Quantum random number-based computing power network identity authentication and permission management method and device

Abstract

The application belongs to the field of information security, and relates to a computing power network identity authentication and permission control method and device based on quantum random numbers, which comprises the following steps: system initialization and quantum key pre-distribution, providing quantum random numbers, quantum identity identification and password resource pool for the computing power network; generating a globally unique quantum identity identification for each access subject and establishing a trusted identity database; realizing two-way peer authentication by using pre-distributed quantum entangled pairs and quantum identity identification; after authentication, dynamically allocating temporary quantum session keys and computing power access permissions based on multi-dimensional situation parameters; allowing operations such as computing power calling, encrypted reading and writing, key management, state monitoring and audit log, and performing anti-quantum signature, hash chain evidence storage and zero-knowledge proof on the full-quantity log; automatically recycling permissions, canceling temporary keys and updating key cache pools when the business is completed or abnormal. Quantum-level security, dynamic fine-grained permissions, trusted compliance audit, high concurrency and good compatibility are realized.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method and apparatus for network identity authentication and access control based on quantum random numbers. Background Technology

[0002] As a new type of digital infrastructure, computing power networks integrate distributed computing power, edge computing power, and cloud cluster computing power to achieve unified scheduling, sharing, and reuse of computing resources. They are widely used in fields such as government big data, industrial simulation, financial computing, and artificial intelligence training. Computing power networks are characterized by multiple nodes, cross-regional operations, heterogeneous access from multiple terminals, dynamic and varied tasks, and significant differences in data confidentiality levels, placing extremely high demands on identity credibility, granular access control, operational traceability, and resistance to quantum attacks.

[0003] Current traditional computing power network security systems are generally based on PKI public key systems, pseudo-random number generation algorithms, and static permission policies for security protection. Traditional computing power network security architectures suffer from poor security, low flexibility, weak auditability, and lack of resistance to quantum attacks, failing to meet the security operation requirements of next-generation computing power networks that are large-scale, confidential, and trustworthy. Therefore, there is an urgent need to design a computing power network identity authentication and permission control scheme based on the native security characteristics of quantum mechanics. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a method for identity authentication and access control in computing power networks based on quantum random numbers, employing the following technical solution, including the following steps: System initialization and quantum key pre-distribution provide quantum random numbers, quantum identity identifiers, and cryptographic resource pools as the underlying security foundation for the entire computing power network; Generate a globally unique quantum identity for each access entity and establish a trusted identity database; Using pre-distributed quantum entangled pairs and the quantum identity identifier, two-way peer authentication between the access subject and the service node is completed; After two-way peer authentication is successful, temporary quantum session keys and computing power access permissions are dynamically allocated based on real-time collected multi-dimensional situational parameters. Under the temporary quantum session key and the computing power access permission, perform any one or more of the following business operations: calling computing power node computing tasks, reading and writing encrypted data, key and permission management operations, system status monitoring, generating audit logs, and performing quantum-resistant signatures, hash chain evidence storage and zero-knowledge proofs on the full operation logs; The system automatically revoks permissions, cancels temporary quantum session keys, and updates the key cache pool after business operations are completed or when an anomaly occurs, forming a secure closed loop.

[0005] Preferably, the steps of system initialization and quantum key pre-distribution, which provide quantum random numbers, quantum identity identifiers, and cryptographic resource pools as the underlying security foundation for the entire computing power network, specifically include: For the core nodes, mid-range clusters and edge terminals of the computing power network, a hybrid type of quantum random number generator is deployed in layers, and a quantum entropy pool is initialized. Quantum identity identifiers are pre-distributed to all network nodes through a quantum key distribution protocol, and key fragmentation initialization is completed using a distributed key generation mechanism. User secret fragments and authorized institution secret fragments are combined into user private keys using bitwise XOR operations. The access policy is encoded as a Bloom filter in the form of short tokens, and an initial version number is assigned to each attribute.

[0006] Preferably, the step of generating a globally unique quantum identity for each access subject and establishing a trusted identity database specifically includes: Based on the true random number generated by the quantum entropy pool, combined with the hash value of the device hardware fingerprint and the timestamp, a unique quantum identity identifier for the access subject is generated through the quantum random number hash function; The quantum identity identifier is bound to the attribute set of the access subject and stored in a distributed trusted identity database that has undergone post-quantum encryption; Initialize a version vector for each attribute and generate a corresponding key update key based on the on-ring error learning problem.

[0007] Preferably, the step of completing the two-way peer authentication between the access subject and the service node using the pre-distributed quantum entangled pairs and the quantum identity identifier specifically includes: The server prepares an Einstein-Podolsky-Rosen entangled pair, retains one photon, and sends the other photon to the client. Both parties independently and randomly select measurement basis sets for measurement. Both parties publicly disclose their respective base group selections through a classical channel, filter events that match the base group, calculate the CHSH correlation value, and compare it with the theoretical threshold to determine whether there is eavesdropping or man-in-the-middle attack on the channel. After removing the measurement results used for CHSH verification, the remaining measurement results of the matching basis set are used to generate a one-time session key after privacy amplification and error correction.

[0008] Preferably, the step of dynamically allocating temporary quantum session keys and computing power access permissions based on real-time collected multi-dimensional situational parameters after successful two-way peer authentication specifically includes: Collect risk indicators such as identity level, device trust status, network attack frequency, geographical location, and spatiotemporal dimension, and calculate a comprehensive risk score through the spatiotemporal entropy risk assessment algorithm; By combining the comprehensive risk score with the user attribute set, calling the attribute version vector-based lattice-based revocable encryption algorithm, dynamically binding the temporary quantum session key with computing power access permissions, and generating the user's private key; Based on the comprehensive risk score, the validity period of the temporary quantum session key is dynamically adjusted using an exponential decay function; the higher the risk, the shorter the validity period.

[0009] Preferably, the step of performing one or more of the following business operations under the temporary quantum session key and the computing power access permission: computing power node computing task invocation, encrypted data read / write access, key and permission management operations, system status monitoring, audit log generation, and performing quantum-resistant signature, hash chain notarization, and zero-knowledge proof on the full operation log specifically includes: Real-time capture of computing node task calls, encrypted data read / write access, key and permission management operations, system status monitoring and audit log generation business operations, generating structured logs, and signing the logs using a post-quantum signature algorithm; Log entries are linked sequentially to form a quantum hash chain, and a proof is generated based on zero-knowledge proof technology to verify that the log has not been tampered with and that the generation time meets the requirements, without revealing the specific content of the log; The root hash and zero-knowledge proof of the entire hash chain are stored on the chain for evidence preservation, and the original log is stored in a distributed file system after being subjected to post-quantum encryption.

[0010] Preferably, the steps of automatically revoking permissions, canceling temporary quantum session keys, and updating the key cache pool to form a security closed loop after the business operation is completed or an anomaly occurs specifically include: After the business operation is completed, the computing power access permission is automatically revoked and the temporary quantum session key is cancelled. Incremental revocation is achieved by incrementing the attribute version by one. When the comprehensive risk score exceeds the preset threshold or an anomaly is detected in the channel, the access subject's permissions will be forcibly frozen, the temporary quantum session key will be destroyed, and the anomaly audit log will be retained for traceability. Maintain a key cache pool, calculate cache weights by comprehensively considering the most recent access time and access frequency of keys, evict infrequently used keys according to their weights, and retain frequently used active keys to reduce authentication latency.

[0011] To address the aforementioned technical problems, this invention also provides a computing power network identity authentication and access control device based on quantum random numbers, employing the following technical solution, including: The pre-distribution module is used for system initialization and quantum key pre-distribution, providing quantum random numbers, quantum identity identifiers and cryptographic resource pools as the underlying security foundation for the entire computing power network; The generation module is used to generate a globally unique quantum identity for each access subject and establish a trusted identity database; The authentication module is used to complete two-way peer authentication between the access subject and the service node using the pre-distributed quantum entangled pairs and the quantum identity identifier; The allocation module is used to dynamically allocate temporary quantum session keys and computing power access permissions based on real-time collected multi-dimensional situational parameters after two-way peer authentication is successful. The execution module is used to perform one or more of the following business operations under the temporary quantum session key and the computing power access permissions: computing power node computing task invocation, encrypted data read and write access, key and permission management operations, system status monitoring, audit log generation, and quantum-resistant signature, hash chain notarization and zero-knowledge proof on the full operation log; The recycling module is used to automatically reclaim permissions, cancel temporary quantum session keys, and update the key cache pool after business operations are completed or when an anomaly occurs, forming a security closed loop.

[0012] To address the aforementioned technical problems, the present invention also provides a computer device that employs the technical solution described below, comprising a memory and a processor. The memory stores computer-readable instructions, and the processor, when executing the computer-readable instructions, implements the steps of the aforementioned quantum random number-based computing power network identity authentication and access control method.

[0013] To address the aforementioned technical problems, the present invention also provides a computer-readable storage medium, which employs the technical solution described below. The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the aforementioned quantum random number-based computing power network identity authentication and access control method.

[0014] Compared with the prior art, the present invention has the following main advantages: (1) Security leaps to the quantum level: By using quantum random numbers as the entropy source and EPR entanglement pairs and CHSH Bell's inequality to achieve two-way authentication at the physical layer, identity forgery and man-in-the-middle attacks are eliminated from the root, achieving unconditional security based on information theory.

[0015] (2) Dynamic and refined access control: By introducing multi-dimensional situational awareness and comprehensive risk scoring, the validity period of temporary quantum session keys and computing power access permissions are adaptively adjusted to achieve an intelligent balance between high-risk compression of permissions and low-risk maintenance of efficiency.

[0016] (3) Trustworthy and compliant audit system: By integrating post-quantum signature, quantum hash chain and zero-knowledge proof, the operation log is made immutable, traceable and privacy controllable, which meets the requirements of government and enterprise confidentiality compliance audit.

[0017] (4) High concurrency and good compatibility: The authentication latency is controlled within 200μs through LRU key caching optimization and lightweight protocol; the layered decoupled architecture does not require reconstruction of the existing system and is suitable for large-scale commercial deployment. Attached Figure Description

[0018] To more clearly illustrate the solutions in this invention, the accompanying drawings used in the description of the embodiments of this invention will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 This is a flowchart of an embodiment of the computing power network identity authentication and access control method based on quantum random numbers of the present invention; Figure 2 This is an exemplary system architecture diagram in which the present invention can be applied; Figure 3 This is an exemplary three-layer decoupled system architecture diagram in which the present invention can be applied; Figure 4 This is a flowchart of the overall business process of computing power network identity authentication and access control used in the computing power network identity authentication and access control method based on quantum random numbers in this invention; Figure 5 This is a schematic diagram of the quantum two-way authentication and channel verification algorithm mechanism used in the quantum random number-based computing power network identity authentication and access control method of the present invention; Figure 6 This is a schematic diagram of an edge distributed computing power access scenario (high-concurrency lightweight mode) using the quantum random number-based computing power network identity authentication and access control method of the present invention; Figure 7 This is a schematic diagram of an embodiment of the computing power network identity authentication and access control device based on quantum random numbers of the present invention; Figure 8 This is a schematic diagram of the structure of one embodiment of the computer device of the present invention. Detailed Implementation

[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains; the terminology used herein in the specification is for the purpose of describing particular embodiments only and is not intended to limit the invention; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings are used to distinguish different objects and not to describe a particular order.

[0021] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0022] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0023] It should be noted that the quantum random number-based computing power network identity authentication and access control method provided in the embodiments of the present invention is generally executed by the server / terminal device, and correspondingly, the quantum random number-based computing power network identity authentication and access control device is generally set in the server / terminal device.

[0024] It should be understood that the number of terminal devices, networks, and servers is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be used.

[0025] Example 1 Please refer to Figure 1 The diagram illustrates a flowchart of an embodiment of the quantum random number-based computing power network identity authentication and access control method of the present invention. The quantum random number-based computing power network identity authentication and access control method includes the following steps: Step S1 involves system initialization and quantum key pre-distribution, providing quantum random numbers, quantum identity identifiers, and cryptographic resource pools as the underlying security foundation for the entire computing power network.

[0026] In this embodiment, the electronic device (e.g., a server / terminal device) on which the quantum random number-based computing power network identity authentication and access control method runs can receive quantum random number-based computing power network identity authentication and access control requests via wired or wireless connection. It should be noted that the aforementioned wireless connection methods may include, but are not limited to, 3G / 4G / 5G connections, WiFi connections, Bluetooth connections, WiMAX connections, Zigbee connections, UWB (ultrawideband) connections, and other currently known or future-developed wireless connection methods.

[0027] In this embodiment, step S1 may specifically include the following steps: S11 deploys hybrid types of quantum random number generators in a layered manner for the core nodes, mid-range clusters, and edge terminals of the computing power network, and initializes the quantum entropy pool.

[0028] Core node: Deploy device-independent QRNG (DI-QRNG), based on the principle of vacuum fluctuations and Bell's inequality detection, to eliminate device vulnerabilities, achieve the highest security level, and serve as the entropy root of the entire network.

[0029] Mid-range computing power cluster: Deploy source-independent QRNG (SI-QRNG) to balance security performance and hardware cost, while connecting to the quantum entropy pool of the core node to dynamically obtain quantum entropy replenishment.

[0030] Massive edge terminals: Deploy integrated silicon photonic quantum random number generation chips, adopt quantum seed and high-speed stream cryptography architecture, periodically obtain quantum seeds from core nodes, and combine them with the ChaCha20 stream cryptography algorithm to generate high-throughput quantum-derived random numbers.

[0031] Entropy health monitoring: Based on the NIST SP 800-90B standard, the generation quality and stock of quantum entropy are monitored in real time, and the backup entropy source is automatically triggered when entropy depletion or deviation is detected.

[0032] The formula for determining entropy health is: .

[0033] in: :random variable Information entropy, measured in bits, measures the randomness quality of a quantum entropy source. The higher the entropy value, the stronger the randomness. The sequence of random variables output by the quantum entropy source represents a single observation result. : No. Output values The probability of occurrence satisfies . The first quantum entropy source Possible output values ​​(e.g., a certain value of an 8-bit byte). The total number of possible output values ​​(e.g., for an 8-bit byte). ). Logarithmic function with base 2 is used to represent information in bits.

[0034] The entropy health determination formula is used to quantify the unpredictability of quantum entropy sources. When near When the entropy source is of good quality, it is in good condition; if it is significantly low, there is a risk of entropy depletion. The system will automatically switch the entropy source to ensure the long-term validity of the random numbers.

[0035] The purpose of step S11 is to deploy four types of quantum random number generation modules in a differentiated manner according to the different security levels and performance requirements of the core nodes, mid-range clusters and edge terminals of the computing power network, and to build an entropy federation system to solve the contradiction between the supply and demand of quantum true random numbers on massive edge devices and their high cost.

[0036] S12 pre-distributes quantum identity identifiers to all network nodes through a quantum key distribution protocol, and uses a distributed key generation mechanism to complete key fragment initialization. It then uses bitwise XOR operations to combine the user's secret fragment with the authorized institution's secret fragment into the user's private key.

[0037] The certification center distributes quantum identity identifiers (Q-IDs) to each computing node and terminal device through the QKD protocol (such as BB84). The Q-ID structure is [region code][device type][time stamp][DI-QRNG true random fingerprint].

[0038] A distributed key generation (DKG) mechanism is used: the user's private key. User-secret sharding and attribute licensing agency segmentation Synthesized via secure multi-party computation (MPC).

[0039] The key fragmentation and synthesis formula is: .

[0040] in: The final generated user private key is a binary string. : User-generated local secret fragment, binary length and same. : Secret fragments generated by the authorized agency, binary length and same. The bitwise XOR operation is used to securely synthesize private keys. The XOR operation satisfies: , , , .

[0041] The key fragmentation synthesis formula ensures that no single entity can recover the complete private key on its own. Even if a fragment is leaked, attackers cannot forge user identities, greatly improving the security of key management.

[0042] The purpose of step S12 is to pre-distribute globally unique quantum identity identifiers to all network nodes through the quantum key distribution protocol, and to complete key fragmentation initialization using a distributed key generation mechanism to prevent single-point key leakage from causing the entire network to crash.

[0043] S13 encodes the access policy into a Bloom filter in the form of short tokens and assigns an initial version number to each attribute.

[0044] Policy tokenization: Encode access policies (such as "Job Level=Manager&Task=Finance&Time=Workday") into short tokens in the form of a Bloom filter.

[0045] Bloom filter existence verification: .

[0046] in: : Length is A Bloom filter token of 1 bit is used to quickly determine whether the policy matches. : No. The mapping results of each hash function to the policy string are output as follows: A bit position within the range. The logical AND operation sets all bits in each hash result to 1. : The length of the bit array of the Bloom filter (e.g., 1024 bits). The number of hash functions (e.g., 3). : Strategy string, for example, "role =manager&task = financial&time = workday".

[0047] Attribute version vector: for each attribute Assign version number Initialized to 1, representing .

[0048] Policy tokenization transforms complex policy matching into constant-time bitwise lookups, avoiding expensive attribute base decryption operations on every access and improving permission scheduling efficiency; version vector mechanism paves the way for future... This provides a foundation for complex permission revocation.

[0049] The purpose of step S13 is to encode the access policy into a short token to simplify the permission matching process; and to assign an initial version number to each attribute to lay the foundation for efficient permission revocation in the future.

[0050] The purpose of step S1 is to build a quantum security foundation for the entire computing power network, deploy differentiated quantum random number generation modules, establish a quantum entropy pool management system, pre-distribute globally unique quantum identity identifiers and key fragments, and ensure the true randomness, unpredictability and resistance to quantum attacks of the underlying cryptographic resources.

[0051] Step S2: Generate a globally unique quantum identity for each access subject and establish a trusted identity database.

[0052] In this embodiment, step S2 may specifically include the following steps: S21, based on the true random number generated by the quantum entropy pool, combined with the hash value of the device hardware fingerprint and the timestamp, generates a unique quantum identity identifier for the access subject through the quantum random number hash function.

[0053] Access entities initiate registration requests through the standardized SDK or the Quantum Security Proxy (QSP).

[0054] The system extracts 256-bit truly random numbers from the quantum entropy pool. Combined with device hardware fingerprint and timestamp Generate Q-ID.

[0055] The formula for generating quantum identity identifiers is: .

[0056] in: Quantum identity identifier, 256 bits (32 bytes) in length. A hash function based on quantum random numbers, using the SHA-3 algorithm, but with the seed strictly derived from QRNG, to enhance collision resistance. : A 256-bit true random number extracted from the quantum entropy pool and generated by QRNG. The hash value of the device hardware fingerprint, which includes MAC address, TPM metric, etc. : Original data of device hardware fingerprint (e.g., "AA:BB:CC:DD:EE:FF"). : A high-precision timestamp (nanosecond level) during registration, such as 2026-05-10T12:34:56.123456789Z. : The string concatenation operator, which joins the two binary strings from the beginning and end.

[0057] The quantum identity generation formula ensures that Q-ID simultaneously contains physical true randomness, device uniqueness, and time uniqueness. Even if an attacker intercepts the device fingerprint, they cannot predict the quantum random number part, thus preventing identity forgery.

[0058] The purpose of step S21 is to generate a unique quantum identity for the access subject based on the true random number generated by the quantum entropy pool, replacing the traditional pseudo-random ID and completely eliminating predictability.

[0059] S22 binds the quantum identity identifier to the attribute set of the access subject and stores it in a distributed trusted identity database that has undergone post-quantum encryption.

[0060] The Q-ID is associated with the attribute set Attr_Set = {role, department, security level, device type} of the access subject and stored in a distributed trusted database.

[0061] Each record has the structure (Q-ID, Attr_Set, registration time, status), where the status includes: active, frozen, and deregistered.

[0062] The database is stored using post-quantum encryption (CRYSTALS-Kyber) to prevent it from being cracked by quantum attacks after data leakage.

[0063] It enables unified management of identity and attributes, providing a trusted data source for subsequent authentication and permission allocation; encrypted storage ensures that plaintext identity information cannot be recovered even after the database is compromised.

[0064] The purpose of step S22 is to bind and store the generated quantum identity identifier with the subject attributes (user identity, node type, security level, etc.) to build a unified and trusted identity database for the entire network.

[0065] S23, initialize a version vector for each attribute, and generate the corresponding key update key based on the on-ring error learning problem.

[0066] For each attribute initial version Generate key Update key , stored in the authorization center.

[0067] KUK generation is based on the Ring-LWE (Learning on the Ring with Error) problem.

[0068] The key generation formula for key update is: .

[0069] in: :property In version The key is updated to an element in the polynomial ring. Key update and key generation functions. The Master Secret Key is a system-level secret polynomial. : Attribute name (string), such as "department". : The version number of the attribute (positive integer), initially 1. : Random polynomial coefficients, from the ring of integers Select evenly from the middle. Secret polynomial, master key Part of it. Gaussian error polynomial, whose coefficients follow a discrete Gaussian distribution, is used to introduce noise to ensure the hardness of the lattice base. Polynomial multiplication (in rings) superior). Polynomial addition (in rings) superior).

[0070] The key update and key generation formula is based on the one-wayness of the Ring-LWE problem, meaning that even if an attacker gains access to the key... It is also impossible to deduce Alternatively, a KUK with other attributes; simultaneously, the versioning mechanism ensures that when permissions are revoked, only the KUK needs to be updated, without re-encrypting the ciphertext, thus reducing computational complexity from... Down to .

[0071] The purpose of step S23 is to generate a key update key (KUK) for each version of each attribute, enabling incremental updates when permissions change and avoiding global re-encryption.

[0072] The purpose of step S2 is to generate a globally unique, unpredictable, and unreplicable quantum identity for each computing node, user terminal, and edge device, bind the device fingerprint and user information, and enter it into a trusted identity database to prevent false identity registration from the source.

[0073] Step S3: Using the pre-distributed quantum entangled pairs and quantum identity tokens, complete the two-way peer authentication between the access subject and the service node.

[0074] In this embodiment, step S3 may specifically include the following steps: S31, the server prepares an Einstein-Podolsky-Rosen entangled pair, retains one photon and sends the other photon to the client, and both parties independently and randomly select measurement basis sets for measurement.

[0075] server Preparation of EPR entangled pairs Preserving photons Photons Send to the client .

[0076] Both parties independently and randomly select measurement basis sets: Z basis ( ) or X-based ( ).

[0077] Measurement results: get , get .

[0078] The EPR entangled state formula is: .

[0079] in: One of the Bell states, representing two photons in a maximally entangled state, is the standard form of an EPR entangled pair. : Normalization factor, ensuring that the sum of squares of the total probability amplitudes of the quantum states is 1. The first photon's Z-based "0" state (e.g., horizontal polarization). The second photon's Z-based "0" state. The first photon's Z-based "1" state (e.g., vertical polarization). : The Z-based "1" state of the second photon. (Subscript) Distinguish between two entangled photons.

[0080] The nonlocality of EPR entangled states ensures that a measurement of one photon will instantaneously affect the state of the other photon, and any attempt by a middleman to eavesdrop will break the entanglement and thus be detected.

[0081] The purpose of step S31 is to share the Einstein-Podolsky-Rosen (EPR) entangled pair, with both parties randomly selecting basis sets to measure qubits, providing raw data for subsequent basis pairing and CHSH games.

[0082] S32, both parties publicly disclose their respective base group selections through the classical channel, filter events that match the base group, calculate the CHSH correlation value, and compare it with the theoretical threshold to determine whether there is eavesdropping or man-in-the-middle attack on the channel.

[0083] CHSH, Clauser-Horne-Shimony-Holt, refers to a specific form of Bell's inequality used to test quantum entanglement.

[0084] Both parties disclose their respective base group selections (Z or X) through a classical channel, but do not disclose the measurement bits.

[0085] Events that match the base set (with a probability of approximately 50%) are filtered out, and 25% of them are randomly selected for CHSH game validation.

[0086] The formula for the CHSH correlation degree S value is: .

[0087] in: CHSH correlation metric, theoretical maximum value The maximum value of classical local latent variable theory . When the server Select measurement basis set Client Select measurement basis set When, the associated expected value of the measurement results. Server Two measurement basis sets, for example base, base. Client Two measurement basis sets, for example base, base. Absolute value operation, ensuring It is a non-negative number. Specific definition: ,in It is the probability that the measurement results are the same. It represents the probability of different measurement results.

[0088] Judgment rule: If ( For noise margin, typically taken as 0.1~0.2), channel security is determined; if If eavesdropping or a man-in-the-middle attack is detected, the authentication will be terminated immediately.

[0089] The CHSH inequality is a watershed between quantum mechanics and classical local hidden variable theory. This method utilizes this inequality to detect channel security in real time; any eavesdropping will cause the quantum state to decoherent, leading to… The value drops below the classical limit of 2, thus enabling physical layer attack detection.

[0090] The purpose of step S32 is to: disclose the base set selection (but not the measurement results), calculate the S value of the CHSH game, and determine whether there is eavesdropping or man-in-the-middle attack.

[0091] S33. After removing the measurement results used for CHSH verification, the remaining measurement results of the matching basis set are used to generate a one-time session key after privacy amplification and error correction.

[0092] After removing the 25% of measurements used for CHSH verification, the remaining 75% of the matching basis set results are used as the original key. .

[0093] The final session key is generated through privacy amplification and error correction. It has a length of 256 bits.

[0094] The formula for generating the session key is: .

[0095] in: The final generated session key is used to encrypt subsequent communications. The original matched radix measurement bit string is approximately 75% the length of the number of matched radix events. Extraction functions based on quantum random numbers, such as hash functions based on the Toeplitz matrix, are used to convert non-uniform raw keys into uniformly random keys. The publicly available random salt value (obtained from the quantum entropy pool) is used to enhance the uniformity of extraction and prevent bias in the extraction function.

[0096] This step ensures that even if an attacker eavesdrops on part of the quantum channel (such as through a light splitting attack), they cannot obtain the complete session key, because privacy amplification can compress the leaked information to an exponentially small level, achieving information-theoretic security.

[0097] The purpose of step S33 is to generate a one-time key for this session using the remaining unpublished matching base set measurement results, and to establish an encrypted communication channel.

[0098] Step S4: After successful two-way peer authentication, a temporary quantum session key and computing power access permissions are dynamically allocated based on the real-time collected multi-dimensional situational parameters.

[0099] In this embodiment, step S4 may specifically include the following steps: S41 collects risk indicators such as identity level, device trust status, network attack frequency, geographical location, and spatiotemporal dimensions, and calculates a comprehensive risk score through a spatiotemporal entropy risk assessment algorithm.

[0100] Collection of indicator sets This includes: number of failed login attempts, device fingerprint SimHash value, probability of geolocation jump, channel QBER (quantum bit error rate), and historical CHSH S value.

[0101] The comprehensive risk scoring formula is as follows: .

[0102] in: Comprehensive risk score, range of values The higher the value, the greater the risk. Dynamic weighting coefficients, satisfying Adaptively adjust according to the scenario (e.g., increase the level of confidentiality in scenarios). ). : The Sim hash value of the device fingerprint, used to detect whether the device has been tampered with. Normal value <0.3, abnormal value >0.7. Original hardware fingerprint data of the device (such as MAC address, TPM measurement value). Time entropy, a metric calculated within a time window. The internal fluctuation entropy. The geographic location risk function returns 0.8 if the location change exceeds the threshold, and 0.1 otherwise. The current geographical location of the device (such as latitude and longitude coordinates or the region inferred from the IP address).

[0103] Time entropy The expansion formula is: .

[0104] in: Time entropy quantifies the uncertainty of an event within a time window. : The number of event types within the time window (e.g., authentication success, authentication failure, permission change, etc.). : No. Class of events. : No. The probability of occurrence of a class of events satisfies . : A logarithmic function with base 2.

[0105] Traditional risk assessments only consider a single dimension or static threshold. This formula introduces time entropy and geospatial jump detection, which can detect complex attack patterns such as high-speed replay attacks and document forgery, thereby improving the accuracy of risk control.

[0106] The purpose of step S41 is to collect multi-dimensional situational parameters and calculate spatiotemporal entropy risk.

[0107] S42 combines the comprehensive risk score with the user attribute set, calls the lattice-based revocable encryption algorithm based on attribute version vectors, dynamically binds the temporary quantum session key with computing power access permissions, and generates the user's private key.

[0108] Invoke the lattice-based revocable encryption algorithm (Revo-LWE) based on attribute version vectors.

[0109] Access Policy Tree Definition: For example, ("Department" = "AI lab") AND ("Security Level" ≥ 3) AND ("Risk Score" ≤ 0.5).

[0110] The formula for generating ciphertext is: .

[0111] in: : Ciphertext, containing the encrypted permission token and access policy tree. : Improved lattice-based CP-ABE encryption function. The Master Public Key is a system-level public parameter. Temporary computing power access tokens (such as 64-bit random numbers) are used for authorization. The currently valid set of attribute versions, for example .

[0112] The formula for deriving a user's private key is: .

[0113] in: User private key, belonging to polynomial ring The elements in. The set of attributes owned by the user. : Single attribute, belonging to . Attribute weight coefficients are assigned by the authorization center based on the security level, satisfying the following conditions: . : Single-attribute private key component, through generate. Summation operation (in the polynomial ring) superior). Multiplication (multiplication of a scalar and a polynomial).

[0114] Decryption determination: Only when the user attribute set Fully satisfy access policy tree Decryption is only possible when the version number of each attribute matches the version required in the ciphertext. This allows them to gain access.

[0115] The user private key derivation formula is based on the Ring-LWE problem, making it resistant to quantum computer attacks; the attribute versioning mechanism ensures that when permissions are revoked, it is not necessary to re-encrypt all ciphertexts, but only to update the KUK, reducing the overhead of permission iteration from Down to .

[0116] The purpose of step S42 is to achieve one-time key-permission binding based on the improved CP-ABE lattice base.

[0117] S43. Based on the comprehensive risk score, the validity period of the temporary quantum session key is dynamically adjusted using an exponential decay function; the higher the risk, the shorter the validity period.

[0118] The dynamic TTL formula is: .

[0119] in: Key validity period, in seconds. : Basic validity period (e.g., 300 seconds for classified scenarios, 3600 seconds for ordinary scenarios). : Natural constant, approximately equal to 2.71828, the base of the exponential function. Adjustment coefficient, range of values Used to control risk sensitivity ( The larger the TTL, the more... The faster the growth declines. Comprehensive risk score, range of values It is calculated by step S41. : Exponential decay function, when The time value is 1, when Time value (Approximately 0.0067~0.0183).

[0120] Example: If Second, , ,but Second.

[0121] The dynamic TTL formula achieves an exponential negative correlation between risk and key lifecycle, ensuring efficient communication in low-risk scenarios (long validity reduces frequent handshakes) and rapid restriction of permissions in high-risk scenarios (short validity forces re-authentication), thus balancing security and availability.

[0122] The purpose of step S43 is to shorten the key lifecycle in high-risk scenarios and reduce the security window by dynamically adjusting the key validity period.

[0123] The purpose of step S4 is to collect four-dimensional situational parameters of users, devices, tasks, and networks in real time, quantify risks through entropy weight assessment algorithm, dynamically bind keys and permissions, and achieve adaptive and refined management and control.

[0124] Step S5: Under the temporary quantum session key and computing power access permissions, perform one or more of the following business operations: calling computing power node computing tasks, reading and writing encrypted data, key and permission management operations, system status monitoring, generating audit logs, and performing quantum-resistant signatures, hash chain evidence storage, and zero-knowledge proofs on the full operation logs.

[0125] In this embodiment, step S5 may specifically include the following steps: S51 captures in real time the business operations of computing node computing task calls, encrypted data read and write access, key and permission management operations, system status monitoring and audit log generation, generates structured logs, and signs the logs using a post-quantum signature algorithm.

[0126] Log entry structure: .

[0127] The formula for signature generation is: .

[0128] in: Digital signature, binary string. Dilithium signature algorithm (NIST post-quantum cryptography standard). Log signing private key, generated and securely stored by the authorization center. : The hash value of the log entry, using the SHA-3-256 algorithm. : No. One log entry (excluding the signature itself).

[0129] The Dilithium algorithm, based on the SIS problem (short integer solution problem) on modular lattices, is resistant to attacks from Shor and Grover's algorithms on quantum computers, ensuring that log signatures remain unforgeable in the quantum era.

[0130] The purpose of step S51 is to capture every operation such as computing power call, data read / write, and permission change in real time, generate structured logs, and sign the logs using a post-quantum signature algorithm to prevent forgery.

[0131] S52 links log entries sequentially to form a quantum hash chain and generates a proof based on zero-knowledge proof technology to verify that the log has not been tampered with and that the generation time meets the requirements, without revealing the specific content of the log.

[0132] Quantum hash chain iteration: Link the current log with the previous hash to form a new hash.

[0133] The iteration formula for the quantum hash chain is: .

[0134] in: : No. A hash digest of each log entry, 256 bits in length. Hash functions based on quantum random numbers (seeds from QRNG, enhancing collision resistance), such as seed-enhanced versions of the SHA-3 algorithm. : No. 1 log entry (including signature). : The hash digest of the previous log entry, where This is the initial entropy of the system (a public constant). : Connect operator.

[0135] The formula for generating zero-knowledge proofs is: .

[0136] in: Zero-knowledge proofs are several hundred bytes in length. zk-SNARKs (zero-knowledge concise non-interactive knowledge proof) proof generation algorithm. : Raw log (private input, not public). : Public hash digest (public input).

[0137] Quantum hash chains utilize QRNG to enhance the collision resistance of hash functions, making it impossible for attackers to find collisions through classical or quantum brute-force attacks; zero-knowledge proofs allow auditors to verify the integrity and timeliness of logs without accessing the original logs, balancing compliance auditing with business privacy.

[0138] The purpose of step S52 is to prove, through quantum hash chain and zero-knowledge proof, that the log has not been tampered with and was generated after a specified time, without revealing the specific content of the log.

[0139] S53 stores the root hash and zero-knowledge proof of the entire hash chain on the chain, and stores the original log in a distributed file system after post-quantum encryption.

[0140] The on-chain data structure is as follows: .

[0141] in: The root hash of the entire quantum hash chain (i.e., the hash of the last log entry). ). Zero-knowledge proof summary (can aggregate all log proofs into one proof). : On-chain timestamp (obtained from a trusted time source).

[0142] The formula for integrity verification is: .

[0143] in: zk-SNARKs verification algorithm. This indicates that the log has not been tampered with from its generation to its upload to the blockchain. This indicates that the log has been tampered with or has been proven invalid.

[0144] Only proofs and hashes are stored on-chain, greatly reducing storage costs and protecting privacy; any tampering with the logs will result in... Mismatch and cannot be forged This enables a trustworthy audit chain that is non-repudiable and tamper-proof.

[0145] The purpose of step S53 is to: convert the root hash and zero-knowledge proof On-chain (blockchain or consortium blockchain), the original logs are encrypted and stored in a distributed file system, supporting rapid verification of integrity during subsequent audits.

[0146] The purpose of step S5 is to execute business operations within the authorized scope, collect full behavior logs in real time, and achieve the immutability, traceability, and privacy protection of the logs by using quantum hash chain, quantum-resistant signature, and zero-knowledge proof, and to store the evidence on the chain.

[0147] Step S6: Automatically revoke permissions, cancel temporary quantum session keys, and update the key cache pool after the business operation is completed or when an anomaly occurs, forming a security closed loop.

[0148] In this embodiment, step S6 may specifically include the following steps: S61 automatically reclaims computing power access permissions and cancels temporary quantum session keys after the business operation is completed, and incremental revocation is achieved by incrementing the attribute version by one.

[0149] Listen for business completion events (such as task closure, session timeout) or explicit logout requests.

[0150] Call the permission revocation interface.

[0151] Attribute version update (revoke specific attribute): If you need to revoke a specific attribute of a user (such as demoting them from "Manager" to "Employee"), the authorization center will execute the following: .

[0152] in: The updated version number. : Old version number. : New version of the key update key.

[0153] This step ensures that permissions are not left behind, preventing session reuse attacks; the attribute version update mechanism reduces the complexity of revocation from... Down to This greatly improves the efficiency of large-scale dynamic permission management.

[0154] The purpose of step S61 is to automatically reclaim the user's computing power access permissions, destroy the temporary session key, and release security resources after the business task is completed normally or times out.

[0155] S62: When the comprehensive risk score exceeds the preset threshold or the channel detection is abnormal, the access subject's permissions are forcibly frozen, the temporary quantum session key is destroyed, and the abnormal audit log is retained for traceability.

[0156] The situational awareness module monitors the risk indicators in step S41 in real time. (e.g., 0.85) or CHSH detected If the value is below 2.5 for three consecutive times, a forced freeze will be triggered.

[0157] Perform a freeze operation: Change the user's status to "frozen", forcibly delete all active session keys, block all computing power requests, and generate an abnormal audit log.

[0158] Transform passive protection into proactive immunity, achieving millisecond-level response in high-risk scenarios, blocking attack chains, and preventing uncontrolled access and data leakage.

[0159] The purpose of step S62 is to work with the situational awareness module to immediately freeze permissions, destroy keys, and retain abnormal audit logs when high-risk behaviors such as abnormal access, key leakage, and channel eavesdropping are detected.

[0160] S63 maintains a key cache pool, calculates cache weights by comprehensively considering the most recent access time and access frequency of keys, evicts infrequently used keys according to their weights, and retains high-frequency active keys to reduce authentication latency.

[0161] Edge gateway maintenance size is A quantum key buffer pool of (e.g., 10000) stores (Q-ID, K) pre , , ).

[0162] The formula for calculating the key cache weight is: .

[0163] in: The cache weight of the key; the smaller the value, the higher the priority for eviction. Balance coefficient (usually) , Adjusting the impact of timeliness and access frequency to meet [the needs of] . : Timestamp of the most recent access time (normalized to) The closer the interval, the larger it is. Access frequency per unit time (e.g., 1 minute), normalized to . Multiplication operation.

[0164] Cache eviction policy: Evict when the cache pool is full. The entries are pre-generated and new key supplements are generated.

[0165] Hit process: When the terminal connects again, the cache pool is checked first. If a match is found, the cache is reused directly. By skipping the full BB84 negotiation, the authentication latency can be reduced to 50μs; if a miss occurs, the lightweight BB84 protocol is triggered.

[0166] This formula combines access timeliness and frequency, ensuring the cache pool always retains the "hottest" keys, thus resolving the issue of low QKD key generation rate (typically <1Mbps) and high concurrency (>10) in computing power networks. 5 The contradiction between TPS (Transmission Time Per Second) and the actual system average authentication latency was stably controlled within 200μs.

[0167] The purpose of step S63 is to maintain an LRU (Least Recently Used) key cache pool, eliminate low-frequency expired keys, retain high-frequency active keys, reduce authentication latency, and improve the performance of high-concurrency access for massive terminals.

[0168] The purpose of step S6 is to revoke permissions and dynamically cancel keys, optimize high-concurrency access performance, and form a security closed loop.

[0169] Figure 2 This is an exemplary system architecture diagram in which the present invention can be applied. For example... Figure 2 As shown, the quantum network layer provides a physical-level security foundation for this embodiment, integrating a multi-specification quantum random number generation module (QRNG), a quantum key distribution module, a quantum entangled state preparation module, a Bell inequality channel verification module, a quantum entropy pool management module, and an entropy health monitoring module. This embodiment proposes a layered deployment architecture for the hybrid quantum random number generation module, with differentiated deployment based on the differences in computing power network layers. Simultaneously, a quantum entropy pool management mechanism is introduced to resolve the contradiction between the output rate of quantum devices and the high concurrency requirements of the computing power network.

[0170] The cryptographic service layer is the core functional layer of the system. It constructs a distributed quantum cryptographic resource pool and integrates an identity authentication unit, a dynamic permission scheduling unit, a key management unit, a security situation assessment unit, and an audit encryption and evidence storage unit. It introduces a policy-key decoupling and mapping mechanism to solve the problem of low efficiency in revoking large-scale user permissions.

[0171] The application access layer serves as the entry point for business interaction, encapsulating standardized access software development kits (SDKs), general communication interfaces, and secure access media. It introduces a lightweight agent architecture, optimizes and adapts for heterogeneous edge devices (IoT, industrial control computers), and is fully compatible with traditional computing power scheduling platforms, edge computing systems, and government and enterprise confidential computing power business systems.

[0172] Figure 3 This is an exemplary three-layer decoupled system architecture diagram to which the present invention can be applied. For example... Figure 3 As shown, the hierarchical structure of the application access layer, cryptographic service layer, and quantum network layer is illustrated, along with the composition of each layer's modules, cross-layer data flow, and core innovative modules such as layered hybrid quantum random number deployment, dynamic permission binding, and audit evidence storage.

[0173] Figure 4 This is a flowchart illustrating the overall business process of network identity authentication and access control used in the quantum random number-based network identity authentication and access control method of this invention. (See diagram below.) Figure 4 As shown, the entire execution logic of system initialization, identity registration, two-way authentication, permission allocation, business execution, audit and evidence storage, and permission revoke is demonstrated.

[0174] Figure 5 This is a schematic diagram illustrating the mechanism of the quantum two-way authentication and channel verification algorithm used in the quantum random number-based computing power network identity authentication and access control method of this invention. Figure 5 As shown, the core processes of quantum entanglement pair distribution, basis pairing, Bell inequality verification, and identity verification are demonstrated, along with the attack detection and interception mechanism.

[0175] Figure 6 This is a schematic diagram of an edge distributed computing power access scenario (high-concurrency lightweight mode) using the quantum random number-based computing power network identity authentication and access control method of this invention. Figure 6 As shown, this scenario applies to the industrial internet edge computing network in the Guangdong-Hong Kong-Macao Greater Bay Area. The scenario includes millions of IoT sensors, AGVs, and edge inference servers. The scenario is characterized by limited device resources, a massive number of connections (eMBB), and short, fast-paced tasks; the core requirements are low latency and high concurrency.

[0176] This invention can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This invention can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This invention can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0177] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware through computer-readable instructions. These computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above methods. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, optical disk, or read-only memory (ROM), or random access memory (RAM).

[0178] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0179] Example 2 Further reference Figure 7 As a response to the above Figure 1 The present invention provides an embodiment of a computing power network identity authentication and access control device based on quantum random numbers, which implements the method shown. Figure 1 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0180] like Figure 7 As shown, the quantum random number-based computing power network identity authentication and access control device 70 described in this embodiment includes: a pre-distribution module 71, a generation module 72, an authentication module 73, an allocation module 74, an execution module 75, and a recycling module 76. Wherein: The pre-distribution module 71 is used for system initialization and quantum key pre-distribution, providing quantum random numbers, quantum identity identifiers and cryptographic resource pools as the underlying security foundation for the entire computing power network; Generation module 72 is used to generate a globally unique quantum identity for each access subject and establish a trusted identity database; Authentication module 73 is used to complete two-way peer authentication between the access subject and the service node by using the pre-distributed quantum entangled pairs and the quantum identity identifier; The allocation module 74 is used to dynamically allocate temporary quantum session keys and computing power access permissions based on real-time collected multi-dimensional situational parameters after two-way peer authentication is successful. The execution module 75 is used to perform one or more of the following business operations under the temporary quantum session key and the computing power access permission: computing power node computing task invocation, encrypted data read and write access, key and permission management operations, system status monitoring, audit log generation, and quantum-resistant signature, hash chain notarization and zero-knowledge proof on the full operation log; The recycling module 76 is used to automatically reclaim permissions, cancel temporary quantum session keys, and update the key cache pool after business operations are completed or when an anomaly occurs, forming a security closed loop.

[0181] Example 3 To address the aforementioned technical problems, embodiments of the present invention also provide a computer device. Please refer to [link / reference needed]. Figure 8 , Figure 8 This is a basic structural block diagram of the computer device in this embodiment.

[0182] The aforementioned computer device 8 includes a memory 81, a processor 82, and a network interface 83 that are interconnected via a system bus. It should be noted that only the computer device 8 with components 81, 82, and 83 is shown in the figure; however, it should be understood that it is not required to implement all the shown components, and more or fewer components can be implemented alternatively. Those skilled in the art will understand that the computer device described herein is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0183] The aforementioned computer devices can be desktop computers, laptops, handheld computers, and cloud servers, among other computing devices. These devices can facilitate human-computer interaction with users through keyboards, mice, remote controls, touchpads, or voice-activated devices.

[0184] The aforementioned memory 81 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the aforementioned memory 81 may be an internal storage unit of the aforementioned computer device 8, such as the hard disk or memory of the computer device 8. In other embodiments, the aforementioned memory 81 may also be an external storage device of the aforementioned computer device 8, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 8. Of course, the aforementioned memory 81 may also include both the internal storage unit and its external storage device of the aforementioned computer device 8. In this embodiment, the aforementioned memory 81 is typically used to store the operating system and various application software installed on the aforementioned computer device 8, such as computer-readable instructions for a quantum random number-based computing power network identity authentication and access control method. In addition, the aforementioned memory 81 can also be used to temporarily store various types of data that have been output or will be output.

[0185] In some embodiments, the processor 82 described above may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 82 is typically used to control the overall operation of the computer device 8. In this embodiment, the processor 82 is used to execute computer-readable instructions stored in the memory 81 or to process data, for example, to execute computer-readable instructions for the quantum random number-based computing power network identity authentication and access control method.

[0186] The network interface 83 may include a wireless network interface or a wired network interface, which is typically used to establish a communication connection between the computer device 8 and other electronic devices.

[0187] Example 4 The present invention also provides another embodiment, namely, providing a computer-readable storage medium storing computer-readable instructions that can be executed by at least one processor to cause the at least one processor to perform the steps of the above-described quantum random number-based computing power network identity authentication and access control method.

[0188] The beneficial effects of implementing the above embodiments are as follows: (1) Security leaps to the quantum level: By using quantum random numbers as the entropy source and EPR entanglement pairs and CHSH Bell's inequality to achieve two-way authentication at the physical layer, identity forgery and man-in-the-middle attacks are eliminated from the root, achieving unconditional security based on information theory.

[0189] (2) Dynamic and refined access control: By introducing multi-dimensional situational awareness and comprehensive risk scoring, the validity period of temporary quantum session keys and computing power access permissions are adaptively adjusted to achieve an intelligent balance between high-risk compression of permissions and low-risk maintenance of efficiency.

[0190] (3) Trustworthy and compliant audit system: By integrating post-quantum signature, quantum hash chain and zero-knowledge proof, the operation log is made immutable, traceable and privacy controllable, which meets the requirements of government and enterprise confidentiality compliance audit.

[0191] (4) High concurrency and good compatibility: The authentication latency is controlled within 200μs through LRU key caching optimization and lightweight protocol; the layered decoupled architecture does not require reconstruction of the existing system and is suitable for large-scale commercial deployment.

[0192] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0193] Obviously, the embodiments described above are merely some embodiments of the present invention, not all embodiments. The accompanying drawings show preferred embodiments of the present invention, but do not limit the patent scope of the present invention. The present invention can be implemented in many different forms; rather, these embodiments are provided to provide a more thorough and complete understanding of the disclosure of the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the patent protection scope of this invention.

Claims

1. A method for identity authentication and access control in computing power networks based on quantum random numbers, characterized in that, Includes the following steps: System initialization and quantum key pre-distribution provide quantum random numbers, quantum identity identifiers, and cryptographic resource pools as the underlying security foundation for the entire computing power network; Generate a globally unique quantum identity for each access entity and establish a trusted identity database; Using pre-distributed quantum entangled pairs and the quantum identity identifier, two-way peer authentication between the access subject and the service node is completed; After two-way peer authentication is successful, temporary quantum session keys and computing power access permissions are dynamically allocated based on real-time collected multi-dimensional situational parameters. Under the temporary quantum session key and the computing power access permission, perform any one or more of the following business operations: calling computing power node computing tasks, reading and writing encrypted data, key and permission management operations, system status monitoring, generating audit logs, and performing quantum-resistant signatures, hash chain evidence storage and zero-knowledge proofs on the full operation logs; The system automatically revoks permissions, cancels temporary quantum session keys, and updates the key cache pool after business operations are completed or when an anomaly occurs, forming a secure closed loop. The steps of performing one or more of the following business operations under the temporary quantum session key and the computing power access permissions: computing power node computing task invocation, encrypted data read / write access, key and permission management operations, system status monitoring, audit log generation, and performing quantum-resistant signatures, hash chain notarization, and zero-knowledge proofs on the full operation logs specifically include: Real-time capture of computing node task calls, encrypted data read / write access, key and permission management operations, system status monitoring and audit log generation business operations, generating structured logs, and signing the logs using a post-quantum signature algorithm; Log entries are linked sequentially to form a quantum hash chain, and a proof is generated based on zero-knowledge proof technology to verify that the log has not been tampered with and that the generation time meets the requirements, without revealing the specific content of the log; The root hash and zero-knowledge proof of the entire hash chain are stored on the chain for evidence preservation, and the original log is stored in a distributed file system after being subjected to post-quantum encryption.

2. The method for identity authentication and access control in computing power networks based on quantum random numbers according to claim 1, characterized in that, The system initialization and quantum key pre-distribution steps, which provide quantum random numbers, quantum identity identifiers, and cryptographic resource pools as the underlying security foundation for the entire computing power network, specifically include: For the core nodes, mid-range clusters and edge terminals of the computing power network, a hybrid type of quantum random number generator is deployed in layers, and a quantum entropy pool is initialized. Quantum identity identifiers are pre-distributed to all network nodes through a quantum key distribution protocol, and key fragmentation initialization is completed using a distributed key generation mechanism. User secret fragments and authorized institution secret fragments are combined into user private keys using bitwise XOR operations. The access policy is encoded as a Bloom filter in the form of short tokens, and an initial version number is assigned to each attribute.

3. The method for identity authentication and access control in computing power networks based on quantum random numbers according to claim 1, characterized in that, The steps of generating a globally unique quantum identity for each access subject and establishing a trusted identity database specifically include: Based on the true random number generated by the quantum entropy pool, combined with the hash value of the device hardware fingerprint and the timestamp, a unique quantum identity identifier for the access subject is generated through the quantum random number hash function; The quantum identity identifier is bound to the attribute set of the access subject and stored in a distributed trusted identity database that has been quantum encrypted. Initialize a version vector for each attribute and generate a corresponding key update key based on the on-ring error learning problem.

4. The method for identity authentication and access control in computing power networks based on quantum random numbers according to claim 1, characterized in that, The steps for completing bidirectional peer-to-peer authentication between the access subject and the service node using the pre-distributed quantum entangled pairs and the quantum identity identifier specifically include: The server prepares an Einstein-Podolsky-Rosen entangled pair, retains one photon, and sends the other photon to the client. Both parties independently and randomly select measurement basis sets for measurement. Both parties publicly disclose their respective base group selections through a classical channel, filter events that match the base group, calculate the CHSH correlation value, and compare it with the theoretical threshold to determine whether there is eavesdropping or man-in-the-middle attack on the channel. After removing the measurement results used for CHSH verification, the remaining measurement results of the matching basis set are used to generate a one-time session key after privacy amplification and error correction.

5. The method for identity authentication and access control in computing power networks based on quantum random numbers according to claim 1, characterized in that, The step of dynamically allocating temporary quantum session keys and computing power access permissions based on real-time collected multi-dimensional situational parameters after successful two-way peer authentication specifically includes: Collect risk indicators such as identity level, device trust status, network attack frequency, geographical location, and spatiotemporal dimension, and calculate a comprehensive risk score through the spatiotemporal entropy risk assessment algorithm; By combining the comprehensive risk score with the user attribute set, calling the attribute version vector-based lattice-based revocable encryption algorithm, dynamically binding the temporary quantum session key with computing power access permissions, and generating the user's private key; Based on the comprehensive risk score, the validity period of the temporary quantum session key is dynamically adjusted using an exponential decay function; the higher the risk, the shorter the validity period.

6. The method for identity authentication and access control of computing power networks based on quantum random numbers according to any one of claims 1 to 5, characterized in that, The steps for automatically revoking permissions, canceling temporary quantum session keys, and updating the key cache pool to form a security closed loop after a business operation is completed or an anomaly occurs specifically include: After the business operation is completed, the computing power access permission is automatically revoked and the temporary quantum session key is cancelled. Incremental revocation is achieved by incrementing the attribute version by one. When the comprehensive risk score exceeds the preset threshold or an anomaly is detected in the channel, the access subject's permissions will be forcibly frozen, the temporary quantum session key will be destroyed, and the anomaly audit log will be retained for traceability. Maintain a key cache pool, calculate cache weights by comprehensively considering the most recent access time and access frequency of keys, evict infrequently used keys according to their weights, and retain frequently used active keys to reduce authentication latency.

7. A computing power network identity authentication and access control device based on quantum random numbers, characterized in that, include: The pre-distribution module is used for system initialization and quantum key pre-distribution, providing quantum random numbers, quantum identity identifiers and cryptographic resource pools as the underlying security foundation for the entire computing power network; The generation module is used to generate a globally unique quantum identity for each access subject and establish a trusted identity database; The authentication module is used to complete two-way peer authentication between the access subject and the service node using the pre-distributed quantum entangled pairs and the quantum identity identifier; The allocation module is used to dynamically allocate temporary quantum session keys and computing power access permissions based on real-time collected multi-dimensional situational parameters after two-way peer authentication is successful. The execution module is used to perform one or more of the following business operations under the temporary quantum session key and the computing power access permissions: computing power node computing task invocation, encrypted data read and write access, key and permission management operations, system status monitoring, audit log generation, and quantum-resistant signature, hash chain notarization and zero-knowledge proof on the full operation log; The recycling module is used to automatically reclaim permissions, cancel temporary quantum session keys, and update the key cache pool after business operations are completed or when an anomaly occurs, forming a security closed loop. The execution module is further used for: Real-time capture of computing node task calls, encrypted data read / write access, key and permission management operations, system status monitoring and audit log generation business operations, generating structured logs, and signing the logs using a post-quantum signature algorithm; Log entries are linked sequentially to form a quantum hash chain, and a proof is generated based on zero-knowledge proof technology to verify that the log has not been tampered with and that the generation time meets the requirements, without revealing the specific content of the log; The root hash and zero-knowledge proof of the entire hash chain are stored on the chain for evidence preservation, and the original log is stored in a distributed file system after being subjected to post-quantum encryption.

8. A computer device, characterized in that, The method includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor executes the computer-readable instructions to implement the steps of the quantum random number-based computing power network identity authentication and access control method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the computing power network identity authentication and access control method based on quantum random numbers as described in any one of claims 1 to 6.

Images