A three-factor anti-quantum data restoration decryption method and system

Abstract

This invention discloses a three-factor quantum-resistant data reconstruction and decryption method and system, belonging to the field of quantum information security technology. Existing quantum-resistant decryption schemes only focus on key negotiation. This invention constructs a four-dimensional collaborative three-factor quantum-resistant authentication architecture involving the transmission layer, physical layer, algorithm layer, and carrier layer. It deeply integrates Kyber quantum-resistant cryptography, domestic QR codes, zero-knowledge proofs, CRC checksums, and other technologies, solving core problems unresolved by existing technologies, such as fragmented data integrity verification, multi-factor authentication, and fragment forgery. An irreversible security strategy is constructed through multiple verifications, each indispensable, ensuring that only legitimate and complete fragments can participate in data reconstruction. Simultaneously, redundant error correction mechanisms and multiple hash checks are set up, improving the scheme's fault tolerance and ensuring the accuracy of the reconstructed data. This completely solves the security risks of traditional data reconstruction relying on a single key and the vulnerability of fragments to theft and forgery.

Description

Technical Field

[0001] This invention relates to the field of quantum information security technology, and in particular to a three-factor quantum-resistant data decryption method and system. Background Technology

[0002] With the rapid development of quantum computing technology, traditional cryptographic systems face severe security challenges. Quantum computers, with their superior parallel computing capabilities, can easily crack existing cryptographic algorithms based on mathematical problems such as large number factorization and discrete logarithms, posing a significant risk of decryption and theft of sensitive data. Against this backdrop, post-quantum cryptography has emerged, and various quantum-resistant cryptographic schemes are being developed and applied. Among them, the Kyber algorithm, a lattice-based quantum-resistant cryptographic algorithm, has attracted widespread attention due to its efficiency and security, becoming a key candidate for post-quantum cryptography standardization.

[0003] However, existing quantum-resistant decryption schemes (such as Kyber) only focus on the security of the key negotiation stage and fail to address the core security issues in the data restoration process, exhibiting significant technical shortcomings: First, existing schemes do not implement integrity verification of fragmented data, and data tampering during transmission and restoration cannot be detected in a timely manner, leading to data distortion in the restored data; Second, traditional data restoration relies on a single key for decryption, and once the key is leaked, attackers can directly obtain all the data, posing a serious security risk; Third, the problem of "stealing and then forging" fragmented data remains unresolved, allowing attackers to steal fragmented data during the data restoration stage and forge fake fragments to participate in data reconstruction, resulting in the original data being cracked or tampered with; Fourth, existing verification mechanisms mostly adopt a single verification method, which is either inefficient or lacks sufficient resistance to attacks, failing to meet the verification requirements of large file fragmented transmission in a quantum environment.

[0004] Meanwhile, in existing technologies, CRC checksums are mostly used in scenarios such as digital forensics and file transfer, but they are not deeply integrated with quantum-resistant cryptography and zero-knowledge proof technology, and cannot achieve secure verification of fragmented data in a quantum environment; although the SHA-256 hash algorithm is widely used for data verification, it has not been optimized for domestic QR code fragmentation scenarios, and its verification efficiency is difficult to meet the needs of simultaneous verification of multiple fragments; although zero-knowledge proof technology can achieve secure verification of private keys, it is not combined with the Kyber quantum-resistant cryptography system, and cannot take into account both quantum resistance and verification security.

[0005] Existing quantum-resistant data decryption technologies fail to organically integrate multi-factor authentication, integrity verification, and quantum attack resistance, resulting in a limited range of technical solutions. Therefore, developing a logically sound, secure, and reliable three-factor quantum-resistant data decryption method and system that addresses these shortcomings has become a pressing technical challenge in the field of quantum information security. Summary of the Invention

[0006] The purpose of this invention is to overcome the technical problem in the prior art that it fails to organically integrate functions such as multi-factor authentication, integrity verification, and resistance to quantum attacks, and to provide a three-factor quantum-resistant data restoration and decryption method and system.

[0007] To address the aforementioned technical problems, the present invention provides the following technical solution: On the one hand, a three-factor quantum-resistant data decryption method is provided, including the following steps: S1: The transport layer decrypts the session key using the Kyber private key, completes the security verification of the transmission channel, and builds a physical layer security guarantee for the three-factor quantum-resistant authentication architecture; S2: Scan the domestic QR code to obtain the fragment index, map the fragment index to a hash value using the SHA-256 hash algorithm, and compare it with the hash value pre-stored in the domestic QR code to complete the dual verification of the algorithm layer and the carrier layer; S3: Prove to the server that you possess a legitimate Kyber private key using a zero-knowledge proof protocol; S4: Verify the integrity of network fragments through CRC check and detect whether the fragment data has been tampered with during transmission; S5: Only when all four verifications in steps S1-S4 pass, select 7 valid fragments to reconstruct the original data; if 3 or more fragments are missing, the restoration process will be terminated. S6: Perform MD5 hash verification on the reconstructed original data to confirm that the restored data is consistent with the original data, and complete the data restoration and decryption.

[0008] As a preferred embodiment of the present invention, the Kyber private key mentioned in step S1 is generated using the CHSH nonlocality-enhanced Kyber protocol, which integrates quantum nonlocality verification and lattice-based computational security.

[0009] As a preferred embodiment of the present invention, a one-time key decryption mechanism is adopted in step S1, and a different session key is used for each data transmission session.

[0010] As a preferred embodiment of the present invention, the domestic QR code mentioned in step S2 serves as a verification carrier, with a built-in hash value corresponding to the shard index and shard association information, and only authorized personnel can obtain relevant information by scanning.

[0011] As a preferred embodiment of the present invention, the SHA-256 hash algorithm described in step S2 is implemented using parallel scheduling optimization to achieve the mapping.

[0012] As a preferred embodiment of the present invention, the zero-knowledge proof in step S3 specifically involves submitting a proof of the validity of the Kyber private key to the server based on the ZKP protocol.

[0013] As a preferred embodiment of the present invention, the CRC check in step S4 adopts the CRC32 check algorithm, which generates a 32-bit check value based on polynomial division operation on the GF(2) finite field.

[0014] As a preferred embodiment of the present invention, a fault-tolerant step is also included: if there are a few errors in the effective fragment data, error correction is performed using three redundant fragments carried by the domestic QR code.

[0015] On the other hand, a three-factor quantum-resistant data restoration and decryption system is provided to implement the three-factor quantum-resistant data restoration and decryption method described in any one of the above, comprising: an authentication module, a verification module, and a restoration module connected in sequence; The authentication module is used to construct a three-factor quantum-resistant authentication architecture to achieve Kyber private key validity authentication, domestic QR code matching authentication, and transmission channel security authentication. The verification module is used to verify the integrity of network fragments through CRC32 verification, verify the integrity of reconstructed data through MD5 hash verification, and verify the matching between fragment index and QR code content through SHA-256 hash verification. The restoration module is used to reconstruct the original data using 7 valid fragments after all verifications have passed, and to terminate the restoration if 3 or more fragments are missing.

[0016] As a preferred embodiment of the present invention, it further includes: a fault-tolerant module connected to the restoration module, used to perform error correction processing on valid fragment data with a small number of errors through three redundant fragments carried by the domestic QR code.

[0017] Compared with the prior art, the advantages of the present invention are as follows: Existing quantum-resistant decryption schemes only focus on key negotiation. This invention constructs a four-dimensional collaborative three-factor quantum-resistant authentication architecture encompassing the transport layer, physical layer, algorithm layer, and carrier layer. It deeply integrates Kyber quantum-resistant cryptography, domestically developed QR codes, zero-knowledge proofs, and CRC checksums, solving core problems unresolved by existing technologies, such as fragmented data integrity verification, multi-factor authentication, and fragment forgery. An irreversible security strategy is built through multiple verifications, each indispensable, ensuring that only legitimate and complete fragments can participate in data reconstruction. Simultaneously, redundant error correction mechanisms and multiple hash checks are implemented, improving the scheme's fault tolerance and ensuring the accuracy of the restored data. This completely resolves the security vulnerabilities of traditional data restoration relying on a single key and the susceptibility of fragments to theft and forgery. It is applicable to various fields with extremely high data security requirements, such as finance, government affairs, and healthcare, and can handle data restoration and decryption needs of different sizes and types. Attached Figure Description

[0018] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. In the drawings: Figure 1 This is a flowchart of a three-factor quantum-resistant data decryption method according to Embodiment 1 of the present invention; Figure 2 This is a structural block diagram of a three-factor quantum-resistant data decryption system as described in Embodiment 3 of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0020] Example 1 A three-factor quantum-resistant data decryption method includes the following steps: S1: The transport layer decrypts the session key using the Kyber private key, completes the security verification of the transmission channel, and builds a physical layer security guarantee for the three-factor quantum-resistant authentication architecture; Preferably, the Kyber private key mentioned in step S1 is generated using the CHSH nonlocality-enhanced Kyber protocol, which integrates quantum nonlocality verification with lattice-based computational security.

[0021] The private key is generated using the Kyber protocol with enhanced CHSH nonlocality, which combines the computational security of lattice cryptography with the information-theoretic security guarantee of quantum nonlocality, effectively resisting attacks from quantum computers. At the same time, a one-time pad decryption mechanism is used to prevent replay attacks, thus improving the resistance to quantum attacks compared to existing Kyber schemes.

[0022] Preferably, step S1 employs a one-time pad decryption mechanism, with each data transmission session using a different session key, effectively preventing replay attacks.

[0023] S2: Scan the domestic QR code to obtain the fragment index, map the fragment index to a hash value using the SHA-256 hash algorithm, and compare it with the hash value pre-stored in the domestic QR code to complete the dual verification of the algorithm layer and the carrier layer; Preferably, the domestically produced QR code mentioned in step S2 serves as a verification carrier, with a built-in hash value corresponding to the fragment index and fragment association information. Only authorized individuals can obtain relevant information by scanning, ensuring the legitimacy of the fragment source.

[0024] Preferably, the SHA-256 hash algorithm described in step S2 uses parallel scheduling optimization to achieve mapping, improves hash value calculation efficiency, and adapts to scenarios where multiple shards are verified simultaneously.

[0025] S3: Proves to the server that it possesses a legitimate Kyber private key through a zero-knowledge proof protocol, preventing decryption by forged private keys; Preferably, the zero-knowledge proof mentioned in step S3 specifically involves: submitting proof of the validity of the Kyber private key to the server based on the ZKP protocol to achieve secure verification of the authenticity of the private key.

[0026] S4: Verify the integrity of network fragments through CRC check and detect whether the fragment data has been tampered with during transmission; Preferably, the CRC check in step S4 uses the CRC32 check algorithm, which generates a 32-bit check value based on polynomial division operations over the GF(2) finite field.

[0027] S5: Only when all four verifications in steps S1-S4 pass, select 7 valid fragments to reconstruct the original data; if 3 or more fragments are missing, the restoration process will be terminated. S6: Perform MD5 hash verification on the reconstructed original data to confirm that the restored data is consistent with the original data, and complete the data restoration and decryption.

[0028] Preferably, it also includes a fault-tolerance step: if there are a few errors in the valid fragment data, error correction is performed using three redundant fragments carried by the domestic QR code.

[0029] Example 2 This embodiment is a specific implementation of the three-factor quantum-resistant data restoration and decryption method described in Embodiment 1, taking the secure restoration and decryption of sensitive government data in a quantum environment as an example, including: The government terminal uses the Kyber private key generated by the CHSH non-locality-enhanced Kyber protocol to decrypt the session key transmitted by the sender and verify the security of the transmission channel. For each government data transmission session, a different session key is generated, and a one-time pad decryption mechanism is used to prevent replay attacks and ensure that the transmission channel is not eavesdropped on or tampered with.

[0030] The recipient scans domestically produced QR codes, such as government-specific QR codes, using a dedicated scanning device. These codes contain a fragment index, fragment association information, and the corresponding SHA-256 hash value. The recipient then obtains the fragment index by using a parallel-scheduled and optimized SHA-256 hash algorithm as input. This hash value is then compared with the hash value pre-stored in the domestically produced QR code. If the comparison matches, the verification is successful, ensuring that the fragment source is legitimate and has not been forged.

[0031] The recipient submits proof of the validity of the Kyber private key to the government server via the ZKP protocol without exposing the specific content of the Kyber private key. The server verifies the authenticity of the proof to confirm that the recipient possesses a legitimate Kyber private key, preventing attackers from forging private keys for decryption.

[0032] The receiver receives 10 pieces of government data (7 valid pieces and 3 redundant pieces). It verifies each piece of data using the CRC32 checksum algorithm, generates a 32-bit checksum value, and compares it with the checksum value pre-stored by the sender. If the comparison matches, the piece is confirmed to be complete and tamper-proof. If the comparison does not match, the piece is determined to be invalid and is refused participation in data reconstruction.

[0033] The receiver selects 7 valid fragments and uses a data reconstruction algorithm to combine the 7 valid fragments to reconstruct the original government data. If the number of valid fragments is less than 7 and 3 or more are missing, the restoration process is immediately terminated and an error message is sent back to the sender.

[0034] The reconstructed original government data is subjected to MD5 hash verification to generate an MD5 hash value, which is then compared with the MD5 hash value of the original data pre-stored by the sender. If the comparison matches, the data restoration and decryption are completed. If the comparison does not match, the above process is repeated to ensure that the restored data is consistent with the original data.

[0035] If a valid fragment has a small number of bit errors, the error correction algorithm is called through the three redundant fragments carried by the domestic QR code to repair the erroneous fragment. After repair, a CRC32 check is performed again. Once the check passes, it participates in the data reconstruction. The redundant fragments are only used for error correction and do not participate in the data reconstruction and decryption process to avoid the abuse of redundant fragments.

[0036] Example 3 A three-factor quantum-resistant data decryption system is provided to implement the three-factor quantum-resistant data decryption method described in Example 1 or 2, such as... Figure 1 As shown, it includes: an authentication module, a verification module, and a restoration module connected in sequence; The authentication module is used to construct a three-factor quantum-resistant authentication architecture to achieve Kyber private key validity authentication, domestic QR code matching authentication, and transmission channel security authentication. Specifically, the authentication module adopts an embedded architecture, with a built-in Kyber key generation unit and a zero-knowledge proof unit. The Kyber key generation unit is based on the CHSH nonlocality-enhanced Kyber protocol, generating Kyber private keys and session keys, and supports a one-time pad key generation mechanism. The zero-knowledge proof unit supports the ZKP protocol and can quickly process the submission and verification of private key validity proofs with a response time of ≤100ms. At the same time, the module integrates a QR code scanning and recognition unit, which can recognize the fragment index and hash value in domestic QR codes, complete QR code matching authentication, and ensure authentication efficiency and security.

[0037] The verification module is used to verify the integrity of network fragments through CRC32 verification, verify the integrity of reconstructed data through MD5 hash verification, and verify the matching between fragment index and QR code content through SHA-256 hash verification. Specifically, the verification module integrates CRC32 verification unit, SHA-256 verification unit, and MD5 verification unit; the CRC32 verification unit is optimized using a lookup table method, reducing the computation time complexity to O(n), and can realize real-time verification of fragmented data; the SHA-256 verification unit is optimized using parallel scheduling, which improves the computation efficiency by more than 2 times compared with the traditional implementation method; the MD5 verification unit is used to verify the integrity of reconstructed data and ensure the accuracy of the restored data.

[0038] The restoration module is used to reconstruct the original data using 7 valid fragments after all verifications have passed, and to terminate the restoration when 3 or more fragments are missing. Specifically, the restoration module has a built-in fragment filtering unit and a data reconstruction unit; the fragment filtering unit can automatically identify valid fragments and invalid fragments with a filtering accuracy of ≥99.9%; the data reconstruction unit supports parallel reconstruction of multiple fragments, and the reconstruction efficiency is dynamically adjusted according to the fragment size, with a reconstruction time of ≤30s for 1GB of data; when the number of valid fragments is less than 7, the reconstruction process is automatically terminated and an abnormal alarm is triggered.

[0039] Preferably, it further includes: a fault-tolerant module connected to the restoration module, used to perform error correction processing on valid fragment data with a small number of errors through three redundant fragments carried by the domestic QR code; Specifically, the fault tolerance module has a built-in redundant fragment management unit and an error correction algorithm unit. The redundant fragment management unit is used to store and manage the three redundant fragments carried by the domestic QR code, limiting the scope of use of the redundant fragments. The error correction algorithm unit adopts an error correction algorithm based on redundant fragments, which can repair a small number of bit errors in the fragment data, with an error correction success rate of ≥98%, ensuring the stability of the data restoration process.

[0040] The three-factor quantum-resistant data restoration and decryption system described in this embodiment can be directly deployed on government terminals, financial servers, and other devices. It is compatible with existing data transmission systems, requires no large-scale modification of existing hardware, has strong adaptability, and possesses extremely high security and reliability. It can effectively resist quantum attacks, fragmentation forgery, and data tampering, ensuring the secure restoration and decryption of sensitive data.

[0041] The preferred embodiments of this disclosure have been described in detail above with reference to the accompanying drawings. However, this disclosure is not limited to the specific details of the above embodiments. Within the scope of the technical concept of this disclosure, various simple modifications can be made to the technical solutions of this disclosure, and these simple modifications all fall within the protection scope of this disclosure.

[0042] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, this disclosure will not describe the various possible combinations separately.

[0043] Furthermore, various different embodiments of this disclosure can be combined in any way, as long as they do not violate the spirit of this disclosure, they should also be regarded as the content disclosed in this disclosure.

Claims

1. A three-factor quantum-resistant data decryption method, characterized in that, Includes the following steps: S1: The transport layer decrypts the session key using the Kyber private key, completes the security verification of the transmission channel, and builds a physical layer security guarantee for the three-factor quantum-resistant authentication architecture; S2: Scan the domestic QR code to obtain the fragment index, map the fragment index to a hash value using the SHA-256 hash algorithm, and compare it with the hash value pre-stored in the domestic QR code to complete the dual verification of the algorithm layer and the carrier layer; S3: Prove to the server that you possess a legitimate Kyber private key using a zero-knowledge proof protocol; S4: Verify the integrity of network fragments through CRC check and detect whether the fragment data has been tampered with during transmission; S5: Only when all four verifications in steps S1-S4 pass, select 7 valid fragments to reconstruct the original data; if 3 or more fragments are missing, the restoration process will be terminated. S6: Perform MD5 hash verification on the reconstructed original data to confirm that the restored data is consistent with the original data, and complete the data restoration and decryption.

2. The three-factor quantum-resistant data decryption method according to claim 1, characterized in that, The Kyber private key mentioned in step S1 is generated using the CHSH nonlocality-enhanced Kyber protocol, which integrates quantum nonlocality verification with lattice-based computational security.

3. The three-factor quantum-resistant data decryption method according to claim 1, characterized in that, Step S1 employs a one-time pad decryption mechanism, with each data transmission session using a different session key.

4. The three-factor quantum-resistant data decryption method according to claim 1, characterized in that, The domestically produced QR code mentioned in step S2 serves as a verification carrier, with a built-in hash value corresponding to the fragment index and fragment association information. Only authorized individuals can obtain relevant information by scanning.

5. The three-factor quantum-resistant data decryption method according to claim 1, characterized in that, The SHA-256 hash algorithm described in step S2 employs parallel scheduling optimization to achieve the mapping.

6. The three-factor quantum-resistant data decryption method according to claim 1, characterized in that, The zero-knowledge proof mentioned in step S3 specifically involves submitting proof of the validity of the Kyber private key to the server based on the ZKP protocol.

7. The three-factor quantum-resistant data decryption method according to claim 1, characterized in that, The CRC check described in step S4 uses the CRC32 check algorithm, which generates a 32-bit check value based on polynomial division operations over the GF(2) finite field.

8. The three-factor quantum-resistant data decryption method according to claim 1, characterized in that, It also includes a fault-tolerance step: if there are a few errors in the valid fragment data, the errors are corrected by using three redundant fragments carried by the domestic QR code.

9. A three-factor quantum-resistant data decryption system, characterized in that, The method for implementing the three-factor quantum-resistant data decryption method according to any one of claims 1-8 includes: an authentication module, a verification module, and a decryption module connected in sequence. The authentication module is used to construct a three-factor quantum-resistant authentication architecture to achieve Kyber private key validity authentication, domestic QR code matching authentication, and transmission channel security authentication. The verification module is used to verify the integrity of network fragments through CRC32 verification, verify the integrity of reconstructed data through MD5 hash verification, and verify the matching between fragment index and QR code content through SHA-256 hash verification. The restoration module is used to reconstruct the original data using 7 valid fragments after all verifications have passed, and to terminate the restoration if 3 or more fragments are missing.

10. A three-factor quantum-resistant data decryption system according to claim 9, characterized in that, Also includes: The fault-tolerant module connected to the restoration module is used to perform error correction processing on valid fragment data with a small number of errors through three redundant fragments carried by the domestic QR code.

Images