP / IP protocol stack. These physical status parameters include the round-trip time estimated by the TCP three-way handshake time, the link bandwidth estimated by the current throughput, and the bit error rate derived by the signal-to-noise ratio or historical packet loss statistics.

[0016] Optionally, step S3 is the adaptive decision-making and handshake execution phase, where the server calculates the globally optimal algorithm combination through a multi-dimensional cost function, specifically including:

[0017] Iterate through each group in the candidate algorithm pool Algorithm combination; calculate the total load for each algorithm combination. The for ciphertext size, Signature size, certificate chain size and The sum of header overheads, where the certificate chain size is based on Accurate calculation of public key size and certificate chain depth;

[0018] The required number of TCP fragments can be calculated based on the maximum TCP segment length, using the following formula: ;

[0019] Based on bit error rate (BER) and The probability of transmission failure is calculated based on the corresponding number of bits, using the following formula: ;

[0020] Introducing a non-linear risk penalty factor The according to The value range is set in levels, when hour , hour , hour , hour ;

[0021] The basic expected delay is calculated using the following formula: ;

[0022] in Multiply the algorithm's base computation time by the client performance scaling factor. , This is an estimated TCP timeout retransmission time.

[0023] The final total cost is calculated using the following formula: ;

[0024] choose The minimum combination of algorithms is the optimal strategy. ).

[0025] Optionally, the adaptive decision-making and handshake execution phase further includes a handshake execution process: the server uses... Encapsulate the client's public key to generate a shared key and ciphertext; the server uses this. The server uses its private key to sign the handshake hash containing the ClientNonce and ServerNonce, ensuring the certificate chain is bound to the current session. The server sends the client a ServerHello message containing the KEM ciphertext, a Certificate message containing the PQC certificate chain, and a CertificateVerify message containing the PQC signature. Upon receiving the messages, the client uses... The private key is decapsulated to obtain the shared key, which is then used. The public key verifies the legitimacy of the digital signature and certificate chain; after successful verification, both parties send a Finished message to complete the TLS 1.3 handshake and begin encrypted communication.

[0026] Optionally, the candidate algorithm pool supports hot updates. When NIST releases new post-quantum cryptography standard parameters, only the algorithm parameter table pre-stored on the server needs to be updated to achieve the integration and application of the new algorithm without modifying the overall protocol framework. The server is also configured with risk thresholds and preset hierarchical judgment criteria for transmission failure probability, which are used to trigger and calculate nonlinear risk penalty factors.

[0027] Optionally, the client includes a high-performance workstation, an edge gateway, or a resource-constrained IoT sensor. All clients integrate a lightweight PQC algorithm library and support NIST-standardized KEM decapsulation and digital signature verification operations. The server has powerful computing capabilities and is equipped with a network state awareness module, an adaptive decision engine, and a network probe. The network probe is used to obtain link physical state parameters in real time, and the adaptive decision engine is used to perform multi-dimensional cost function calculations and select the optimal algorithm combination.

[0028] Optionally, the certificate chain adopts a two-layer structure, including a server certificate and an intermediate certificate, in calculating the total payload size. When using this protocol, the overhead must include the public keys, signatures, and X.509 metadata of both certificates. The digital signature generated by the server is forcibly bound to ClientNonce and ServerNonce to prevent replay attacks. At the same time, the protocol verifies the binding relationship between the digital signature and the algorithm identifier to defend against downgrade attacks that force the system to downgrade to an insecure algorithm by forging network state.

[0029] Optionally, calculate the transmission failure probability. High-precision floating-point arithmetic is used to ensure accurate differentiation of risk levels corresponding to failure rates in different ranges, especially the difference between 99.0% and 99.9% failure rates, providing data support for the precise application of non-linear risk penalty factors.

[0030] Optionally, the adaptive decision-making and handshake execution phase also includes an exception handling mechanism: if the transmission failure probability of all candidate algorithm combinations is high... If the error rate exceeds 99%, the server refuses to initiate a handshake and records relevant logs to avoid unnecessary TCP retransmissions that consume network and device resources. The exception handling mechanism is linked with the adaptive decision-making logic to ensure the reasonable allocation of system resources in extreme network environments.

[0031] This invention provides an adaptive post-quantum cryptographic handshake method based on multidimensional cost awareness, which has the following beneficial effects:

[0032] Firstly, this invention introduces a nonlinear risk penalty factor. It can keenly sense changes in network error rate and transmission failure probability; when in high error rate environments such as satellite networks or congested wireless networks, this factor will force the system to avoid large-size algorithms and automatically switch to bandwidth-friendly algorithms, greatly improving the handshake success rate in harsh network environments and ensuring stable and reliable communication connections.

[0033] Secondly, the multidimensional cost function constructed in this invention comprehensively integrates network state parameters and device performance parameters, enabling real-time weighing of the advantages and disadvantages of "computation-intensive" and "transmission-intensive" algorithms. Unlike traditional static configuration strategies, this invention requires no manual intervention and can dynamically adjust the algorithm combination based on real-time network and device status. In ideal network environments, it can leverage the advantages of computationally balanced algorithms to reduce processing latency, while in weak network environments, it can reduce transmission loss using bandwidth-optimized algorithms, always minimizing the global latency of the handshake process and significantly improving communication efficiency.

[0034] Secondly, the candidate algorithm pool of this invention is entirely composed of NIST-standardized post-quantum cryptographic algorithms, fundamentally eliminating traditional algorithms such as RSA and ECDHE that are vulnerable to quantum attacks, ensuring that the communication process has quantum-resistant security capabilities. At the same time, through formal verification, it is proven that the adaptive negotiation mechanism of this invention has negotiation integrity. By verifying the binding relationship between digital signatures and algorithm identifiers, it can effectively resist attackers' attempts to force the system to downgrade to an insecure algorithm by forging network states, providing double protection for communication security.

[0035] This invention introduces a device performance scaling factor. It can accurately quantify the differences in computing power between different terminals relative to standard processors and incorporate them into the cost function calculation. Whether it is a high-performance workstation with powerful computing capabilities or an IoT sensor or edge gateway with limited resources, this invention can avoid handshake timeouts caused by forcibly running high-complexity algorithms on low-end devices by dynamically adjusting the algorithm combination, while giving full play to the computing advantages of high-end devices, and achieving comprehensive adaptation of heterogeneous terminals.

[0036] The candidate algorithm pool of this invention supports hot update functionality. When NIST releases new post-quantum cryptography standard parameters, only the algorithm parameter table on the server needs to be updated to integrate the new algorithm without modifying the overall protocol framework, ensuring that the system can keep up with the latest security standards in a timely manner. At the same time, this invention adopts a two-layer certificate chain structure and accurately incorporates certificate chain-related overhead when calculating the transmission payload, taking into account both the compatibility of the PKI system and the accuracy of transmission overhead, further enhancing the practical application value of the method. Attached Figure Description

[0037] Figure 1 A flowchart illustrating the protocol implementation for inventing an adaptive post-quantum cryptographic handshake method based on multidimensional cost awareness. Detailed Implementation

[0038] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0039] Please see Figure 1 This invention provides a technical solution: an adaptive post-quantum cryptographic handshake method based on multidimensional cost awareness, as detailed below:

[0040] Step 1: System hardware and software configuration, client configuration, server configuration, and network environment preparation;

[0041] The client supports various heterogeneous terminal types, including high-performance workstations, edge gateways, and resource-constrained IoT sensors; each client has a pre-configured performance scaling factor. This coefficient is used to inform the server of its own computing power. The value is determined based on the client's hardware performance; the client integrates a lightweight PQC algorithm library, which supports NIST-standardized KEM decapsulation and digital signature verification operations, and can adapt to the client's computing resource constraints, ensuring that necessary cryptographic operations can be completed efficiently even on resource-constrained devices;

[0042] The server boasts powerful computing capabilities and is equipped with a "multi-dimensional cost-aware decision-making module." This module, the core processing unit of the server, is responsible for receiving network status parameters and client device information in real time, performing multi-dimensional cost function calculations, and selecting the optimal PQC algorithm combination. The server stores a full spectrum of post-quantum cryptography algorithm implementations and has built a complete candidate algorithm pool, covering Kyber, Dilithium, Falcon, and SPHINCS+ algorithms with different security levels. Simultaneously, the server is configured with a network probe, enabling network status monitoring. It can obtain physical status parameters such as round-trip latency, bandwidth, and bit error rate of the current link in real time through the underlying TCP / IP protocol stack, providing data support for adaptive decision-making.

[0043] This invention is applicable to heterogeneous network environments, covering a variety of scenarios from high-bandwidth, low-latency fiber optic networks to low-bandwidth, high-error-rate non-terrestrial networks (such as satellite networks), as well as congested wireless networks, heterogeneous IoT networking, etc., and can maintain stable communication performance and security in different network environments.

[0044] Step Two: System Initialization and Algorithm Pool Construction. Configuration is completed during server startup to provide the algorithmic foundation and parameter support for subsequent adaptive decision-making. Specific implementation steps are as follows:

[0045] 1. Construct a candidate algorithm set: The server creates a candidate algorithm list A, which contains all NIST-standardized PQCKEM and Signature algorithm combinations. The KEM algorithm set is based on the Kyber algorithm, and the signature algorithm set includes the bandwidth-optimized Falcon algorithm and the computationally balanced Dilithium algorithm. The SPHINCS+ algorithm can also be included according to actual security requirements.

[0046] 2. Elimination of insecure algorithms: To prevent degradation attacks, the candidate algorithm pool strictly eliminates traditional non-quantum resistant algorithms such as RSA and ECDHE, ensuring that all candidate algorithms have the ability to resist quantum computing attacks, thus guaranteeing communication security from the root.

[0047] 3. Pre-set algorithm parameter table: The server loads and stores the core parameters of each algorithm, including public key size, signature size, ciphertext size, and parameters on the benchmark hardware (…). Average processing time on The above parameters provide the basic data for subsequent total load calculation and processing time estimation;

[0048] 4. Configure risk thresholds: The server presets tiered thresholds for non-linear risk penalty factors to clearly define the probability of transmission failure. The interval division criteria, namely , , , The four intervals correspond to The penalty coefficient provides a clear basis for risk assessment;

[0049] Step 3: Network and Device Status Awareness. When a client initiates a connection request, it enters the network and device status awareness phase. This phase collects necessary contextual information for adaptive decision-making. The specific implementation steps are as follows:

[0050] 1. Handshake Initiation: The client sends a ClientHello message to the server. This message contains a random number generated by the client, a list of PQC algorithms supported by the client, and its own performance scaling factor in the extended fields. This informs the server of the current limitations on computing resources, allowing the server to adjust its algorithm selection strategy accordingly.

[0051] 2. Network Status Detection: The server obtains the physical status parameters of the current connection link in real time through the underlying TCP / IP protocol stack and network probes. Among them, the round-trip time is estimated by the time difference of the TCP three-way handshake to ensure the real-time performance and accuracy of the data; the link bandwidth is dynamically estimated by the actual throughput of the current network to reflect the data transmission capacity of the link; the bit error rate is derived by the link signal-to-noise ratio or historical packet loss statistics to quantify the probability of bit errors at the physical layer and provide support for the calculation of the transmission failure probability.

[0052] Step 4: Adaptive Decision Making and Handshake Execution. The server calculates the globally optimal algorithm combination through a multi-dimensional cost function and completes the TLS 1.3 handshake process. The specific implementation steps are as follows:

[0053] 1. Traversal and Parameter Calculation: After receiving the ClientHello message and network status parameters, the server traverses each (K,S) algorithm combination in the candidate algorithm pool A and performs the following parameter calculations:

[0054] (1) Calculation of total load size: Calculate the total load size of each algorithm combination according to the following formula; ;

[0055] The certificate chain size is determined by the signature algorithm. The public key size and depth of the two-level certificate chain are accurately calculated, including the public keys, signatures, and X.509 metadata overhead of both levels of certificates. Fixed overhead for the TLS protocol header;

[0056] (2) TCP fragmentation calculation: Based on the maximum TCP segment size (MSS, default 1460 bytes), the number of fragments is calculated using the formula. Calculate the required number of TCP fragments and quantify the impact of large data packets on transmission;

[0057] (3) Calculation of transmission failure probability: High-precision floating-point arithmetic is used, according to the formula Calculate the probability of transmission failure for the entire handshake data stream, where Converting bytes to bits ensures that the calculation results can accurately distinguish the differences between different failure rate ranges, providing precise data for the application of risk penalty factors;

[0058] 2. Cost function evaluation: The server calculates the total cost for each algorithm combination using a multi-dimensional cost function, specifically including:

[0059] (1) Calculation of basic expected delay: According to the formula Calculate the basic expected delay; where, The base processing time of the algorithm Multiply by the client performance scaling factor ,Right now This is used to quantify the processing time of the algorithm on different devices; This is an estimated value for TCP Timeout Retransmission Time (RTO), reflecting the retransmission overhead after a transmission failure;

[0060] (2) Nonlinear risk penalty: based on the transmission failure probability The value of is used to determine the corresponding nonlinear risk penalty factor. And through the formula Calculate the final total cost for each algorithm combination;

[0061] (3) Optimal strategy selection: The server compares the final total cost of all algorithm combinations. ,choose The smallest combination of algorithms is taken as the optimal strategy for this session. For example, in weak network environments such as satellite networks, the system will automatically avoid the large-size Dilithium algorithm and choose a combination of Kyber-512 and Falcon-512 to minimize the number of TCP fragments; in ideal fiber optic network environments, the faster Dilithium algorithm will be selected to give full play to the computing advantages of the equipment.

[0062] 3. Response and Authentication: After determining the optimal algorithm combination, the server sends a response message to the client and completes authentication. The specific steps are as follows:

[0063] (1) Key encapsulation and signature generation: The server uses the selected key... The algorithm encapsulates the client's public key to generate a shared key and ciphertext; simultaneously, it uses... The algorithm's private key signs the handshake record, and the signature must include ClientNonce and ServerNonce to ensure that the signature is bound to the current session and prevent replay attacks.

[0064] (2) Message sending: The server constructs a ServerHello message (carrying KEM ciphertext), a Certificate message (carrying PQC two-layer certificate chain) and a CertificateVerify message (carrying PQC signature), packages the three types of messages and sends them to the client.

[0065] 4. Verification and key confirmation: After receiving the message from the server, the client performs the following operations to complete the handshake:

[0066] (1) Key decapsulation: The client uses the corresponding key according to the negotiation result. The private key is used to decrypt the KEM ciphertext to obtain the shared key;

[0067] (2) Signature and certificate verification: Client uses The public key verifies the digital signature in the CertificateVerify message and also checks the legitimacy of the PQC certificate chain in the Certificate message to ensure the server's identity is authentic and reliable.

[0068] (3) Handshake complete: After successful verification, the client sends a Finished message to the server, and the server also sends a Finished message after receiving it. The two parties complete the TLS 1.3 handshake process, and then begin encrypted communication based on the negotiated shared key;

[0069] Step 5: Certificate Chain and Parameter Management, as detailed below:

[0070] 1. Certificate Chain Management: This invention uses a two-layer certificate structure (server certificate + intermediate certificate) by default when calculating the total payload size. At the same time, the relevant overhead of the two-level certificates is accurately incorporated to ensure the accuracy of the transmission payload calculation, while being compatible with the existing PKI system and improving the practicality of the method;

[0071] 2. Algorithm Update: The system supports hot updates of the candidate algorithm pool. When NIST releases new post-quantum cryptography standard parameters or algorithms, only the algorithm parameter table and candidate algorithm set on the server need to be updated. The core protocol logic of the client and server does not need to be modified, which can realize the rapid integration and application of the new algorithm and ensure that the system can keep up with the latest security standards in a timely manner.

[0072] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. An adaptive post-quantum cryptographic handshake method based on multidimensional cost awareness, characterized in that, The specific steps include the following: S1. The server executes system initialization and algorithm pool construction, integrates NIST-standardized post-quantum cryptography algorithms to build a candidate algorithm pool, eliminates non-quantum-resistant traditional algorithms, and pre-stores the parameters of each algorithm. S2. The client sends a list of PQC algorithms it supports and performance scaling factors to the server. The ClientHello message allows the server to obtain the network status parameters of the current link in real time through the underlying TCP / IP protocol stack. S3, Server-side traversal of candidate algorithm pool ( Algorithm combinations are used to calculate the total payload, number of TCP fragments, transmission failure probability, and final total cost for each combination through a multi-dimensional cost function, and the optimal algorithm combination with the minimum total cost is selected. ; S4, Server-side usage Encapsulate the client's public key to generate a shared key and ciphertext, and use... The private key is used to sign the handshake hash containing ClientNonce and ServerNonce, and a response message containing KEM ciphertext, PQC certificate chain and PQC signature is sent to the client. S5, after the client receives the message, it uses To obtain the shared key, decapsulate the private key and then... The public key verifies the validity of the signature and certificate chain. Once the verification is successful, both parties send a Finished message to complete the TLS 1.3 handshake and begin encrypted communication.

2. The adaptive post-quantum cryptographic handshake method based on multidimensional cost awareness according to claim 1, characterized in that, Step S1, which involves server-side system initialization and algorithm pool construction, specifically includes: A candidate algorithm pool is constructed, which integrates only NIST-standardized post-quantum cryptographic algorithms, including a key encapsulation mechanism set and a digital signature set. The KEM set includes the Kyber algorithm, and the digital signature set includes the bandwidth-optimized Falcon algorithm and the computationally balanced Dilithium algorithm. Non-quantum-resistant traditional algorithms in the candidate algorithm pool are strictly eliminated. The core parameters of each algorithm in the candidate algorithm pool are pre-stored.

3. The adaptive post-quantum cryptographic handshake method based on multidimensional cost awareness according to claim 1, characterized in that, Step S2 is the network and device status awareness phase, which specifically includes: The client sends a ClientHello message to the server, which contains a list of PQC algorithms supported by the client and a performance scaling factor used to quantify the difference in computing power between the client and a standard processor. The server measures the physical status parameters of the current link in real time through the underlying TCP / IP protocol stack. These physical status parameters include the round-trip time estimated by the TCP three-way handshake time, the link bandwidth estimated by the current throughput, and the bit error rate derived by the signal-to-noise ratio or historical packet loss statistics.

4. The adaptive post-quantum cryptographic handshake method based on multidimensional cost awareness according to claim 1, characterized in that, Step S3 is the adaptive decision-making and handshake execution phase. The server calculates the globally optimal algorithm combination through a multi-dimensional cost function, specifically including: Iterate through each group in the candidate algorithm pool Algorithm combination; calculate the total load for each algorithm combination. The for ciphertext size, Signature size, certificate chain size and The sum of header overheads, where the certificate chain size is based on Accurate calculation of public key size and certificate chain depth; The required number of TCP fragments can be calculated based on the maximum TCP segment length, using the following formula: ； Based on bit error rate (BER) and The probability of transmission failure is calculated based on the corresponding number of bits, using the following formula: ； Introducing a non-linear risk penalty factor The according to The value range is set in levels, when hour , hour , hour , hour ; The basic expected delay is calculated using the following formula: ； in Multiply the algorithm's base computation time by the client performance scaling factor. , This is an estimated TCP timeout retransmission time. The final total cost is calculated using the following formula: ； choose The minimum combination of algorithms is the optimal strategy. ).

5. The adaptive post-quantum cryptographic handshake method based on multidimensional cost awareness according to claim 4, characterized in that, The adaptive decision-making and handshake execution phase also includes a handshake execution process: server-side use Encapsulate the client's public key to generate a shared key and ciphertext; the server uses this. The private key is used to sign the handshake hash containing ClientNonce and ServerNonce to ensure that the certificate chain is bound to the current session; The server sends a ServerHello message containing KEM ciphertext, a Certificate message containing the PQC certificate chain, and a CertificateVerify message containing the PQC signature to the client. After the client receives the message, it uses The private key is decapsulated to obtain the shared key, which is then used. Public keys verify the legitimacy of digital signatures and certificate chains; After successful verification, both parties send a Finished message to complete the TLS 1.3 handshake and begin encrypted communication.

6. The adaptive post-quantum cryptographic handshake method based on multidimensional cost awareness according to claim 2, characterized in that, The candidate algorithm pool supports hot updates. When NIST releases new post-quantum cryptography standard parameters, only the algorithm parameter table pre-stored on the server needs to be updated to achieve the integration and application of the new algorithm without modifying the overall protocol framework. The server is also configured with risk thresholds and preset hierarchical judgment criteria for transmission failure probability, which are used for triggering and calculating nonlinear risk penalty factors.

7. The adaptive post-quantum cryptographic handshake method based on multidimensional cost awareness according to claim 1, characterized in that, The clients include high-performance workstations, edge gateways, or resource-constrained IoT sensors. All clients integrate a lightweight PQC algorithm library, supporting NIST-standardized KEM decapsulation and digital signature verification operations. The server has powerful computing capabilities and is equipped with a network state awareness module, an adaptive decision engine, and a network probe. The network probe is used to acquire link physical state parameters in real time, and the adaptive decision engine is used to perform multi-dimensional cost function calculations and select the optimal algorithm combination.

8. The adaptive post-quantum cryptographic handshake method based on multidimensional cost awareness according to claim 5, characterized in that, The certificate chain adopts a two-layer structure, including server certificates and intermediate certificates, in calculating the total payload size. When using this protocol, the overhead must include the public keys, signatures, and X.509 metadata of both certificates. The digital signature generated by the server is forcibly bound to ClientNonce and ServerNonce to prevent replay attacks. At the same time, the protocol verifies the binding relationship between the digital signature and the algorithm identifier to defend against downgrade attacks that force the system to downgrade to an insecure algorithm by forging network state.

9. The adaptive post-quantum cryptographic handshake method based on multidimensional cost awareness according to claim 4, characterized in that, Calculate the probability of transmission failure High-precision floating-point arithmetic is used to ensure accurate differentiation of the risk level corresponding to the failure rate in different ranges.

10. The adaptive post-quantum cryptographic handshake method based on multidimensional cost awareness according to claim 4, characterized in that, The adaptive decision-making and handshake execution phase also includes an exception handling mechanism: if the transmission failure probability of all candidate algorithm combinations is high... If the failure rate exceeds 99%, the server will refuse to initiate a handshake and record relevant logs. The exception handling mechanism is linked with the adaptive decision-making logic to ensure the reasonable allocation of system resources in extreme network environments.

Images