A remote operation and maintenance authentication method based on post-quantum key rotation

Abstract

The application discloses a remote operation and maintenance authentication method based on post-quantum key rotation, and relates to the field of information security.The method obtains remote operation and maintenance task information, uses a post-quantum digital signature to complete identity authentication of an operation and maintenance personnel and an operation and maintenance terminal, establishes a shared secret through a post-quantum key encapsulation mechanism, generates a session authentication key and a key generation identifier, constructs an operation and maintenance operation chain according to an execution dependency relationship and an interruption attribute of the operation and maintenance operation, determines an operation switching boundary, and determines a key rotation risk value in combination with a key use time length, an authentication number of times, an abnormal authentication record and a device state change; when a rotation condition is met, a next-generation session authentication key is generated and verified, an uncompleted operation and maintenance operation is registered as an old key allowed operation set, phased switching of new and old keys is completed at the operation switching boundary, and the old key is revoked after the old key allowed operation is completed, cancelled or a transition time limit expires. The application can take into account both the continuity of remote operation and maintenance and the security of key rotation.

Description

Technical Field

[0001] This invention relates to the field of information security, and in particular to a remote operation and maintenance authentication method based on post-quantum key rotation. Background Technology

[0002] With the increasing connectivity of servers, industrial control equipment, edge gateways, and communication devices, remote operation and maintenance (O&M) has become a crucial method for equipment status monitoring, parameter configuration, fault handling, firmware upgrades, and access control. Since remote O&M typically involves high-level device control privileges, its authentication process must simultaneously ensure the trustworthiness of the O&M personnel's identity, the O&M terminal's identity, and the source of the O&M commands. Existing remote O&M systems mostly employ digital certificates, asymmetric key negotiation, and session keys to authenticate O&M connections and operations. However, with the development of quantum computing technology, traditional public-key cryptography algorithms face potential quantum computing attack risks. Therefore, post-quantum digital signatures and post-quantum key encapsulation mechanisms are gradually being introduced to improve the resistance to quantum attacks in the remote O&M authentication process.

[0003] Existing remote authentication schemes using post-quantum cryptography typically complete identity authentication and session key generation when the maintenance session is established, and rotate the session key according to a preset period, usage count, or abnormal events. However, remote maintenance tasks often consist of multiple maintenance operations with execution dependencies, among which operations such as firmware transmission, parameter writing, configuration switching, and device restart may require continuous execution. When key rotation occurs during the execution of the above operations, directly revoking the old key and enabling the new key can easily cause the ongoing maintenance operation to be unable to continue authentication, or even cause maintenance task interruption, abnormal device status, or incomplete operation results. If the validity period of the old key is extended to ensure maintenance continuity, the old key may continue to be used to initiate new maintenance operations after rotation, increasing the risk of key leakage, replay, or unauthorized use.

[0004] Furthermore, existing key rotation methods typically rely on fixed durations or fixed authentication counts for triggering, failing to comprehensively consider the risk level of current operations, authentication anomaly records, changes in the status of maintenance terminals, and changes in the status of the maintained devices. This makes it difficult to reasonably determine the rotation timing for different maintenance scenarios. The maintenance management platform and the maintained devices may also experience key generational synchronization issues due to network latency, device offline status, or failed rotation confirmation. Simply restoring old keys may result in the reactivation of keys that have been revoked or pose security risks.

[0005] To address this, a remote operation and maintenance authentication method based on post-quantum key rotation is proposed. Summary of the Invention

[0006] The main objective of this invention is to provide a remote operation and maintenance authentication method based on post-quantum key rotation, which can effectively solve the problems in the background technology.

[0007] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0008] A remote operation and maintenance authentication method based on post-quantum key rotation is applied to a remote operation and maintenance system including an operation and maintenance management platform, an operation and maintenance terminal, and the equipment being maintained. The method includes the following steps:

[0009] S1. Obtain remote operation and maintenance task information, use post-quantum digital signature to authenticate the operation and maintenance personnel and operation and maintenance terminal, and establish a current shared secret between the operation and maintenance management platform and the device under maintenance through a post-quantum key encapsulation mechanism. Generate a current generation session authentication key based on the current shared secret, and generate an operation and maintenance session identifier and a current key generation identifier. The identity signature key corresponding to the post-quantum digital signature is used for identity authentication when establishing the operation and maintenance session, and the current generation session authentication key is used for operation and maintenance operation authentication after the operation and maintenance session is established. The operation and maintenance management platform and the device under maintenance respectively maintain a current valid key generation identifier bound to the operation and maintenance session identifier.

[0010] S2. Based on the remote operation and maintenance task information, determine multiple operation and maintenance operations and the execution dependencies between each operation and maintenance operation. Based on the operation and maintenance task type, operation instruction type, or instruction execution constraint, determine the interruption attribute of each operation and maintenance operation. Based on the execution dependencies and interruption attributes, construct an operation and maintenance operation chain and determine the operation switching boundary in the operation and maintenance operation chain.

[0011] S3. Based on the usage duration, authentication count, and abnormal authentication records of the current generation session authentication key, as well as the risk status of the current operation and maintenance, and the status changes of the operation and maintenance terminal and the maintained device, determine the key rotation risk value; when the key rotation risk value meets the key rotation triggering condition, establish the next shared secret through the post-quantum key encapsulation mechanism, generate the next generation session authentication key based on the next shared secret, and verify the next generation session authentication key;

[0012] S4. Before performing the key switch, identify the registered but not yet completed operation and maintenance operations in the operation and maintenance operation chain as the old key allowed operation set, and stop assigning the current key generation identifier to newly registered operation and maintenance operations.

[0013] S5. When the execution progress of the operation and maintenance operation chain reaches an operation switching boundary, the operation and maintenance operation located before the operation switching boundary and having an execution dependency relationship with the subsequent operation and maintenance operation has been completed or ended according to the preset exception handling rules, and the next-generation session authentication key is verified, the next-generation session authentication key is switched to the currently valid session authentication key, so that the newly registered operation and maintenance operation after the switch uses the next-generation session authentication key for authentication, and the current generation session authentication key is only used to authenticate the operation and maintenance operation in the old key allowed operation set;

[0014] S6. When all maintenance operations in the old key allowed operation set have been completed or cancelled, or when the old key transition period expires, the current generation session authentication key is revoked, and the maintenance management platform and the maintained device update the next key generation identifier to the currently valid key generation identifier bound to the maintenance session identifier; wherein, the revoked session authentication key is not restored to a valid state.

[0015] Furthermore, each operation in the operation chain has an operation identifier, an operation parameter summary, an execution dependency, an execution status, an interruption attribute, and a key generation identifier; the execution status includes at least one of registered, sent, executing, completed, execution failed, and canceled; the interruption attribute includes an interruption allowed attribute or an interruption prohibited attribute.

[0016] Furthermore, determining the operation switching boundary in the operation and maintenance operation chain includes: dividing consecutively arranged operation and maintenance operations with non-interruptible attributes into non-interruptible operation segments according to the execution dependency relationship of each operation and maintenance operation; without dividing the non-interruptible operation segments, determining the positions between adjacent non-interruptible operation segments, the positions between non-interruptible operation segments and operation and maintenance operations with permissible interruption attributes, and the positions between adjacent operation and maintenance operations with permissible interruption attributes as the operation switching boundary.

[0017] Furthermore, the normalized value of the usage duration and the normalized value of the authentication count of the current generation session authentication key are determined according to the following formulas:

[0018]

[0019]

[0020] in, For the first Normalized value of usage duration corresponding to key generation. The cumulative usage time of the current generation session authentication key. To preset the usage time threshold, For the first Normalized value of authentication count corresponding to key generation. The cumulative number of authentications for the current generation session authentication key. The preset threshold for the number of authentication attempts;

[0021] The key rotation risk value is determined according to the following formula:

[0022]

[0023] in, For the first The key generation corresponds to the key rotation risk value. This represents the risk value of the current operation and maintenance. To determine the degree of authentication anomaly, The degree of state change of the maintenance terminal and the maintained equipment. , , , and For the corresponding preset weights, and satisfy:

[0024]

[0025] Among them, each preset weight is not less than 0. , , , and The value range is 0 to 1; when the key rotation risk value Greater than or equal to the preset rotation threshold When the key rotation triggering condition is met, it is determined that the condition is satisfied.

[0026] Furthermore, the next-generation session authentication key is generated according to the following formula:

[0027]

[0028] in, For the first The next-generation session authentication key corresponding to the key generation. This is the next shared secret established through the aforementioned post-quantum key encapsulation mechanism. This is the identifier for the operation and maintenance session. For the next key generation identifier, This refers to the operation and maintenance authorization information corresponding to the remote operation and maintenance task. This is a summary of the operation and maintenance authorization information. This is the rotation random value corresponding to this key rotation. Derived function for key. This is a join function that executes data joins according to a preset field order.

[0029] Furthermore, the next-generation session authentication key is verified, including: generating key rotation authentication information based on the maintenance session identifier, the current key generation identifier, the next key generation identifier, the maintenance authorization information digest, and the rotation random variable; and generating the rotation authentication value corresponding to the key rotation authentication information according to the following formula:

[0030]

[0031] in, For the rotating authentication value, For the next-generation session authentication key Message authentication function as authentication key This serves as the identifier for the current key generation.

[0032] The operation and maintenance management platform and the device under maintenance calculate the rotation authentication value based on their respective generated next-generation session authentication keys. When the rotation authentication values ​​calculated by both parties are consistent, the operation and maintenance session identifier is consistent, and the next-generation key identifier is continuous with the current key generation identifier, the next-generation session authentication key is marked as a candidate valid state.

[0033] Furthermore, each maintenance operation in the old key allowed operation set is associated with at least an operation identifier, an operation parameter digest, a registration time, an execution status, and a completion time limit. When the device under maintenance receives a maintenance operation authenticated using the current generation session authentication key, it determines whether the operation identifier of the maintenance operation belongs to the old key allowed operation set, and whether the operation parameter digest of the maintenance operation is consistent with the operation parameter digest registered before the key switch. If the operation identifier of the maintenance operation belongs to the old key allowed operation set, the operation parameter digest is consistent, and the maintenance operation has not been completed and has not exceeded the corresponding completion time limit, the maintenance operation is allowed to continue execution; otherwise, the current generation session authentication key is refused to be used to authenticate the maintenance operation.

[0034] Furthermore, when the operation and maintenance management platform and the currently valid key generation identifier maintained by the device under maintenance and bound to the same operation and maintenance session identifier are inconsistent, key generation proof information containing the operation and maintenance session identifier, adjacent key generation association information, key rotation record, and key revocation record is obtained; the key generation proof information is verified by post-quantum digital signature, and the most recently consistent and unrevoked trusted key generation between the two parties is determined based on the verified key generation proof information; post-quantum key encapsulation is re-executed based on the trusted key generation to establish a new shared secret, and a new generation session authentication key jointly confirmed by the operation and maintenance management platform and the device under maintenance is generated, wherein revoked session authentication keys are not restored to a valid state.

[0035] A remote operation and maintenance authentication system based on post-quantum key rotation includes an operation and maintenance management platform, an operation and maintenance terminal, and the device being maintained. The system is configured with:

[0036] The identity authentication module is used to authenticate the identity of operation and maintenance personnel and operation and maintenance terminals using post-quantum digital signatures. It establishes a shared secret between the operation and maintenance management platform and the device under maintenance through a post-quantum key encapsulation mechanism, generates a current generation session authentication key based on the shared secret, and generates an operation and maintenance session identifier and a current key generation identifier. The operation and maintenance management platform and the device under maintenance respectively maintain a current valid key generation identifier bound to the operation and maintenance session identifier.

[0037] The operation chain construction module is used to determine the execution dependencies and interruption attributes of multiple operation and maintenance operations based on remote operation and maintenance tasks, construct the operation and maintenance operation chain, and determine the operation switching boundary.

[0038] The rotation judgment module is used to determine the key rotation risk value based on the usage duration, number of authentications and abnormal authentication records of the current generation session authentication key, as well as the current operation and maintenance operation, the status of the operation and maintenance terminal and the device under maintenance;

[0039] The key generation module is used to establish the next shared secret through the post-quantum key encapsulation mechanism and generate and verify the next generation session authentication key when the key rotation risk value meets the key rotation triggering condition.

[0040] The operation registration module is used to identify registered but not yet completed operation and maintenance operations as the set of operations allowed under the old key before key switching.

[0041] The key switching module is used to enable the next-generation session authentication key to be used to authenticate newly registered operations when the execution progress of the operation and maintenance chain reaches the operation switching boundary, and to enable the current-generation session authentication key to be used only to authenticate operations and maintenance operations in the set of operations allowed by the old key.

[0042] The key revocation and synchronization module is used to revoke the current generation session authentication key when all maintenance operations in the old key allowed operation set have been completed or canceled, or when the old key transition period expires, and to synchronously update the current valid key generation identifier maintained by the maintenance management platform and the maintained device and bound to the maintenance session identifier.

[0043] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method steps.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] 1. This invention constructs an operation chain based on the execution dependency and interruption attributes between operation and maintenance operations, and determines the operation switching boundary without dividing the uninterruptible operation segment, so that the session authentication key is switched at the appropriate operation and maintenance operation position, avoiding the direct interruption of the ongoing continuous operation and maintenance operation by key rotation, thereby improving the continuity and stability of the remote operation and maintenance process.

[0046] 2. Before the key switch, this invention identifies the registered but not yet completed operation and maintenance operations as the set of operations allowed by the old key, and stops assigning the current key generation identifier to newly registered operation and maintenance operations. This ensures that the old key is only used to complete specific operation and maintenance operations that were registered before the switch, while the newly registered operation and maintenance operations are authenticated by the next generation session authentication key. This can ensure that the original operation and maintenance operations are completed normally, while reducing the risk that the old key will be used for new operations, replay operations, or unauthorized operations during the transition phase.

[0047] 3. This invention comprehensively considers the usage duration of the current generation session authentication key, the number of authentications, abnormal authentication records, the risk status of the current operation and maintenance, and the status changes of the operation and maintenance terminal and the maintained equipment to determine the key rotation risk value. This allows the key rotation timing to be dynamically adjusted according to the operation and maintenance risk. Compared with simply rotating according to a fixed period or a fixed number of times, it can better balance authentication security, operation and maintenance efficiency, and post-quantum cryptographic operation overhead.

[0048] 4. This invention binds the operation and maintenance session identifier with the current valid key generation identifier, and the operation and maintenance management platform and the device being maintained maintain the corresponding key generation status respectively; when the key generations of the two parties are inconsistent, the trusted key generation is determined by the key generation proof information and the shared secret is re-established, and the revoked session authentication key is not restored, thereby improving the traceability of the key rotation process and the security of abnormal recovery. Attached Figure Description

[0049] Figure 1 This is a schematic diagram of the method flow of the present invention;

[0050] Figure 2This is a schematic diagram of the system modules of the present invention. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0052] Example 1

[0053] like Figure 1-2 As shown, this invention will be further explained in conjunction with an application scenario of remote maintenance of industrial control equipment. It should be understood that this embodiment is only used to illustrate the technical solution of this invention and is not intended to limit the scope of protection of this invention.

[0054] The remote operation and maintenance system in this embodiment includes an operation and maintenance management platform, an operation and maintenance terminal, and the device being maintained. The operation and maintenance management platform can be deployed in an enterprise operation and maintenance center, a cloud operation and maintenance server, or a bastion host; the operation and maintenance terminal can be a computer, mobile terminal, or dedicated debugging terminal used by operation and maintenance personnel; the device being maintained can be a server, an industrial controller, an edge gateway, a communication device, or other networked device that supports remote maintenance.

[0055] The operation and maintenance management platform pre-stores the following information: operation and maintenance personnel identity information, operation and maintenance terminal registration information, information of the devices being maintained, operation and maintenance permission information, post-quantum identity authentication public key, operation and maintenance operation type and corresponding risk level and interruption attribute. The devices being maintained store the following information: device identity information, key materials required for post-quantum key encapsulation, currently valid key generation identifier, and session status corresponding to each operation and maintenance session.

[0056] Remote operation and maintenance task creation and initial authentication

[0057] When maintenance personnel need to perform remote maintenance on the equipment being maintained, they submit a remote maintenance application to the maintenance management platform through the maintenance terminal. The remote maintenance task information may include the maintenance personnel identifier, maintenance terminal identifier, equipment being maintained identifier, maintenance task type, permitted operation scope, maintenance start time, maintenance end time, and approval information.

[0058] The operation and maintenance management platform uses the public key of the operation and maintenance personnel's identity signature to perform post-quantum digital signature verification on the identity authentication information sent by the operation and maintenance personnel through the operation and maintenance terminal, and combines the device certificate, terminal fingerprint or registration mark of the operation and maintenance terminal to authenticate the identity of the operation and maintenance terminal.

[0059] In this embodiment, the identity signing key corresponding to the post-quantum digital signature is mainly used for identity verification during the operation and maintenance session establishment phase. It belongs to a different key level than the session authentication key that is subsequently rotated. The identity signing key can be updated according to an independent certificate lifecycle. The key rotation described in this invention mainly targets the session authentication key used for operation and maintenance authentication after the operation and maintenance session is established.

[0060] After successful identity authentication, the operation and maintenance management platform and the device under maintenance perform a post-quantum key encapsulation process. The device under maintenance generates or provides a post-quantum key encapsulation public key. The operation and maintenance management platform generates ciphertext and a shared secret based on this public key. The device under maintenance uses the corresponding private key to decapsulate the ciphertext and obtain the same current shared secret.

[0061] Generate the current generation session authentication key based on the current shared secret, and generate a unique operation and maintenance session identifier (SID) and a current key generation identifier. .in, This indicates the current key generation number; the initial key generation can be set to 1.

[0062] The operation and maintenance management platform and the device being maintained shall establish the following session records respectively:

[0063] Session ID (SID), Current Valid Key Generation ID Current generation session authentication key The system includes: maintenance personnel identifier, maintenance terminal identifier, maintained device identifier, maintenance authorization information summary, session validity period, and current session status.

[0064] This ensures that the current generation session authentication key can only be used for the corresponding operation and maintenance session and the authorized operation and maintenance operation, avoiding the mixing of authentication keys between different sessions.

[0065] Construction of Operation and Maintenance Chain

[0066] The operations and maintenance management platform divides the remote operations and maintenance tasks to be executed into multiple operations based on the remote operations and maintenance task information. For example, a firmware upgrade task can be divided into:

[0067] Device status check, firmware file integrity verification, device storage space check, firmware data transfer, firmware writing, write result verification, boot partition switching, device restart and restart status confirmation.

[0068] For each operation and maintenance task, a corresponding operation node is established, and the operation node records at least the following:

[0069] Operation identifier, operation type, operation parameter summary, preceding operation identifier, subsequent operation identifier, execution status, interruption attribute, risk level, key generation identifier, registration time, and completion time limit.

[0070] The operation parameter digest can be calculated based on the operation type, operation object, operation parameters, and operation sequence number, and is used to prevent the operation parameters from being replaced after key rotation.

[0071] Execution status can include registered, sent, in progress, completed, failed, and canceled. At any given time, an operation has one of these execution statuses and can transition between different statuses as the operation progresses. For example, an operation can sequentially transition from the registered status to the sent status, the in progress status, and the completed status.

[0072] The interruption attribute of operation and maintenance is predetermined based on the operation and maintenance task type, operation instruction type, or instruction execution constraints. For example:

[0073] Status queries, log reads, and single parameter reads can be set to allow interruption.

[0074] The firmware data block continuous writing, boot partition switching, and device restart processes can be set to disable interruption.

[0075] Multiple configuration instructions that need to be executed consecutively can also be combined into a continuous operation segment with the property of disabling interruption.

[0076] Based on the execution dependencies between various operation and maintenance operations, a directed operation and maintenance operation chain is formed. Operation and maintenance operations that are consecutively arranged and have a non-interruptible attribute are divided into non-interruptible operation segments. Without splitting the non-interruptible operation segments, the positions between adjacent non-interruptible operation segments, the positions between non-interruptible operation segments and interruptible operations, and the positions between adjacent interruptible operations are determined as operation switching boundaries.

[0077] The operation switching boundary can be predetermined when constructing the operation and maintenance chain, and it does not depend on the operation completion status at runtime. When the key switch is actually performed, the completion status of the relevant operation and maintenance operations before the boundary is used to determine whether the switch is allowed.

[0078] Determining the risk value of key rotation

[0079] During the duration of the operation and maintenance session, the operation and maintenance management platform continuously obtains the cumulative usage time of the current generation session authentication key. Cumulative number of authentications Abnormal authentication records, current operation and maintenance risk values Authentication anomaly level and the degree of status change of the maintenance terminal and the equipment being maintained. .

[0080] The normalized value of the usage duration of the current generation session authentication key is determined by the following formula:

[0081]

[0082] The normalized value of the number of authentications is determined according to the following formula:

[0083]

[0084] in, To preset the usage time threshold, The preset authentication count threshold is used, and and All are greater than 0.

[0085] For example, it can be Set to 60 minutes, Set to 1000 times. When the current generation session authentication key has been used for 30 minutes, the usage duration normalization value is 0.5; when the number of authentications reaches or exceeds 1000 times, the authentication count normalization value is 1.

[0086] Current Operational Risk Value This can be preset according to the type of operation. For example, log reading corresponds to a lower risk value, parameter modification corresponds to a medium risk value, and firmware upgrade, permission adjustment, and control policy modification correspond to a higher risk value.

[0087] Authentication anomaly level The number of authentication failures can be determined based on the number of authentication failures, the proportion of failed messages, the amount of repeated random data, abnormal timestamps, or the number of suspected replay messages. For example, when no authentication anomalies occur, Set to 0; as the number of anomalies increases, It gradually increases, with a maximum value of 1.

[0088] Degree of state change This can be determined based on changes in the network address of the maintenance terminal, changes in the terminal device fingerprint, changes in the operating status of the maintained device, device restart status, or security alarm status. When the status of the maintenance terminal and the maintained device is stable... Take the lower value; increase the value when terminal replacement, abnormal device restart, or change in security status is detected. .

[0089] The key rotation risk value is determined by the following formula:

[0090]

[0091] Each preset weight is not less than 0 and satisfies the following conditions:

[0092]

[0093] For example, you can set For 0.20, 0.15 0.30 For 0.20, The value is 0.15. The above weights can be adjusted based on device type, maintenance task type, and security level.

[0094] When key rotation risk value Greater than or equal to the preset rotation threshold When the key rotation trigger condition is met, a preset rotation threshold is established. It can be set to 0.65. In other implementations, different rotation thresholds can be set for the maintained equipment with different security levels.

[0095] Generation of next-generation session authentication keys

[0096] After the key rotation trigger condition is met, the operation and maintenance management platform does not immediately revoke the current generation session authentication key. Instead, it first performs a new post-quantum key encapsulation process with the device being maintained to establish the next shared secret. .

[0097] Generate the next-generation session authentication key based on the next shared secret, the operation and maintenance session identifier, the next key generation identifier, the operation and maintenance authorization information digest, and the rotating random variable:

[0098]

[0099] in, For next-generation session authentication keys, To share secrets for the next time, For operation and maintenance session identification, For the next key generation identifier, This refers to the operation and maintenance authorization information corresponding to the current remote operation and maintenance task. For operation and maintenance authorization information summary, It is a rotating random variable.

[0100] The concatenation function `Concat` joins the input fields according to a preset field order. To avoid different field combinations producing the same concatenation result, each field can use a fixed-length encoding or a length-field-value encoding format. The key derivation function `KDF` can use a preset key derivation method based on a hash function.

[0101] Since the next-generation session authentication key is bound to the operation and maintenance session identifier, the key generation identifier, and the operation and maintenance authorization information, even if two operation and maintenance sessions use the same post-quantum key encapsulation algorithm, they will not generate interchangeable session authentication keys.

[0102] Verification of next-generation session authentication keys

[0103] The operation and maintenance management platform uses the operation and maintenance session identifier (SID) and the current key generation identifier. Next key generation identifier Summary of Operation and Maintenance Authorization Information and rotating random variables Generate key rotation authentication information and calculate the rotation authentication value:

[0104]

[0105] The operation and maintenance management platform sends the key rotation authentication information and rotation authentication value to the device under maintenance. The device under maintenance generates a local next-generation session authentication key based on the next shared secret obtained by local decapsulation, and recalculates the rotation authentication value using the local next-generation session authentication key.

[0106] The equipment being maintained must verify the following:

[0107] Whether the received operation and maintenance session identifier is consistent with the local session record; whether the current key generation identifier is consistent with the currently valid key generation identifier maintained locally; whether the next key generation identifier is the next consecutive generation of the current key generation identifier; whether the operation and maintenance authorization information digest is consistent with the current operation and maintenance task; whether the rotation random quantity has not been reused; and whether the rotation authentication values ​​calculated by both parties are consistent.

[0108] After successful verification, the device being maintained will mark the next-generation session authentication key as a candidate valid state. The candidate valid state indicates that the key has been generated and verified, but has not yet been used to authenticate newly registered maintenance operations.

[0109] If verification fails, key switching will not be performed. The current generation session authentication key will remain under control as long as it has not been revoked, and the next generation key generation process will be restarted.

[0110] The old key allows for the generation of operation sets.

[0111] After the next-generation session authentication key is verified, the operation and maintenance management platform obtains the operation and maintenance operations that have been registered but not yet completed in the current operation and maintenance operation chain and generates the old key allowed operation set.

[0112] For example, if a firmware data transfer operation has been registered and is in progress, and a firmware write operation has been registered but not yet completed when a key rotation is triggered, then these operations will be added to the old key-allowed operation set. Firmware verification operations and device reboot operations that have not yet been registered will not be added to this set.

[0113] The old key allows each operational operation in the operation set to be recorded at least as follows:

[0114] Operation identifier, operation parameter summary, registration time, execution status, completion time limit and current key generation identifier.

[0115] After generating the set of allowed operations for the old key, the operations and maintenance management platform stops assigning the current key generation identifier to newly registered operations and maintenance operations. Newly registered operations and maintenance operations will then wait until the next generation session authentication key is officially switched over before being assigned the next key generation identifier.

[0116] "Registered but not yet completed" means that the operation and maintenance operation has formed an operation record that cannot be changed or can be changed under control, and is in the state of being registered, sent or executed, but has not yet entered the state of being completed, canceled or ultimately failed.

[0117] Phased switchover of old and new session authentication keys

[0118] When the execution progress of the operation and maintenance operation chain reaches the predetermined operation switching boundary, the operation and maintenance management platform further checks whether the relevant operation and maintenance operations located before the operation switching boundary and having an execution dependency relationship with subsequent operation and maintenance operations have been completed or have ended in accordance with the preset exception handling rules.

[0119] When there are multiple related preceding maintenance operations, key switching should only be allowed after all of these operations have been completed or have been completed in accordance with the corresponding exception handling rules.

[0120] The termination according to the preset exception handling rules may include:

[0121] After rolling back failed operations, mark them as exceptions and terminate the process.

[0122] Cancel operations that cannot continue and remove their execution dependencies from subsequent operations;

[0123] Operations and maintenance tasks that require manual processing will be moved to a manual confirmation state, and the corresponding subsequent operations and maintenance tasks will be suspended.

[0124] When the above conditions are met and the next-generation session authentication key has been verified, the next-generation session authentication key will be switched to the currently valid session authentication key.

[0125] After the switch is complete:

[0126] Newly registered operation and maintenance personnel will be assigned a next-generation key identifier. and using next-generation session authentication keys Perform authentication;

[0127] Original current generation session authentication key Entering a restricted validity state, it can only be used for maintenance operations within the set of operations allowed for authenticating old keys;

[0128] The operation and maintenance session identifier (SID) remains unchanged to ensure session continuity for the same remote operation and maintenance task.

[0129] This process does not allow the new and old keys to be valid simultaneously within the same scope, but rather assigns the new and old keys to different operational scopes.

[0130] Restricted authentication of old keys

[0131] When the device being maintained receives a maintenance message that is authenticated using the original current generation session authentication key, it first extracts the maintenance session identifier, key generation identifier, operation identifier, and operation parameter digest from the message.

[0132] The equipment being maintained is being assessed as follows:

[0133] Whether the operation identifier belongs to the set of operations allowed by the old key;

[0134] Does the operation parameter digest match the operation parameter digest registered before the key switch?

[0135] Has the maintenance operation not yet been completed or canceled?

[0136] Did the maintenance operation not exceed the corresponding completion time limit?

[0137] Is the key generation identifier in the message the same as the original current key generation identifier?

[0138] Only when all of the above conditions are met is the maintenance equipment allowed to continue the maintenance operation.

[0139] If an attacker submits a new operation identifier or modifies existing operation parameters using the old key during the key transition period, the maintenance device will reject the operation because the operation does not belong to the set of operations allowed by the old key or the operation parameter digest is inconsistent.

[0140] Old key revocation

[0141] When all maintenance operations in the old key's allowed operation set have been completed or cancelled, the maintenance management platform and the maintained device revoke the original current generation session authentication key.

[0142] If some maintenance operations are not completed for a long time, the incomplete operations will be cancelled, rolled back, or manually confirmed when the old key transition period expires, and the original current generation session authentication key will be revoked to avoid the old key remaining in a restricted valid state for a long time.

[0143] After the cancellation is completed, the operation and maintenance management platform and the equipment being maintained will respectively:

[0144] Mark the original current generation session authentication key as revoked;

[0145] Delete, overwrite, or isolate the corresponding key materials;

[0146] Reject all new authentication messages submitted using this key generation identifier;

[0147] Next key generation identifier Update to the current valid key generation identifier bound to the operation and maintenance session identifier SID;

[0148] Record the key revocation time, revocation reason, and rotation result.

[0149] A revoked session authentication key cannot be restored to a valid state due to subsequent authentication failures, network recovery, or device re-connection.

[0150] Key generation asynchronous processing

[0151] In the event of network outages, device offline, or loss of rotation confirmation messages, the current valid key generation identifier maintained by the operation and maintenance management platform and the device being maintained may be inconsistent.

[0152] For example, the operation and maintenance management platform has updated the current valid key generation to The equipment being maintained is still recorded as At this point, both parties suspended accepting new high-risk operation and maintenance tasks and obtained key generation proof information.

[0153] Key generation proof information may include:

[0154] Operation and maintenance session identifier, adjacent key generation association information, time of each key rotation, rotation random quantity digest, key rotation result, key revocation record and corresponding post-quantum digital signature.

[0155] Both parties perform post-quantum digital signature verification on the key generation proof information and determine the most recently agreed-upon and unrevoked trusted key generation.

[0156] "Re-execute post-quantum key encapsulation based on trusted key generation" means re-execute a new post-quantum key encapsulation process using the session state, operation and maintenance authorization information and rotation record corresponding to the trusted key generation as the synchronization starting point, instead of directly deriving a new key from the old session authentication key corresponding to the trusted key generation.

[0157] After re-establishing the shared secret, both parties generate and jointly confirm a new session authentication key and a new key generation identifier. Session authentication keys that have been recorded as revoked cannot be reactivated.

[0158] System Implementation

[0159] In this embodiment, the remote operation and maintenance authentication system can be implemented through software modules, hardware circuits, or a combination of software and hardware.

[0160] The identity authentication module is used to perform post-quantum digital signature verification, post-quantum key encapsulation, initial session authentication key generation, and the establishment of operation and maintenance session identifiers and key generation identifiers.

[0161] The operation chain construction module is used to parse remote operation and maintenance tasks, break down the operation and maintenance tasks into multiple operation and maintenance operations, construct operation and maintenance operation chains based on operation dependencies and interruption attributes, and determine operation switching boundaries.

[0162] The key rotation judgment module is used to collect key usage duration, authentication count, abnormal authentication records, current operational risks, and changes in terminal and device status, and to calculate the key rotation risk value.

[0163] The key generation module is used to perform the next post-quantum key encapsulation, generate the next generation session authentication key, and complete the rotation authentication.

[0164] The operation registration module is used to generate the set of operations allowed for the old key before key switching, and to restrict the registration of new operation and maintenance operations for the current generation session authentication key.

[0165] The key switching module is used to complete the phased switching of the old and new session authentication keys when the operation chain execution progress reaches the operation switching boundary and the relevant switching conditions are met.

[0166] The key revocation and synchronization module is used to revoke old session authentication keys, update the current valid key generation identifier, and perform generation proof verification and resynchronization when key generations are inconsistent.

[0167] The above implementation method enables the rotation of quantum session authentication keys without interrupting remote operation and maintenance, while restricting the old keys to be used only for operation and maintenance operations that were registered before the rotation, thus balancing the continuity of remote operation and maintenance with the security of key rotation.

[0168] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A remote operation and maintenance authentication method based on post-quantum key rotation, characterized in that, The method, applicable to a remote operation and maintenance system including an operation and maintenance management platform, operation and maintenance terminals, and the equipment being maintained, includes the following steps: S1. Obtain remote operation and maintenance task information, use post-quantum digital signature to authenticate the operation and maintenance personnel and operation and maintenance terminal, and establish a current shared secret between the operation and maintenance management platform and the device under maintenance through a post-quantum key encapsulation mechanism. Generate a current generation session authentication key based on the current shared secret, and generate an operation and maintenance session identifier and a current key generation identifier. The identity signature key corresponding to the post-quantum digital signature is used for identity authentication when establishing the operation and maintenance session, and the current generation session authentication key is used for operation and maintenance operation authentication after the operation and maintenance session is established. The operation and maintenance management platform and the device under maintenance respectively maintain a current valid key generation identifier bound to the operation and maintenance session identifier. S2. Based on the remote operation and maintenance task information, determine multiple operation and maintenance operations and the execution dependencies between each operation and maintenance operation. Based on the operation and maintenance task type, operation instruction type, or instruction execution constraint, determine the interruption attribute of each operation and maintenance operation. Based on the execution dependencies and interruption attributes, construct an operation and maintenance operation chain and determine the operation switching boundary in the operation and maintenance operation chain. S3. Based on the usage duration, authentication count, and abnormal authentication records of the current generation session authentication key, as well as the risk status of the current operation and maintenance, and the status changes of the operation and maintenance terminal and the maintained device, determine the key rotation risk value; when the key rotation risk value meets the key rotation triggering condition, establish the next shared secret through the post-quantum key encapsulation mechanism, generate the next generation session authentication key based on the next shared secret, and verify the next generation session authentication key; S4. Before performing the key switch, identify the registered but not yet completed operation and maintenance operations in the operation and maintenance operation chain as the old key allowed operation set, and stop assigning the current key generation identifier to newly registered operation and maintenance operations. S5. When the execution progress of the operation and maintenance operation chain reaches an operation switching boundary, the operation and maintenance operation located before the operation switching boundary and having an execution dependency relationship with the subsequent operation and maintenance operation has been completed or ended according to the preset exception handling rules, and the next-generation session authentication key is verified, the next-generation session authentication key is switched to the currently valid session authentication key, so that the newly registered operation and maintenance operation after the switch uses the next-generation session authentication key for authentication, and the current generation session authentication key is only used to authenticate the operation and maintenance operation in the old key allowed operation set; S6. When all maintenance operations in the old key allowed operation set have been completed or cancelled, or when the old key transition period expires, the current generation session authentication key is revoked, and the maintenance management platform and the maintained device update the next key generation identifier to the currently valid key generation identifier bound to the maintenance session identifier; wherein, the revoked session authentication key is not restored to a valid state.

2. The remote operation and maintenance authentication method based on post-quantum key rotation according to claim 1, characterized in that, Each operation in the operation chain has an operation identifier, an operation parameter summary, an execution dependency, an execution status, an interruption attribute, and a key generation identifier; the execution status includes at least one of registered, sent, in execution, completed, failed, and canceled; the interruption attribute includes an interruption allowed attribute or an interruption prohibited attribute.

3. The remote operation and maintenance authentication method based on post-quantum key rotation according to claim 2, characterized in that, Determining the operation switching boundary in the operation and maintenance operation chain includes: dividing consecutively arranged operation and maintenance operations with non-interruptible attributes into non-interruptible operation segments according to the execution dependency relationship of each operation and maintenance operation; without dividing the non-interruptible operation segments, determining the positions between adjacent non-interruptible operation segments, the positions between non-interruptible operation segments and operation and maintenance operations with permissible interruption attributes, and the positions between adjacent operation and maintenance operations with permissible interruption attributes as the operation switching boundary.

4. The remote operation and maintenance authentication method based on post-quantum key rotation according to claim 1, characterized in that, The normalized values ​​of the usage duration and authentication count of the current generation session authentication key are determined according to the following formulas: in, For the first Normalized value of usage duration corresponding to key generation. The cumulative usage time of the current generation session authentication key. To preset the usage time threshold, For the first Normalized value of authentication count corresponding to key generation. The cumulative number of authentications for the current generation session authentication key. The preset threshold for the number of authentication attempts; The key rotation risk value is determined according to the following formula: in, For the first The key generation corresponds to the key rotation risk value. This represents the risk value of the current operation and maintenance. To determine the degree of authentication anomaly, The degree of state change of the maintenance terminal and the maintained equipment. , , , and For the corresponding preset weights, and satisfy: Among them, each preset weight is not less than 0. , , , and The value range is 0 to 1; when the key rotation risk value Greater than or equal to the preset rotation threshold When the key rotation triggering condition is met, it is determined that the condition is satisfied.

5. The remote operation and maintenance authentication method based on post-quantum key rotation according to claim 1, characterized in that, The next-generation session authentication key is generated according to the following formula: in, For the first The next-generation session authentication key corresponding to the key generation. This is the next shared secret established through the aforementioned post-quantum key encapsulation mechanism. This is the identifier for the operation and maintenance session. For the next key generation identifier, This refers to the operation and maintenance authorization information corresponding to the remote operation and maintenance task. This is a summary of the operation and maintenance authorization information. This is the rotation random value corresponding to this key rotation. Derived function for key. This is a join function that executes data joins according to a preset field order.

6. The remote operation and maintenance authentication method based on post-quantum key rotation according to claim 5, characterized in that, Verifying the next-generation session authentication key includes: generating key rotation authentication information based on the maintenance session identifier, the current key generation identifier, the next key generation identifier, the maintenance authorization information digest, and the rotation random variable; and generating the rotation authentication value corresponding to the key rotation authentication information according to the following formula: in, For the rotating authentication value, For the next-generation session authentication key Message authentication function as authentication key This serves as the identifier for the current key generation. The operation and maintenance management platform and the device under maintenance calculate the rotation authentication value based on their respective generated next-generation session authentication keys. When the rotation authentication values ​​calculated by both parties are consistent, the operation and maintenance session identifier is consistent, and the next-generation key identifier is continuous with the current key generation identifier, the next-generation session authentication key is marked as a candidate valid state.

7. The remote operation and maintenance authentication method based on post-quantum key rotation according to claim 2, characterized in that, Each maintenance operation in the old key allowed operation set is associated with at least an operation identifier, an operation parameter digest, a registration time, an execution status, and a completion time limit. When the device under maintenance receives a maintenance operation authenticated using the current generation session authentication key, it determines whether the operation identifier of the maintenance operation belongs to the old key allowed operation set and whether the operation parameter digest of the maintenance operation is consistent with the operation parameter digest registered before the key switch. If the operation identifier of the maintenance operation belongs to the old key allowed operation set, the operation parameter digest is consistent, and the maintenance operation has not been completed and has not exceeded the corresponding completion time limit, the maintenance operation is allowed to continue. Otherwise, the current generation session authentication key is refused to be used to authenticate the maintenance operation.

8. The remote operation and maintenance authentication method based on post-quantum key rotation according to claim 1, characterized in that, When the operation and maintenance management platform and the currently valid key generation identifier maintained by the device under maintenance and bound to the same operation and maintenance session identifier are inconsistent, the platform obtains key generation proof information containing the operation and maintenance session identifier, adjacent key generation association information, key rotation records, and key revocation records; performs post-quantum digital signature verification on the key generation proof information, and determines the most recently consistent and unrevoked trusted key generation based on the verified key generation proof information; re-executes post-quantum key encapsulation based on the trusted key generation, establishes a new shared secret, and generates a new generation session authentication key jointly confirmed by the operation and maintenance management platform and the device under maintenance, wherein revoked session authentication keys are not restored to a valid state.

9. A remote operation and maintenance authentication system based on post-quantum key switching, characterized in that, The system includes an operation and maintenance management platform, operation and maintenance terminals, and the equipment being maintained. The system is configured with: The identity authentication module is used to authenticate the identity of operation and maintenance personnel and operation and maintenance terminals using post-quantum digital signatures. It establishes a shared secret between the operation and maintenance management platform and the device under maintenance through a post-quantum key encapsulation mechanism, generates a current generation session authentication key based on the shared secret, and generates an operation and maintenance session identifier and a current key generation identifier. The operation and maintenance management platform and the device under maintenance respectively maintain a current valid key generation identifier bound to the operation and maintenance session identifier. The operation chain construction module is used to determine the execution dependencies and interruption attributes of multiple operation and maintenance operations based on remote operation and maintenance tasks, construct the operation and maintenance operation chain, and determine the operation switching boundary. The rotation judgment module is used to determine the key rotation risk value based on the usage duration, number of authentications and abnormal authentication records of the current generation session authentication key, as well as the current operation and maintenance operation, the status of the operation and maintenance terminal and the maintained device. The key generation module is used to establish the next shared secret through the post-quantum key encapsulation mechanism and generate and verify the next generation session authentication key when the key rotation risk value meets the key rotation triggering condition. The operation registration module is used to identify registered but not yet completed operation and maintenance operations as the set of operations allowed under the old key before key switching. The key switching module is used to enable the next-generation session authentication key to be used to authenticate newly registered operations when the execution progress of the operation and maintenance chain reaches the operation switching boundary, and to enable the current-generation session authentication key to be used only to authenticate operations and maintenance operations in the set of operations allowed by the old key. The key revocation and synchronization module is used to revoke the current generation session authentication key when all maintenance operations in the old key allowed operation set have been completed or canceled, or when the old key transition period expires, and to synchronously update the current valid key generation identifier maintained by the maintenance management platform and the maintained device and bound to the maintenance session identifier.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method described in any one of claims 1 to 8.

Images