Session key updating method, device and computer equipment

Abstract

The application relates to a session key updating method, device and computer equipment. The method comprises the following steps: monitoring running parameters in a session process under the condition that a secure session is established, selecting other security parameter sets under the condition that the running parameters meet preset requirements, and re-executing a key encapsulation process and a signature exchange process with a communication response end based on the selected other security parameter sets and in combination with negotiation parameters of the current secure session to generate a transition session key and new encapsulation ciphertext; sending a new to-be-signed message digest and the new encapsulation ciphertext to the communication response end, and replacing the transition session key with a new current main session key and continuing the secure session with the communication response end based on the new current main session key in response to an acknowledgement message returned by the communication response end. The key updating can be completed according to a running time security state in the secure session, thereby improving communication efficiency.

Description

Technical Field

[0001] This application relates to the field of post-quantum cryptography, and in particular to a session key update method, apparatus, and computer device. Background Technology

[0002] With the rapid development of quantum computing technology, Shor's algorithm and Grover's algorithm can crack traditional public-key cryptography such as RSA and elliptic curve cryptography, which are public-key cryptographic algorithms for large integer factorization. Post-quantum cryptography has emerged, which has the characteristics of resisting quantum computing cracking and has given rise to three traditional processing methods: TLS embedding, hybrid cryptographic parallelism, and static policy configuration.

[0003] Traditional solutions often directly replace a single post-quantum algorithm or run two sets of cryptographic processes, classical and post-quantum, in parallel, relying on static configuration to switch security parameters.

[0004] However, the existing handshake method has high latency, lacks quantitative guarantee of key entropy, requires reconnection interruption when switching security levels, and lacks runtime abnormal monitoring mechanism, which cannot resist verification errors caused by quantum side channel interference, making it difficult to balance communication efficiency and continuous security. Summary of the Invention

[0005] Therefore, it is necessary to provide a session key update method, apparatus, and computer device to address the above-mentioned technical problems. This method and apparatus can adaptively complete key renegotiation and key update based on the runtime security state within an established secure session, thereby improving communication efficiency.

[0006] Firstly, this application provides a session key update method, including:

[0007] When a secure session has been established between the communication initiator and the communication responder, the runtime error count vector and average decryption time statistics are monitored during the session; the current secure session corresponds to the current master session key and the current security parameter set;

[0008] If any count dimension in the runtime error count vector exceeds the corresponding threshold value in the preset security level switching threshold array, or if the average decryption time statistic deviates from the historical baseline by a preset percentage, another security parameter set is selected from the algorithm family to which the current security parameter set belongs. Based on the selected other security parameter set and combined with the existing negotiated parameters of the current security session, the key encapsulation process and signature exchange process are re-executed with the communication response end to generate a transition session key and a new encapsulated ciphertext. The security strength of the other security parameter set is different from that of the current security parameter set.

[0009] The new message digest to be signed and the new encapsulated ciphertext are sent to the communication responder. In response to the confirmation message returned by the communication responder, the transition session key is replaced with the new current master session key, and the secure session continues with the communication responder based on the new current master session key.

[0010] In one embodiment, the runtime error count vector includes at least one of the following:

[0011] The failure count vector for decapsulation operations in the post-quantum key encapsulation algorithm;

[0012] The signature verification operation failure count vector of the post-quantum digital signature algorithm;

[0013] A count vector for integrity verification failures in authentication encryption operations.

[0014] In one embodiment, replacing the transition session key with the new current master session key includes:

[0015] Replace the transition session key with the new current master session key using an atomic switch.

[0016] In one embodiment, based on other selected security parameter sets and combined with existing negotiated parameters of the current secure session, the key encapsulation process and signature exchange process are re-executed with the communication response end to generate a transitional session key and new encapsulated ciphertext, including:

[0017] Based on the selected set of other security parameters and the first temporary key encapsulated in the negotiation parameters of the current security session, the encapsulation operation of the post-quantum key encapsulation algorithm is re-executed to generate a new encapsulated ciphertext and a new shared secret seed.

[0018] The initial transition session key is derived from the new shared secret seed; a new message digest to be signed is generated based on the new encapsulated ciphertext and the first protocol random challenge number in the existing negotiation parameters of the current secure session.

[0019] The new encapsulated ciphertext and the new message digest to be signed are sent to the communication response end, so that the communication response end can decapsulate the new encapsulated ciphertext to obtain a new shared secret seed, derive the initial transition session key, and generate a new digital signature value based on the new message digest to be signed.

[0020] The system receives a new digital signature value from the communication response end, performs a post-quantum digital signature algorithm verification operation on the new digital signature value, and if the verification is successful, uses the initial transition session key as the final transition session key.

[0021] In one embodiment, a new message digest to be signed is generated based on the new encapsulated ciphertext and the first protocol random challenge number in the existing negotiation parameters of the current secure session, including:

[0022] The new encapsulated ciphertext and the first protocol random challenge number are concatenated to obtain concatenated data;

[0023] Perform a hash operation on the cascaded data to generate a new message digest to be signed.

[0024] In one embodiment, a preset entropy convergence quantization model is used to quantize the quantum-resistant redundancy entropy of the session key material corresponding to the current session.

[0025] Correspondingly, the methods also include:

[0026] If the quantum-resistant redundancy entropy obtained by quantization is lower than the preset security entropy threshold, other security parameter sets are selected from the algorithm family to which the current security parameter set belongs.

[0027] In one embodiment, the process of establishing a secure session between the communication initiator and the communication responder includes:

[0028] In response to the handshake request, based on the current system timestamp and hardware random source, a first temporary key is generated to encapsulate the public key and the first protocol random challenge number. The first temporary key encapsulates the public key, the first protocol random challenge number, and the algorithm family identifier into a handshake initialization message and sends it to the communication response end.

[0029] Receive the handshake response message returned by the communication response end, and extract the second encapsulated ciphertext, the first digital signature value, and the response end's digital certificate object from the handshake response message;

[0030] The decapsulation operation is performed based on the second encapsulated ciphertext and the first temporary key encapsulated private key corresponding to the first temporary key encapsulated public key; the digital signature algorithm is verified based on the first digital signature value, the responding digital certificate object, and the first message digest to be signed; wherein, the first message digest to be signed is generated by calculating the concatenated data of the first encapsulated ciphertext and the first protocol random challenge number; the first encapsulated ciphertext is generated by calculating the first temporary key encapsulated public key;

[0031] If the verification operation is successful, a first-level session key material is generated based on the decapsulation result, the first protocol random challenge number, and the second protocol random response number. The current master session key is then derived from the first-level session key material to establish a secure session. The second protocol random response number is extracted from the handshake response message.

[0032] In one embodiment, the decapsulation result is the second shared secret seed; accordingly, based on the decapsulation result, the first protocol random challenge number, and the second protocol random response number, first-level session key material is generated, including:

[0033] The second shared secret seed, the first protocol random challenge number, and the second protocol random response number are concatenated to generate the first-level session key material and the protocol random derivation number.

[0034] Secondly, this application also provides a session key update device, comprising:

[0035] The monitoring module is used to monitor the runtime error count vector and average decryption time statistics during a secure session when a secure session has been established between the communication initiator and the communication responder. The current secure session corresponds to the current master session key and the current security parameter set.

[0036] The generation module is used to select other security parameter sets from the algorithm family to which the current security parameter set belongs when it detects that any count dimension in the runtime error count vector exceeds the corresponding threshold value in the preset security level switching threshold array, or when the average decryption time statistics offset from the historical baseline exceeds a preset percentage. Based on the selected other security parameter sets and combined with the existing negotiation parameters of the current security session, the module re-executes the key encapsulation process and signature exchange process with the communication response end to generate a transition session key and a new encapsulated ciphertext. The security strength of other security parameter sets is different from that of the current security parameter set.

[0037] The update module is used to send the new message digest to be signed and the new encapsulated ciphertext to the communication response end, and in response to the confirmation message returned by the communication response end, replace the transition session key with the new current master session key, and continue the secure session with the communication response end based on the new current master session key.

[0038] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0039] When a secure session has been established between the communication initiator and the communication responder, the runtime error count vector and average decryption time statistics are monitored during the session; the current secure session corresponds to the current master session key and the current security parameter set;

[0040] If any count dimension in the runtime error count vector exceeds the corresponding threshold value in the preset security level switching threshold array, or if the average decryption time statistic deviates from the historical baseline by a preset percentage, another security parameter set is selected from the algorithm family to which the current security parameter set belongs. Based on the selected other security parameter set and combined with the existing negotiated parameters of the current security session, the key encapsulation process and signature exchange process are re-executed with the communication response end to generate a transition session key and a new encapsulated ciphertext. The security strength of the other security parameter set is different from that of the current security parameter set.

[0041] The new message digest to be signed and the new encapsulated ciphertext are sent to the communication responder. In response to the confirmation message returned by the communication responder, the transition session key is replaced with the new current master session key, and the secure session continues with the communication responder based on the new current master session key.

[0042] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0043] When a secure session has been established between the communication initiator and the communication responder, the runtime error count vector and average decryption time statistics are monitored during the session; the current secure session corresponds to the current master session key and the current security parameter set;

[0044] If any count dimension in the runtime error count vector exceeds the corresponding threshold value in the preset security level switching threshold array, or if the average decryption time statistic deviates from the historical baseline by a preset percentage, another security parameter set is selected from the algorithm family to which the current security parameter set belongs. Based on the selected other security parameter set and combined with the existing negotiated parameters of the current security session, the key encapsulation process and signature exchange process are re-executed with the communication response end to generate a transition session key and a new encapsulated ciphertext. The security strength of the other security parameter set is different from that of the current security parameter set.

[0045] The new message digest to be signed and the new encapsulated ciphertext are sent to the communication responder. In response to the confirmation message returned by the communication responder, the transition session key is replaced with the new current master session key, and the secure session continues with the communication responder based on the new current master session key.

[0046] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0047] When a secure session has been established between the communication initiator and the communication responder, the runtime error count vector and average decryption time statistics are monitored during the session; the current secure session corresponds to the current master session key and the current security parameter set;

[0048] If any count dimension in the runtime error count vector exceeds the corresponding threshold value in the preset security level switching threshold array, or if the average decryption time statistic deviates from the historical baseline by a preset percentage, another security parameter set is selected from the algorithm family to which the current security parameter set belongs. Based on the selected other security parameter set and combined with the existing negotiated parameters of the current security session, the key encapsulation process and signature exchange process are re-executed with the communication response end to generate a transition session key and a new encapsulated ciphertext. The security strength of the other security parameter set is different from that of the current security parameter set.

[0049] The new message digest to be signed and the new encapsulated ciphertext are sent to the communication responder. In response to the confirmation message returned by the communication responder, the transition session key is replaced with the new current master session key, and the secure session continues with the communication responder based on the new current master session key.

[0050] The aforementioned session key update method, apparatus, and computer equipment, based on the establishment of a secure session between the two communicating parties, monitor the runtime error count vector and average decryption time statistics during the session operation. When the indicators meet the switching conditions, other sets of security parameters with different security strengths are selected within the same algorithm family. The negotiated parameters already generated in the current secure session are reused, and the key encapsulation process and signature exchange process are re-completed with the communication response end to obtain a transition session key. After the key replacement is completed, the original secure session communication continues to be maintained. On the one hand, this solution can update security parameters and session keys without rebuilding the entire handshake session, avoiding session interruptions and business data flow interruptions caused by reconnection. On the other hand, it triggers security parameter switching based on the actual abnormalities and performance deviations during session operation, rather than using fixed static configurations. This allows for adaptive adjustment of security strength according to the actual risk situation of the session. It can both increase the security level to resist potential attacks when abnormal signs are detected and avoid unnecessary performance overhead caused by indiscriminate upgrades, thus balancing communication security and operational performance. At the same time, the update process reuses existing negotiated parameters in the session to renegotiate keys, eliminating the need to regenerate the entire set of negotiation materials. This reduces interaction and computational overhead, enabling dynamic updates of session keys and security capabilities online. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 This is a diagram illustrating the application environment of the session key update method in one embodiment;

[0053] Figure 2 This is a flowchart illustrating a session key update method in one embodiment;

[0054] Figure 3 This is a flowchart illustrating the steps for generating the transition session key and the new encapsulated ciphertext in one embodiment.

[0055] Figure 4 This is a flowchart illustrating the secure session establishment steps in one embodiment;

[0056] Figure 5 This is a flowchart illustrating the session key update method in another embodiment;

[0057] Figure 6 This is a structural block diagram of a session key update device in one embodiment;

[0058] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0060] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0061] The session key update method provided in this application can be applied to, for example... Figure 1In the application environment shown, the communication initiator 102 and the communication responder 104 are connected. Specifically, when a secure session has been established between the communication initiator 102 and the communication responder 104, the communication initiator 102 monitors the runtime error count vector and the average decryption time statistics during the session. The current secure session corresponds to the current master session key and the current security parameter set. If the communication initiator 102 detects that any count dimension in the runtime error count vector exceeds the corresponding threshold value in the preset security level switching threshold array, or that the offset of the average decryption time statistics relative to the historical baseline exceeds a preset percentage, it selects another security parameter set from the algorithm family to which the current security parameter set belongs, and based on... The selected other security parameter sets, combined with the existing negotiated parameters of the current security session, re-execute the key encapsulation process and signature exchange process with the communication response end 104 to generate a transition session key and a new encapsulated ciphertext; the security strength of the other security parameter sets is different from the security strength of the current security parameter set; the communication initiator 102 sends the new message digest to be signed and the new encapsulated ciphertext to the communication response end 104, and in response to the confirmation message returned by the communication response end 104, replaces the transition session key with the new current master session key, and continues the security session with the communication response end 104 based on the new current master session key.

[0062] It should be noted that the steps of the method described in this application are implemented by the protocol stack of the communication initiator. The active security guard thread, in-situ switching controller, and secure session buffer mentioned in the subsequent description of this embodiment are all software functional units within the protocol stack. They are optional internal implementation forms for implementing this method, used to complete indicator monitoring, switching logic scheduling, and session context data storage, and are not essential limiting features of this method. This method is not limited to being implemented in the form of threads or controller components. Those skilled in the art can also use other equivalent methods such as state machines, function modules, and hardware logic to complete the same function.

[0063] In one exemplary embodiment, such as Figure 2 As shown, a session key update method is provided, which is applied to... Figure 1 Taking the active security guard thread of the protocol stack in the communication initiator 102 as an example, the following steps are included:

[0064] S210, when a secure session has been established between the communication initiator and the communication responder, monitor the runtime error count vector and average decryption time statistics during the session.

[0065] The current secure session corresponds to the current master session key and the current security parameter set. The current security parameter set belongs to the same algorithm family as the post-quantum key encapsulation algorithm and the post-quantum digital signature algorithm. The security parameter set is used to define the specific security level under the algorithm family and includes at least one of the following: key length, ciphertext output length, hash algorithm selection, and key derivation parameter configuration.

[0066] Error count vectors reflect the frequency of anomalies in various cryptographic operations (such as decapsulation failures, signature verification failures, and integrity verification failures), serving as an early indicator of attack activities (especially quantum side-channel attacks and fault injection attacks). Decryption time statistics reflect the performance degradation of cryptographic operations, effectively capturing timing side-channel attacks or denial-of-service attacks targeting post-quantum algorithms.

[0067] In one alternative implementation, the runtime error count vector includes at least one of the following: a failure count vector for decapsulation operation of the post-quantum key encapsulation algorithm; a failure count vector for signature verification operation of the post-quantum digital signature algorithm; and a failure count vector for integrity verification of the authentication encryption operation.

[0068] Specifically, after the protocol stack establishes a secure session, the proactive security guard thread is permanently scheduled and runs. This thread reads the session context from the protocol stack's secure session cache, maintains and updates the runtime error count vector and the decryption operation time sampling queue in real time. Each time an exception occurs during the execution of the post-quantum key encapsulation / decapsulation operation, post-quantum digital signature verification operation, or authentication encryption integrity verification operation, the proactive security guard thread increments the corresponding dimension of the runtime error count vector. Simultaneously, the proactive security guard thread collects the actual time consumed by multiple decryption operations, calculates the average decryption time, and reads the locally stored historical baseline. The historical baseline is the decryption time benchmark obtained under normal load and no attack conditions for the corresponding security parameter set of this algorithm family.

[0069] S220: If any count dimension in the runtime error count vector exceeds the corresponding threshold value in the preset security level switching threshold array, or if the average decryption time statistics deviate from the historical baseline by a preset percentage, select another security parameter set from the algorithm family to which the current security parameter set belongs. Based on the selected other security parameter set and combined with the negotiation parameters already present in the current security session, re-execute the key encapsulation process and signature exchange process with the communication response end to generate a transition session key and a new encapsulated ciphertext.

[0070] The security strength of other security parameter sets differs from that of the current security parameter set. The preset security level switching threshold array and preset percentage can be determined based on human experience or through extensive experimentation; this application does not impose any limitations on this.

[0071] In this embodiment, by pre-setting a security level switching threshold array, the protocol stack can gradually upgrade the security level according to the actual threat situation. When a lower-level anomaly is detected, it switches to the medium security parameter set, and when a serious anomaly is detected, it switches to the highest security parameter set. This avoids excessively aggressive security upgrades from causing unnecessary impact on system performance and achieves a dynamic balance between security and performance.

[0072] In some embodiments, the process of re-executing key encapsulation can be as follows: the in-situ switching controller in the communication initiator loads the post-quantum key encapsulation algorithm implementation corresponding to the selected other security parameter set, encapsulates the public key using the first temporary key, executes the encapsulation operation of the post-quantum key encapsulation algorithm, and generates a new encapsulated ciphertext and a new shared secret seed; the initial transition session key is derived based on the new shared secret seed; the new encapsulated ciphertext is concatenated with the first protocol random challenge number saved in the session to obtain concatenated data, and a hash operation is performed on the concatenated data to generate a new message digest to be signed.

[0073] In some embodiments, the process of re-executing the signature exchange can be as follows: the initiating end sends a new encapsulated ciphertext and a new message digest to be signed to the responding end; the responding end reuses its corresponding session context, performs decapsulation based on the received new encapsulated ciphertext to obtain a new shared secret seed, derives an initial transition session key, and generates a new digital signature value based on the new message digest to be signed; the responding end sends the new digital signature value back to the initiating end; the initiating end receives the new digital signature value returned by the responding end, calls the post-quantum digital signature algorithm to perform a signature verification operation; after the signature verification is successful, the initial transition session key is determined as the transition session key.

[0074] It should be noted that the key encapsulation process and signature exchange process re-executed in this embodiment reuse the cryptographic processing logic of the handshake to establish a secure session in this application. The difference is that in the in-situ parameter switching scenario, the first temporary key encapsulates the public key, the second temporary key encapsulates the public key, the first protocol random challenge number, the second protocol random response number, and the session recovery identifier that have been generated and persistently stored in the session. It is not necessary to regenerate the complete set of handshake initialization messages and handshake response messages. A round of lightweight renegotiation is completed on the basis of the existing session context, thereby achieving a security level upgrade without rebuilding the connection.

[0075] The specific logic of the handshake to establish a secure session will be further described in subsequent embodiments.

[0076] In an optional implementation, a preset entropy convergence quantization model can also be used to quantize the quantum-resistant redundancy entropy of the session key material corresponding to the current session; correspondingly, if the quantized quantum-resistant redundancy entropy is lower than the preset security entropy threshold, other security parameter sets are selected from the algorithm family to which the current security parameter set belongs.

[0077] For example, the proactive security guard thread calls the entropy convergence calculation formula, inputting the first-level session key material of the current session, the number of first protocol random challenges, the number of second protocol random responses, the number of protocol random derivations, the runtime error count vector tensor, the decryption delay offset tensor, and the security level switching threshold array of the hybrid security policy configuration object, and quantizes and outputs the quantum-resistant redundancy entropy of the current session key material; compares the calculated quantum-resistant redundancy entropy with the preset security entropy threshold; when the quantum-resistant redundancy entropy is lower than the preset security entropy threshold, the in-situ parameter switching logic is also triggered, and the above steps of selecting other security parameter sets, re-executing the key encapsulation process and the signature exchange process are executed.

[0078] The preset security entropy threshold can be determined based on human experience or through a large number of experiments; this application does not impose any restrictions on it.

[0079] For example, the communication initiator reads the first-level session key material, the first protocol random challenge number, the second protocol random response number, and the protocol random derivation number stored in the session context. Simultaneously, it reads the runtime error count vector obtained from the current session statistics, the decryption time statistics, and the hybrid security policy configuration object. These parameters are then input into the entropy convergence quantization model, which uses the following entropy convergence calculation formula:

[0080] ;

[0081] In the formula, This is the material for the first-level session key; The random entropy of the XOR fusion result of the three random numbers is aggregated from the random challenge number of the first protocol, the random response number of the second protocol, and the random derivation number of the protocol. Quantum security level coefficient; The Frobenius norm of the safety threshold tensor; It is a runtime error count vector tensor; To decrypt the time delay offset tensor; The outer product norm of the tensor gradient for the security strategy; This is the L1 regularization constraint for the security policy.

[0082] Substitute the above parameters to calculate the quantum-resistant redundancy entropy corresponding to the current session key material. Compare the calculation result with the preset security entropy threshold. If the quantum-resistant redundancy entropy is lower than the preset security entropy threshold, the in-situ parameter switching is triggered, and the process of selecting other security parameter sets, re-executing the key encapsulation process and signature exchange process is carried out.

[0083] It should be noted that this condition is an optional triggering logic and can be used alone or in combination with the error count and decryption time offset conditions.

[0084] S230, the new message digest to be signed and the new encapsulated ciphertext are sent to the communication response end, and in response to the confirmation message returned by the communication response end, the transition session key is replaced with the new current master session key, and the secure session continues with the communication response end based on the new current master session key.

[0085] In one alternative implementation, replacing the transition session key with a new current master session key includes: replacing the transition session key with a new current master session key in an atomic switching manner.

[0086] In this embodiment, after the communication initiating end completes the aforementioned re-execution of the key encapsulation process and signature exchange process and obtains the transition session key, it receives a confirmation message returned by the communication responding end; the confirmation message indicates that the communication responding end has completed the corresponding decapsulation, derived the initial transition session key, and performed local signature verification.

[0087] The in-situ switching controller performs an atomic switching operation: During the atomic operation, the upper-layer business data flow is not interrupted; the transition session key is atomically replaced with the official new master session key; the bidirectional session binding token stored in the protocol stack security session buffer is synchronously updated; the updated bidirectional session binding token is re-associated and stored with the new master session key, session recovery identifier, and response end session snapshot digest;

[0088] The atomic handover operation guarantees that there will be no window during which the old master session key and the new master session key are valid at the same time; if an anomaly occurs during the atomic handover process, the transition session key is discarded, and the original current master session key remains unchanged, so as not to cause inconsistency in the session state.

[0089] After the key replacement is completed, all subsequent business messages sent and received by the protocol stack will be encrypted and decrypted using the updated new current master session key. The communication initiator and the communication responder will continue to maintain the original secure session connection, and the upper layer application data stream will continue to be transmitted without needing to re-execute the complete handshake connection establishment process.

[0090] It should be noted that the in-situ parameter switching operation can complete the upgrade and switching of the security parameter set without releasing the current master session key or interrupting the upper-layer application data flow, achieving online dynamic upgrade of quantum attack resistance capabilities with zero downtime. An atomic switching method is used to replace the transitional session key with the official new master session key, synchronously updating the bidirectional session binding token. This ensures that during the master session key replacement process, the protocol stack will not experience a window period where the old and new keys are valid simultaneously, nor will it lead to abnormal situations such as key replacement failure causing inconsistent session states.

[0091] In the aforementioned session key update method, based on the established secure session between the communicating parties, the runtime error count vector and average decryption time statistics are monitored during session operation. When the indicators meet the switching conditions, other security parameter sets with different security strengths are selected within the same algorithm family. The negotiated parameters already generated in the current secure session are reused, and the key encapsulation and signature exchange processes are re-completed with the communication response end to obtain a transitional session key. After the key replacement is completed, the original secure session communication continues. On the one hand, this scheme can update security parameters and session keys without rebuilding the complete handshake session, avoiding session interruption and business data flow interruption caused by reconnection. On the other hand, the security parameter switching is triggered based on the actual abnormal and performance deviation states during session operation, rather than using a fixed static configuration. This allows for adaptive adjustment of security strength according to the actual risk situation of the session. It can both increase the security level to resist potential attacks when abnormal signs are detected and avoid unnecessary performance overhead caused by indiscriminate upgrades, balancing communication security and operational performance. At the same time, the update process reuses existing negotiated parameters in the session for key renegotiation, eliminating the need to regenerate the entire set of negotiation materials, reducing interaction and computational overhead, and enabling dynamic online updates of session keys and security capabilities.

[0092] Based on the technical solutions of the above embodiments, this application also provides an optional implementation method. In this optional implementation method, the process of re-executing the key encapsulation process and signature exchange process with the communication response end based on other selected security parameter sets and combined with the existing negotiation parameters of the current security session to generate a transition session key and a new encapsulated ciphertext is refined.

[0093] See Figure 3 The transition session key and new encapsulated ciphertext generation steps shown include:

[0094] S310, based on the selected other security parameter set and the first temporary key encapsulated public key in the negotiation parameters already present in the current security session, re-execute the encapsulation operation of the post-quantum key encapsulation algorithm to generate a new encapsulated ciphertext and a new shared secret seed.

[0095] The first temporary key encapsulating the public key is a public key generated and stored in the session context by the initiating end during the initial handshake to establish a secure session. The new encapsulated ciphertext, after triggering the in-situ handover, is the ciphertext output by reusing the existing temporary public key and performing the encapsulation operation using the changed security parameter set. This ciphertext is sent to the responding end for decapsulation to obtain the shared secret seed. The new shared secret seed is the original secret material output by the post-quantum key encapsulation algorithm; the initiating end generates a copy locally. The responding end obtains the same content by decapsulating the new encapsulated ciphertext, and both parties derive the transition session key based on this seed.

[0096] After triggering the in-situ parameter switch, the communication initiator reads the selected set of other security parameters. This set of security parameters defines the key output specifications, ciphertext length, and hash parameters corresponding to the post-quantum key encapsulation algorithm. The communication initiator directly reads and reuses the first temporary key encapsulation public key already saved in the current secure session context, without needing to regenerate a new temporary key encapsulation public-private key pair. The communication initiator loads the post-quantum key encapsulation algorithm implementation logic corresponding to this other set of security parameters, uses the first temporary key encapsulation public key as the algorithm input, and executes the encapsulation operation of the post-quantum key encapsulation algorithm. The algorithm outputs two sets of data: the new encapsulated ciphertext and the new shared secret seed. The new encapsulated ciphertext is used to transmit to the communication response end, while the new shared secret seed is retained locally at the communication initiator for subsequent derivation of the transition session key.

[0097] S320: Derive the initial transition session key from the new shared secret seed; generate a new message digest to be signed based on the new encapsulated ciphertext and the first protocol random challenge number in the existing negotiation parameters of the current secure session.

[0098] The random number generated by the communication initiator during the handshake and connection establishment phase is stored in the session context as a session freshness factor. It is used to bind renegotiation messages to prevent replay and tampering attacks; it is directly reused during the renegotiation phase and is not regenerated. The new message digest to be signed is a hash digest obtained by concatenating and hashing the new encapsulated ciphertext and the first protocol random challenge number. The communication responder signs this digest to verify the integrity of the renegotiation message and the legitimacy of the communication responder's identity.

[0099] In this embodiment, the communication initiator uses the newly obtained shared secret seed locally as the key derivation input material, calls the preset key derivation function, and performs key derivation operations in combination with the preset derivation context label to output the initial transition session key. The initial transition session key is the original session key material used in the transition phase and is not directly used as the business communication key. At the same time, the first protocol random challenge number stored in the session context is read. This random challenge number is generated and saved during the handshake and chain establishment phase. The random challenge number will not be regenerated in this renegotiation. The new encapsulated ciphertext and the first protocol random challenge number are used as the input material to generate the digest to be signed.

[0100] In one alternative implementation, the new encapsulated ciphertext and the first protocol random challenge number can be concatenated to obtain concatenated data; a hash operation is performed on the concatenated data to generate a new message digest to be signed.

[0101] For example, the binary byte stream of the new encapsulated ciphertext can be concatenated with the first protocol random challenge number throttling in a preset byte order to obtain complete concatenated data; a preset hash algorithm is selected to perform a hash operation on the concatenated data, and the output of the hash operation is the new message digest to be signed; by binding the encapsulated ciphertext with the original random challenge number of the session, the message digest to be signed is strongly bound to the key material of this renegotiation and the freshness factor of the original session, preventing attackers from tampering with the key negotiation data in the renegotiation process.

[0102] S330, the new encapsulated ciphertext and the new message digest to be signed are sent to the communication response end, so that the communication response end can decapsulate the new encapsulated ciphertext, obtain the new shared secret seed, derive the initial transition session key, and generate a new digital signature value based on the new message digest to be signed.

[0103] The initial transition session key is the original key material directly derived from the new shared secret seed, and has not yet officially replaced the old master session key; it needs to wait for the signature verification to pass before it can be upgraded to a formally usable transition session key.

[0104] In some embodiments, the initiating end packages the new encapsulated ciphertext and the new message digest to be signed into a renegotiation message and sends it to the responding end. Upon receiving the renegotiation message, the responding end parses and extracts the new encapsulated ciphertext and the new message digest to be signed. The responding end calls the decapsulation logic of the post-quantum key encapsulation algorithm under the corresponding security parameter set, uses the temporary private key corresponding to the session phase to perform decapsulation operations on the new encapsulated ciphertext, and parses it to obtain a new shared secret seed. The responding end reuses the same key derivation function and derivation context label as the initiating end, and derives its local initial transition session key based on the new shared secret seed. The responding end reads its own local signing private key, uses the received new message digest to be signed as the signature input, performs the signature operation of the post-quantum digital signature algorithm, generates a new digital signature value, and feeds it back to the initiating end to complete the signature exchange verification.

[0105] S340 receives the new digital signature value returned by the communication response end, performs the verification operation of the post-quantum digital signature algorithm on the new digital signature value, and if the verification is successful, uses the initial transition session key as the final transition session key.

[0106] In some embodiments, the communication initiator receives a new digital signature value returned by the communication responder; the communication initiator reads the responder's signature public key stored in the session context, and uses the responder's signature public key, the locally generated new message digest to be signed, and the received new digital signature value as input parameters to call the post-quantum digital signature algorithm to perform a signature verification operation; the signature verification result is judged, and if the signature verification fails, the generated initial transition session key is discarded, the subsequent key replacement process is not executed, and the original secure session state remains unchanged; if the signature verification operation passes, it means that the communication responder has successfully completed the renegotiation process, confirming that the peer's identity is legitimate and the renegotiation message has not been tampered with, and then the local initial transition session key is determined as the final transition session key for use in the subsequent atomic key replacement step.

[0107] It should be noted that this set of steps reuses the key encapsulation and signature exchange cryptographic processing paradigm recorded in the handshake to establish a secure session in this application; the difference is that the in-situ renegotiation reuses the first temporary key encapsulating the public key and the first protocol random challenge number already stored in the session context, without needing to fully execute the entire set of handshake message interactions, relying on lightweight messages to complete key renegotiation, supporting in-situ parameter switching without interrupting the upper layer data stream.

[0108] In the above embodiments, the negotiation parameters already saved in the session are directly reused to complete the renegotiation, saving the computational overhead of regenerating the entire handshake parameters. The message interaction is also more streamlined. At the same time, the key material for this renegotiation is bound to the original session random number, and signature exchange verification is used to prevent message tampering. If the signature verification fails, the key generated this time is discarded and the original session is retained, thereby improving the security of the renegotiation process. The entire process uses the existing cryptographic processing logic in the handshake phase, without the need to rebuild the handshake session, and can complete the key renegotiation without interrupting the upper-layer business data flow.

[0109] It is worth noting that the above is the implementation method for normal process execution. Based on the design concept of in-situ parameter switching without interrupting the session in this application, the following optional exception handling logic can also be included:

[0110] Optionally, if an algorithm call exception occurs during the re-execution of the quantum key encapsulation algorithm, the current in-situ parameter switching is terminated, all intermediate temporary data is discarded, and the existing master session key is used to maintain the secure session. Optionally, after sending the renegotiation message, if a new digital signature value is not received from the communication response end within a preset time window, the renegotiation is deemed to have timed out, the initial transition session key is discarded, key replacement is not performed, and the original session continues to run. Optionally, when signature verification fails, in addition to discarding the initial transition session key, the failure event can also be optionally included in the runtime error count vector to provide statistical basis for subsequent security level judgment.

[0111] Based on the technical solutions of the above embodiments, this application also provides an optional embodiment. In this optional embodiment, the process of establishing a secure session between the communication initiator and the communication responder is described in detail.

[0112] See Figure 4 The secure session establishment steps shown include:

[0113] S410, in response to the handshake request, generates a first temporary key encapsulates the public key and a first protocol random challenge number based on the current system timestamp and hardware random source, and encapsulates the first temporary key encapsulates the public key, the first protocol random challenge number and the algorithm family identifier into a handshake initialization message, and sends it to the communication response end.

[0114] Among them, the hardware random source is used to provide true random entropy in a cryptographic sense, reducing the risk of random numbers being predicted; the first protocol random challenge number represents the session freshness factor generated by the communication initiator during the handshake phase, which is used to bind the current handshake session and resist replay attacks.

[0115] Typically, when the communication initiator generates a first temporary key to encapsulate the public key, it also stores a matching first temporary key to encapsulate the private key locally. This private key is not transmitted externally. The communication initiator also uses the first temporary key to encapsulate the public key to perform encapsulation operations locally to obtain the first encapsulated ciphertext. The first encapsulated ciphertext is then concatenated with the first protocol random challenge number, and a hash calculation is performed to obtain the first message digest to be signed. This digest is temporarily stored locally for use in subsequent signature verification steps.

[0116] Specifically, after receiving the handshake request, the initiating end reads the local system timestamp and simultaneously calls the hardware random source to obtain a random entropy value. Using the obtained random entropy, it executes the key generation logic of the quantum key encapsulation algorithm to obtain a first temporary key encapsulation public key and a matching first temporary key encapsulation private key. The private key is stored locally by the initiating end and not sent externally. Simultaneously, it extracts data of a corresponding length from the hardware random entropy as the first protocol random challenge number, which serves as the freshness factor for this session. Then, it assembles the first temporary key encapsulation public key, the first protocol random challenge number, and the corresponding algorithm family identifier to complete the handshake initialization message packetization process and sends the assembled handshake initialization message to the responding end. The initiating end also performs encapsulation operations locally using the first temporary key encapsulation public key to obtain the first encapsulated ciphertext. It then performs a concatenated hash operation on the first encapsulated ciphertext and the first protocol random challenge number to obtain the first message digest to be signed. This digest is stored in the local session context for use in subsequent signature verification.

[0117] In some embodiments, an integrity verification field can be included in the handshake initialization message to reduce parsing anomalies caused by unintentional tampering of the message during transmission.

[0118] S420 receives the handshake response message returned by the communication responder and extracts the second encapsulated ciphertext, the first digital signature value, and the responder's digital certificate object from the handshake response message.

[0119] The responding digital certificate object carries the responding end's signing public key and certificate validity information, serving as a crucial credential for identity verification. Upon receiving the handshake initialization message, the responding end uses the first temporary key carried in the message to encapsulate the public key, obtaining a second encapsulated ciphertext. Simultaneously, it signs the aforementioned first message digest to be signed, obtaining a first digital signature value. The responding end also generates its own second protocol random response number, which is included in the handshake response message and returned. When the initiating end parses the handshake response message, in addition to extracting the data listed in this step, it also reads the second protocol random response number for subsequent use in generating session key materials.

[0120] Specifically, after receiving the handshake initialization message, the responding end parses the message to obtain the first temporary key encapsulating the public key, the first protocol random challenge number, and the algorithm family identifier. It then uses the first temporary key encapsulating the public key to perform encapsulation operations to generate the second encapsulated ciphertext. Furthermore, it performs a signature operation on the first message digest to be signed generated locally by the initiating end to obtain the first digital signature value. This first digital signature value, along with its own responding end's digital certificate object, is assembled into the handshake response message and sent back to the initiating end. Upon receiving the handshake response message, the initiating end parses the message, extracting the second encapsulated ciphertext, the first digital signature value, and the responding end's digital certificate object. Simultaneously, it extracts the second protocol random response number from the message. This second protocol random response number is a random number generated by the responding end and is used for generating subsequent session key materials.

[0121] It should be noted that, in order to reduce the number of handshake round trips, the handshake response message can combine the key negotiation data, signature data, and certificate data into a single return message.

[0122] S430, perform decapsulation operation based on the second encapsulated ciphertext and the first temporary key encapsulated private key corresponding to the first temporary key encapsulated public key; perform digital signature algorithm verification operation based on the first digital signature value, the response end digital certificate object and the first message digest to be signed.

[0123] The first message digest to be signed is generated by concatenating data of the first encapsulated ciphertext and the first protocol random challenge number; the first encapsulated ciphertext is generated by encapsulating the public key with the first temporary key.

[0124] Specifically, the initiating end retrieves the first temporary key stored locally to encapsulate the private key, and uses the private key to perform a decapsulation operation on the received second encapsulated ciphertext to obtain the decapsulation result; at the same time, it parses the responding end's signature public key from the responding end's digital certificate object, and combines it with the first message digest to be signed stored locally to perform signature verification on the received first digital signature value.

[0125] It is worth noting that the generation of session key materials is only allowed if the signature verification result is successful; if the signature verification fails, the handshake process will be terminated directly and no session key will be generated.

[0126] In some embodiments, the cross-end verification confidence of the quantum digital signature can be quantized using the joint probability density calculation formula, thereby eliminating false verifications caused by quantum side-channel interference.

[0127] For example, during the signature verification operation, information such as the channel noise variance on the signature side, the certificate field perturbation variance, the system timestamp, the certificate validity period, and the message digest hash bias are collected and substituted into the following joint probability density calculation formula:

[0128] ;

[0129] In the formula, Normalized confidence level for signature verification; This is a three-dimensional validation factor Bayesian weighted joint confidence operator; To validate the prior coefficients of the weights for each dimension; The quantum side channel noise variance is the signature value. This is the signature noise weight matrix; Perturbation variance for certificate fields; This is the certificate error weight matrix; () represents the signature verification baseline variance threshold; System timestamp; This is the certificate expiration date stamp; The message digest hash bias is the infinite norm. The validity of a signature is determined based on the calculated signature verification normalized confidence score, avoiding false verifications caused by quantum side-channel noise interference, which can occur if the algorithm's boolean return result is relied upon alone.

[0130] In some embodiments, it can be determined whether the digital certificate object of the responding end is within a valid time range before verifying the signature. If the certificate has expired, the handshake is directly deemed to have failed.

[0131] S440, if the verification operation is successful, generate the first-level session key material based on the decapsulation result, the first protocol random challenge number, and the second protocol random response number, and derive the current master session key based on the first-level session key material to establish a secure session based on the current master session key.

[0132] The first-level session key material is the original key input for deriving the master session key and is not directly used for business message encryption and decryption.

[0133] In some embodiments, after successful signature verification, the communication initiator uses the decapsulation result, the first protocol random challenge number retained during the handshake phase, and the second protocol random response number parsed from the handshake response message as input materials to generate the first-level session key material. Then, it calls the key derivation function to perform derivation processing on the first-level session key material to obtain the current master session key. Based on this master session key, a secure session is formally established between the communication initiator and the communication responder.

[0134] In one optional implementation, the decapsulation result is the second shared secret seed; correspondingly, the second shared secret seed, the first protocol random challenge number, and the second protocol random response number can be concatenated to generate the first-level session key material and the protocol random derivation number; wherein, the second protocol random response number is extracted from the handshake response message. The protocol random derivation number is saved with the session context and can be directly reused when the session subsequently enters the in-situ renegotiation phase.

[0135] In practice, the second shared secret seed output from the decapsulation operation is concatenated with the first protocol random challenge number and the second protocol random response number in a preset byte order. The concatenated data is the first-level session key material. At the same time, the protocol random derivation number is obtained from the concatenation result. This protocol random derivation number is stored in the session context and can be reused in subsequent session runs and renegotiation phases.

[0136] In some embodiments, key expansion derivation can be performed based on the first-level session key material and the protocol random derivation number to generate the current master session key. Specifically, the first-level session key material and the protocol random derivation number can be concatenated byte-wise to obtain the input material for key derivation; the preset key derivation function identifier and derivation context label are read, and the corresponding key derivation function is called to perform the first round of key derivation operation; a segment of data of a preset length is extracted from the derivation output data as the current master session key.

[0137] It should be noted that by using different context labels, keys for different purposes can be derived from the same set of input materials, avoiding the mixing of keys with different functions and improving the security of key use.

[0138] In the above embodiments, the initial handshake between the two communicating parties is completed, a shared seed is obtained through key encapsulation operation, and then the session key material is jointly generated by the random numbers generated by both parties. The identity verification is completed with digital signature. Only when the signature verification is successful will the master session key be generated, ensuring the identity trustworthiness and key security during the initial session establishment phase. The public key, various random numbers and other negotiation parameters generated during the handshake phase are saved in the session context, providing reusable basic parameters for in-situ renegotiation during the session operation.

[0139] In some embodiments, a second message digest to be signed can be generated based on the protocol's random derivation number and the initiator's identity information in the initiator's digital certificate object; a post-quantum digital signature algorithm is executed on the second message digest to be signed based on the initiator's signature private key to generate a second digital signature value; and an authentication completion message is generated based on the second digital signature value, the second message digest to be signed, and the initiator's digital certificate object; the authentication completion message is encrypted based on a temporary encryption key to obtain an encrypted authentication completion payload, and the encrypted authentication completion payload is sent to the communication response end for the communication response end to perform integrity and security verification on the encrypted authentication completion payload; wherein, the temporary encryption key is derived based on the first-level session key material; the authentication confirmation message returned by the communication response end is received, and a two-way session binding token between the communication initiator and the communication response end is generated based on the authentication confirmation message and the current master session key.

[0140] For example, after obtaining the protocol random derivation number, the initiating end reads the initiating end's identity information carried in its local initiating end digital certificate object. It uses the protocol random derivation number and this identity information as hash input, and performs a hash operation to obtain the second message digest to be signed. It then retrieves the locally stored initiating end's signature private key and calls the post-quantum digital signature algorithm to perform a signature operation on the second message digest to be signed, outputting the second digital signature value. The second digital signature value, the second message digest to be signed, and the initiating end's digital certificate object are assembled into a plaintext authentication completion message. The initiating end then derives a temporary encryption key from the first-level session key material through a key derivation function. Using this temporary encryption key, it performs authentication encryption on the authentication completion message, simultaneously performing message encryption and integrity tag calculation to obtain the encrypted authentication completion payload, which is then sent to the responding end. Upon receiving the encrypted authentication completion payload, the responding end first decrypts it using the corresponding key, then performs integrity verification and certificate validity verification. After all verifications pass, it sends an authentication confirmation message back to the initiating end. When the communication initiator receives the authentication confirmation message, it means that the two-way identity authentication process is complete. Combined with the generated current master session key, a two-way session binding token is generated to identify this secure session. The two-way session binding token is stored in the session context. The token can be used to complete the session state identification in subsequent session continuation and in-situ renegotiation processes.

[0141] It should be noted that the authentication completion message is encrypted before being sent out, which can prevent the plaintext data related to the initiator's identity and signature from being directly exposed in the transmission link; the two-way session binding token is used to uniquely identify the security session established this time, which makes it easier for the protocol stack to distinguish multiple parallel sessions, and also provides a session state anchor for subsequent in-situ key updates.

[0142] Based on the technical solutions of the above embodiments, this application also provides an optional embodiment. In this optional embodiment, the session key update method provided by this application will be described in detail.

[0143] See Figure 5 The session key update method shown includes:

[0144] S510 monitors the runtime error count vector and average decryption time statistics during the session.

[0145] The current secure session corresponds to the current master session key and the current security parameter set.

[0146] The runtime error counting vector includes at least one of the following: a failure counting vector for decapsulation operation of the post-quantum key encapsulation algorithm; a failure counting vector for signature verification operation of the post-quantum digital signature algorithm; and a failure counting vector for integrity verification of the authentication encryption operation.

[0147] S520, upon detecting that preset conditions are met, selects other security parameter sets from the algorithm family to which the current security parameter set belongs, and based on the selected other security parameter sets, combined with the existing negotiated parameters of the current security session, re-executes the key encapsulation process and signature exchange process with the communication response end to generate a transition session key and a new encapsulated ciphertext.

[0148] Among them, the security strength of other security parameter sets differs from the security strength of the current security parameter set. Preset conditions include at least one of the following: any counting dimension in the runtime error count vector exceeds the corresponding threshold value in the preset security level switching threshold array; the average decryption time statistic's offset relative to the historical baseline exceeds a preset percentage; and a preset entropy convergence quantization model is used to quantize the quantum-resistant redundancy entropy of the session key material corresponding to the current session.

[0149] In an optional implementation, the key encapsulation process and signature exchange process can be re-executed with the communication response end in the following manner: The negotiation parameters retained during the secure session establishment phase are reused, namely the first temporary key encapsulated public key and the first protocol random challenge number obtained in the handshake process of claims 7-8; based on other selected security parameter sets, the post-quantum key encapsulation algorithm is invoked to re-execute the encapsulation operation using the first temporary key encapsulated public key, generating a new encapsulated ciphertext and a new shared secret seed; an initial transition session key is derived based on the new shared secret seed; the new encapsulated ciphertext and the first protocol random challenge number are concatenated to obtain concatenated data, and a hash operation is performed on the concatenated data to generate a new message digest to be signed; the new encapsulated ciphertext and the new message digest to be signed are sent to the communication response end, so that the communication response end can perform a decapsulation operation on the new encapsulated ciphertext to obtain a new shared secret seed and derive the initial transition session key, while generating a new digital signature value based on the received new message digest to be signed; the new digital signature value is received from the communication response end, and the post-quantum digital signature algorithm is invoked to perform a verification operation on the new digital signature value; under the condition that the signature verification is successful, the initial transition session key is determined as the transition session key.

[0150] S530 sends the new message digest to be signed and the new encapsulated ciphertext to the communication response end, and in response to the confirmation message returned by the communication response end, replaces the transition session key with the new current master session key in an atomic switching manner, and continues the secure session with the communication response end based on the new current master session key.

[0151] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0152] Based on the same inventive concept, this application also provides a session key update apparatus for implementing the session key update method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more session key update apparatus embodiments provided below can be found in the limitations of the session key update method described above, and will not be repeated here.

[0153] In one exemplary embodiment, such as Figure 6 As shown, a session key update device is provided, including: a monitoring module 610, a generation module 620, and an update module 630, wherein:

[0154] The monitoring module 610 is used to monitor the runtime error count vector and average decryption time statistics during the communication process when a secure session has been established between the communication initiator and the communication responder; wherein, the current secure session corresponds to the current master session key and the current security parameter set;

[0155] The generation module 620 is used to select other security parameter sets from the algorithm family to which the current security parameter set belongs when it detects that any counting dimension in the runtime error counting vector exceeds the corresponding threshold value in the preset security level switching threshold array, or when the offset of the average decryption time statistics relative to the historical baseline exceeds a preset percentage. Based on the selected other security parameter sets and combined with the existing negotiated parameters of the current security session, the key encapsulation process and signature exchange process are re-executed with the communication response end to generate a transition session key and a new encapsulated ciphertext. The security strength of the other security parameter sets is different from that of the current security parameter set.

[0156] The update module 630 is used to send a new message digest to be signed and a new encapsulated ciphertext to the communication response end, and in response to the confirmation message returned by the communication response end, replace the transition session key with the new current master session key, and continue the secure session with the communication response end based on the new current master session key.

[0157] In one embodiment, the runtime error count vector includes at least one of the following: a failure count vector for decapsulation operation of the post-quantum key encapsulation algorithm; a failure count vector for signature verification operation of the post-quantum digital signature algorithm; and a failure count vector for integrity verification of the authentication encryption operation.

[0158] In one embodiment, update module 630 is used to replace the transition session key with a new current master session key in an atomic switching manner.

[0159] In one embodiment, the generation module 620 includes a first generation unit, configured to encapsulate the public key using a first temporary key from the selected set of other security parameters and the negotiation parameters of the current security session, re-execute the encapsulation operation of the post-quantum key encapsulation algorithm, and generate a new encapsulated ciphertext and a new shared secret seed; a second generation unit, configured to derive an initial transition session key from the new shared secret seed; and generate a new message digest to be signed based on the new encapsulated ciphertext and the first protocol random challenge number from the negotiation parameters of the current security session; a third generation unit, configured to send the new encapsulated ciphertext and the new message digest to be signed to the communication response end, so that the communication response end can decapsulate the new encapsulated ciphertext to obtain a new shared secret seed, derive the initial transition session key, and generate a new digital signature value based on the new message digest to be signed; and a fourth generation unit, configured to receive the new digital signature value returned by the communication response end, perform a verification operation of the post-quantum digital signature algorithm on the new digital signature value, and, if the verification is successful, use the initial transition session key as the final transition session key.

[0160] In one embodiment, the second generation unit is specifically used to concatenate the new encapsulated ciphertext and the first protocol random challenge number to obtain concatenated data; and to perform a hash operation on the concatenated data to generate a new message digest to be signed.

[0161] In one embodiment, the generation module further includes a calculation unit for quantizing the quantum-resistant redundancy entropy of the session key material corresponding to the current session using a preset entropy convergence quantization model; correspondingly, the generation module includes a selection unit for selecting other security parameter sets from the algorithm family to which the current security parameter set belongs if the quantized quantum-resistant redundancy entropy is lower than a preset security entropy threshold.

[0162] In one embodiment, the session key update device further includes a session establishment module, comprising a fifth generation unit, configured to, in response to a handshake request, generate a first temporary key encapsulated public key and a first protocol random challenge number based on the current system timestamp and a hardware random source, and encapsulate the first temporary key encapsulated public key, the first protocol random challenge number, and the algorithm family identifier into a handshake initialization message, and send it to the communication response end; an extraction unit, configured to receive a handshake response message returned by the communication response end, and extract a second encapsulated ciphertext, a first digital signature value, and a response end digital certificate object from the handshake response message; and a verification unit, configured to perform a decapsulation operation based on the second encapsulated ciphertext and the first temporary key encapsulated private key corresponding to the first temporary key encapsulated public key; The digital signature algorithm is verified based on the first digital signature value, the responding digital certificate object, and the first message digest to be signed. The first message digest to be signed is generated by concatenating data of the first encapsulated ciphertext and the first protocol random challenge number. The first encapsulated ciphertext is generated by encapsulating the public key with the first temporary key. An establishment unit is used, upon successful verification, to generate first-level session key material based on the decapsulation result, the first protocol random challenge number, and the second protocol random response number, and to derive the current master session key from the first-level session key material to establish a secure session based on the current master session key. The second protocol random response number is extracted from the handshake response message.

[0163] In one embodiment, the establishment unit is specifically used to cascade the second shared secret seed, the first protocol random challenge number, and the second protocol random response number to generate the first-level session key material and the protocol random derivation number.

[0164] Each module in the aforementioned session key update device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device in software form, so that the processor can invoke and execute the operations corresponding to each module.

[0165] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 7As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a session key update method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0166] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0167] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0168] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0169] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0170] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0171] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0172] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0173] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A session key update method, characterized in that, Applied to the communication initiator, the method includes: When a secure session has been established between the communication initiator and the communication responder, the runtime error count vector and average decryption time statistics during the session are monitored; wherein, the current secure session corresponds to the current master session key and the current security parameter set; If any counting dimension in the runtime error counting vector exceeds the corresponding threshold value in the preset security level switching threshold array, or if the average decryption time statistic deviates from the historical baseline by a preset percentage, another security parameter set is selected from the algorithm family to which the current security parameter set belongs. Based on the selected other security parameter set and combined with the existing negotiation parameters of the current security session, the key encapsulation process and signature exchange process are re-executed with the communication response end to generate a transition session key and a new encapsulated ciphertext. The security strength of the other security parameter set is different from that of the current security parameter set. The new message digest to be signed and the new encapsulated ciphertext are sent to the communication response end. In response to the confirmation message returned by the communication response end, the transition session key is replaced with the new current master session key, and a secure session is continued with the communication response end based on the new current master session key.

2. The method according to claim 1, characterized in that, The runtime error count vector includes at least one of the following: The failure count vector for decapsulation operations in the post-quantum key encapsulation algorithm; The signature verification operation failure count vector of the post-quantum digital signature algorithm; Integrity verification failure count vector for authentication encryption operations.

3. The method according to claim 1, characterized in that, The step of replacing the transition session key with the new current master session key includes: The transition session key is replaced with the new current master session key using an atomic switching method.

4. The method according to claim 1, characterized in that, Based on the selected set of other security parameters, combined with the existing negotiated parameters of the current security session, the key encapsulation process and signature exchange process are re-executed with the communication response end to generate a transition session key and a new encapsulated ciphertext, including: Based on the selected set of other security parameters and the first temporary key encapsulated in the negotiation parameters of the current security session, the encapsulation operation of the post-quantum key encapsulation algorithm is re-executed to generate a new encapsulated ciphertext and a new shared secret seed. An initial transition session key is derived from the new shared secret seed; a new message digest to be signed is generated based on the new encapsulated ciphertext and the first protocol random challenge number in the existing negotiation parameters of the current secure session. The new encapsulated ciphertext and the new message digest to be signed are sent to the communication response end, so that the communication response end can decapsulate the new encapsulated ciphertext to obtain a new shared secret seed, derive the initial transition session key, and generate a new digital signature value based on the new message digest to be signed. The system receives a new digital signature value returned by the communication response terminal, performs a verification operation of the post-quantum digital signature algorithm on the new digital signature value, and if the verification is successful, uses the initial transition session key as the final transition session key.

5. The method according to claim 4, characterized in that, The step of generating a new message digest to be signed based on the new encapsulated ciphertext and the first protocol random challenge number in the existing negotiation parameters of the current secure session includes: The new encapsulated ciphertext and the first protocol random challenge number are concatenated to obtain concatenated data; Perform a hash operation on the concatenated data to generate the new message digest to be signed.

6. The method according to claim 1, characterized in that, The method further includes: A pre-defined entropy convergence quantization model is used to quantize the quantum-resistant redundancy entropy of the session key material corresponding to the current session. Accordingly, the method further includes: If the quantum-resistant redundancy entropy obtained by quantization is lower than the preset security entropy threshold, other security parameter sets are selected from the algorithm family to which the current security parameter set belongs.

7. The method according to claim 1, characterized in that, The process of establishing a secure session between the communication initiator and the communication responder includes: In response to the handshake request, based on the current system timestamp and hardware random source, a first temporary key is generated to encapsulate the public key and the first protocol random challenge number. The first temporary key encapsulates the public key, the first protocol random challenge number, and the algorithm family identifier into a handshake initialization message and sends it to the communication response end. Receive the handshake response message returned by the communication response end, and extract the second encapsulated ciphertext, the first digital signature value, and the response end digital certificate object from the handshake response message; Decapsulation is performed based on the second encapsulated ciphertext and the first temporary key encapsulated private key corresponding to the first temporary key encapsulated public key; verification of the digital signature algorithm is performed based on the first digital signature value, the response end digital certificate object, and the first message digest to be signed; wherein, the first message digest to be signed is generated based on the concatenated data of the first encapsulated ciphertext and the first protocol random challenge number; the first encapsulated ciphertext is generated based on the first temporary key encapsulated public key; If the verification operation is successful, a first-level session key material is generated based on the decapsulation result, the first protocol random challenge number, and the second protocol random response number. The current master session key is then derived from the first-level session key material to establish a secure session based on the current master session key. The second protocol random response number is extracted from the handshake response message.

8. The method according to claim 7, characterized in that, in, The decapsulation result is the second shared secret seed; correspondingly, the generation of the first-level session key material based on the decapsulation result, the first protocol random challenge number, and the second protocol random response number includes: The second shared secret seed, the first protocol random challenge number, and the second protocol random response number are concatenated to generate the first-level session key material and the protocol random derivation number.

9. A session key update device, characterized in that, At the communication initiating end, the device includes: The monitoring module is used to monitor the runtime error count vector and average decryption time statistics during the communication process when a secure session has been established between the communication initiator and the communication responder; wherein, the current secure session corresponds to the current master session key and the current security parameter set; The generation module is used to select other security parameter sets from the algorithm family to which the current security parameter set belongs when it detects that any counting dimension in the runtime error counting vector exceeds the corresponding threshold value in the preset security level switching threshold array, or when the offset of the average decryption time statistics relative to the historical baseline exceeds a preset percentage. Based on the selected other security parameter sets and combined with the existing negotiation parameters of the current security session, the module re-executes the key encapsulation process and signature exchange process with the communication response end to generate a transition session key and a new encapsulated ciphertext. The security strength of the other security parameter sets is different from that of the current security parameter set. The update module is used to send the new message digest to be signed and the new encapsulated ciphertext to the communication response end, and in response to the confirmation message returned by the communication response end, replace the transition session key with the new current master session key, and continue the secure session with the communication response end based on the new current master session key.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1-8.

Images