Cross-domain identity authentication method and system based on quantum key distribution network

Abstract

Disclosed in the present invention are a cross-domain identity authentication method and system based on a quantum key distribution network. The method comprises: sending a key negotiation request to a corresponding quantum key management system, and forwarding the key negotiation request to a quantum key generation system by means of the quantum key management system, such that the quantum key generation system establishes a relay key negotiation link between quantum key terminals and generates symmetric authentication keys; receiving an authentication request sent by means of a corresponding user-side terminal, and allocating identifiers of the authentication keys to the user-side terminal on the basis of the authentication request; and receiving login request information sent by means of the corresponding user-side terminal, and responding to the user-side terminal with constructed token ciphertext on the basis of the login request information, so as to forward the token ciphertext to a cross-domain identity authentication service system when the user-side terminal accesses the cross-domain identity authentication service system. The present invention solves the centralization problem that is present in cross-domain identity authentication, thus improving the confidentiality and integrity of authentication credential data distribution.

Description

Cross-domain identity authentication method and system based on quantum key distribution network Technical Field The present invention relates to the field of security application technology, and in particular to a cross-domain identity authentication method and system based on a quantum key distribution network. Background Art With the rapid development of Internet technology and the expansion of network application systems, various services and resources will be distributed to different domains. Different services and resources are distinguished according to domain division and permission management, so that users in different domains can use them according to different needs. This way of accessing services and resources in different domains involves cross-domain access. Traditional cross-domain access methods usually use central or centralized databases, proxies, etc. to maintain cross-domain authentication credentials, identity tokens and other data to achieve user identity authentication and verification. However, the existing centralized identity authentication methods used in cross-domain access have the following problems in actual application: (1) The reliability of centralized management of identity authentication data is poor, and user access is prone to bottlenecks. Once failure occurs, it affects the overall situation, and lacks the flexibility to expand; (2) When the same user accesses other identity authentication service systems under the cross-domain, the cross-domain identity authentication service systems need to synchronize identity authentication credentials, identity tokens and other data, which poses a risk of theft and tampering during the identity authentication data distribution process. In the related technology, the Chinese invention patent application document with application publication number CN114362947A discloses a wide-area quantum key service method and system. The scheme describes a method for generating keys between arbitrary nodes in local and cross-domain scenarios, and realizes key relay and unified management of QKD network through QKD link network virtualization and unified service interface, and realizes quantum key services between different QKD networks through a unified platform, and the platform uses a cascade architecture. Summary of the invention The technical problem to be solved by the present invention is how to improve the confidentiality and integrity of authentication credential data distribution. The present invention solves the above technical problems through the following technical means: In a first aspect, the present invention proposes a cross-domain identity authentication method based on a quantum key distribution network, which is applied to an identity authentication service system. The method comprises the following steps: Sending a key negotiation request to a corresponding quantum key management system, which is forwarded by the quantum key management system to a quantum key generation system, so that the quantum key generation system establishes a relay key negotiation link between quantum key terminals KM and generates a symmetric authentication key; Receive an authentication request sent by a corresponding user-side terminal, and assign an identifier of the authentication key to the user-side terminal based on the authentication request, so that when the user-side terminal accesses the cross-domain identity authentication service system, the authentication key is used to authenticate the user-side terminal. The identifier applies for the authentication key from the quantum key management system corresponding to the cross-domain identity authentication service system; Receive the login request information sent by the corresponding user side terminal, and respond to the user side terminal with a constructed token ciphertext based on the login request information, so as to forward the token ciphertext to the cross-domain identity authentication service system when the user side terminal accesses the cross-domain identity authentication service system. Furthermore, before sending the key agreement request to the corresponding quantum key management system, the method further includes: Sending a network access authentication request to the corresponding quantum key management system, so that the quantum key management system generates a signature public-private key pair and returns the signature public-private key pair to the identity authentication service system; Sign authentication data using the private key in the signature public-private key pair, obtain signature data and send it to the quantum key management system, so that the quantum key management system verifies authentication information of the signature data based on the public key; After the quantum key management system passes the verification, an authentication token handle returned by the quantum key management system is received. Further, the sending of a key negotiation request to a corresponding quantum key management system, and forwarding of the key negotiation request by the quantum key management system to a quantum key generation system, so that the quantum key generation system establishes a KM-to-KM relay key negotiation link and generates a symmetric authentication key, includes: Send a key agreement request to the corresponding quantum key management system, where the information carried in the key agreement request is QMSID-A||KMID-A||QMSID-B||KMID-B, where QMSID-A is a virtual unique identifier of quantum key management system A, KMID-A is a virtual unique identifier of a quantum key terminal corresponding to quantum key management system A, QMSID-B is a virtual unique identifier of quantum key management system B, KMID-B is a virtual quasi-unique identifier of a quantum key terminal corresponding to quantum key management system B, and || represents a logical AND character; The quantum key management system sends the key agreement request to the quantum key generation system, so that the quantum key generation system triggers the inter-KM relay key agreement, generates the symmetric authentication key and stores it in the relay key pool corresponding to each relay. Further, after sending the key negotiation request to the corresponding quantum key management system, the method further includes: Sending a batch key request to the quantum key management system, wherein the batch key request carries information including the authentication token handle, QMSID-B, and KMID-B; Receive the identification ReadkeyID of the authentication key returned by the quantum key management system, wherein the cross-domain identity authentication service system, as a passive end, adopts push-type monitoring to wait for the quantum key management system corresponding to the local end to return the identification ReadkeyID of the authentication key. Furthermore, the authentication request sent by the user side terminal carries information including a user master key, a user master key identifier and a security chip ID, the user master key is stored in the security chip, and the security chip is set in the user side terminal. Further, the receiving of the login request information sent by the corresponding user-side terminal and responding to the user-side terminal with a constructed token ciphertext based on the login request information includes: Receiving login request information sent by the corresponding user-side terminal, the login request information including the identifier of the authentication key and the ciphertext of the login information encrypted by using the authentication key; Requesting the quantum key management system to obtain the authentication key based on the identifier of the authentication key; The login request information is verified based on the authentication key, and the token ciphertext is generated after the verification is passed. Further, the step of verifying the login request information based on the authentication key and generating the token ciphertext after the verification is successful includes: After the login information is verified, an identity token is generated; The authentication key is used in combination with an encryption algorithm to calculate the ciphertext data of the identity token Token; Calculate the MAC value of the ciphertext data of the identity token Token using a hash operation combined with the authentication key; The token ciphertext is generated based on the ciphertext data of the identity token Token and its MAC value. Furthermore, the method further comprises: Receiving login request information sent by a user-side terminal corresponding to the cross-domain identity authentication service system, wherein the login request information carries the token ciphertext; The token ciphertext is sent to a corresponding quantum key management system so that the quantum key management system searches for an authentication key; the authentication key is received and the token ciphertext is decrypted using the authentication key to obtain a cross-domain authentication result. Further, when receiving the login request information sent by the user-side terminal corresponding to the cross-domain identity authentication service system, if the login request information does not carry the token ciphertext, the method further includes: A connection failure message and an authentication redirection message are responded to the user-side terminal corresponding to the cross-domain identity authentication service system, wherein the authentication redirection message includes parameter information of the cross-domain identity authentication service system. Furthermore, the cross-domain identity authentication service system includes at least one authentication service system outside the cross-domain. In a second aspect, the present invention further proposes a cross-domain identity authentication method based on a quantum key distribution network, which is applied to a user-side terminal, and the method comprises the following steps: Sending an authentication request to the corresponding identity authentication service system to obtain an authentication key identifier assigned by the identity authentication service system; Sending an authentication key application request to a corresponding quantum key management system based on the authentication key identifier to obtain an authentication key returned by the quantum key management system; Sending a login request message to the identity authentication service system, so that the identity authentication service system generates a token ciphertext based on the login request message, wherein the login request message is encrypted using the authentication key; The token ciphertext is received, and when the user-side terminal accesses the cross-domain identity authentication service system, a login request is sent to the cross-domain identity authentication service system, wherein the login request carries the token ciphertext. Further, the user-side terminal is provided with a security chip, in which a quantum key preset by a quantum key distribution system is stored as a user master key, and the step of sending an authentication request to a corresponding identity authentication service system to obtain an authentication key identifier assigned by the identity authentication service system includes: Sending an authentication request to the identity authentication service system, wherein the authentication request carries information including a user master key, a user master key identifier, and a security chip ID; A session is established with the identity authentication service system, and an authentication key identifier ReadkeyID allocated by the identity authentication service system is received. Further, the sending of an authentication key application request to a corresponding quantum key management system based on the authentication key identifier to obtain an authentication key returned by the quantum key management system includes: Construct authentication key request information and send it to the corresponding quantum key management system, the authentication key request information includes the user master key identifier and the request information encrypted by the user master key, the request information is: security chip ID||QMSID-A||KMID-A||ReadkeyID, QMSID-A is the virtual unique identifier of quantum key management system A, KMID-A is the virtual unique identifier of the quantum key terminal corresponding to the quantum key management system A, and ReadkeyID is the authentication key identifier; After the quantum key management system successfully decrypts the authentication key request information by searching for the corresponding user master key according to the user master key identifier, receiving an authentication key encrypted message returned by the quantum key management system, where the authentication key encrypted message is obtained by encrypting the authentication key by the quantum key management system using the user master key; The corresponding user master key is searched according to the user master key identifier, and the authentication key encrypted message is decrypted to obtain the authentication key. Further, the receiving of the token ciphertext and sending a login request to the cross-domain identity authentication service system when the user-side terminal accesses the cross-domain identity authentication service system, wherein the login request carries the token ciphertext, including: Receive the token ciphertext, and use the authentication key to decrypt and verify the token ciphertext to confirm that the response authentication is completed; when the user-side terminal accesses the cross-domain identity authentication service system, forward the token ciphertext to the cross-domain identity authentication service system. The quantum key management system corresponding to the system; Receive the cross-domain authentication result returned by the quantum key management system corresponding to the cross-domain identity authentication service system. Further, the user-side terminal accesses the cross-domain identity authentication service system and sends a login request to the cross-domain identity authentication service system. If the login request does not carry the token ciphertext, the method further includes: Receiving a connection failure message and a redirection message returned by the cross-domain identity authentication service system, wherein the redirection message includes parameter information of the identity authentication service system in the local domain; Based on the parameter information of the identity authentication service system in the domain, an identity authentication process is initiated to the identity authentication service system in the domain. In a third aspect, the present invention further proposes an identity authentication service system, the system comprising: A key negotiation request sending module, used to send a key negotiation request to a corresponding quantum key management system, and the quantum key management system forwards the request to a quantum key generation system, so that the quantum key generation system establishes a KM relay key negotiation link and generates a symmetric authentication key; A request receiving module, used to receive an authentication request sent by a corresponding user-side terminal, and allocate an identifier of the authentication key to the user-side terminal based on the authentication request, so that when the user-side terminal accesses a cross-domain identity authentication service system, it applies for the authentication key from a quantum key management system corresponding to the cross-domain identity authentication service system based on the identifier of the authentication key; The identity authentication module is used to receive the login request information sent by the corresponding user side terminal, and respond to the user side terminal with a constructed token ciphertext based on the login request information, so as to forward the token ciphertext to the cross-domain identity authentication service system when the user side terminal accesses the cross-domain identity authentication service system. In a fourth aspect, the present invention further proposes a user side terminal, the terminal comprising: An authentication request module, used to send an authentication request to a corresponding identity authentication service system to obtain an authentication key identifier assigned by the identity authentication service system; An authentication key application module, configured to send an authentication key application request to a corresponding quantum key management system based on the authentication key identifier, so as to obtain an authentication key returned by the quantum key management system; A login request module sends login request information to the identity authentication service system so that the identity authentication service system generates a token ciphertext based on the login request information, wherein the login request information is encrypted using the authentication key; a cross-domain authentication module is used to receive the token ciphertext and send a login request to the cross-domain identity authentication service system when a user-side terminal accesses the cross-domain identity authentication service system, wherein the login request carries the token ciphertext. In a fifth aspect, the present invention also proposes a cross-domain identity authentication system based on a quantum key distribution network. The system includes a user-side terminal, a quantum key generation system, an identity authentication service system A in the local domain of the user-side terminal, and an identity authentication service system B in the cross-domain of the user-side terminal, wherein the identity authentication service system A is connected to the quantum key management system A, the identity authentication service system B is connected to the quantum key management system B, and the quantum key management system A and the quantum key management system B are both connected to the quantum key generation system, wherein: The identity authentication service system A and the identity authentication service system B are used to send a key negotiation request to the quantum key generation system, establish a KM relay key negotiation link within the quantum key generation system, and generate a symmetric authentication key; the user-side terminal sends an authentication request to the identity authentication service system A, and receives an authentication key identifier returned by the identity authentication service system A; The user-side terminal sends a login request message to the identity authentication service system A, and receives a token ciphertext responded by the identity authentication service system A; The user-side terminal accesses the identity authentication service system B based on the token ciphertext. The advantages of the present invention are: (1) The identity authentication service system in the present invention adopts a configurable key application mode to initiate a cross-domain key negotiation request to the quantum key management system, establishes a relay key link between KMs in the quantum key generation system, realizes key negotiation between cross-domain quantum key management systems, and solves the problem of key synchronization between quantum key distribution networks in cross-domain identity authentication service systems; the identity authentication service system receives the authentication request sent by the user-side terminal, and responds to the user-side terminal with a constructed token ciphertext. When there is no need to centrally maintain user identity tokens between multiple cross-domain identity authentication service systems, when the user needs to access other cross-domain identity authentication service systems, the user side directly forwards the identity token ciphertext generated in the domain to the corresponding cross-domain identity authentication service system for decryption and verification. After passing, the cross-domain authentication is completed, which solves the problem that the traditional cross-domain identity authentication service system needs to centrally maintain identity tokens. (2) Safely distribute authentication keys based on quantum key distribution networks, encrypt identity authentication data based on authentication keys, and ensure data integrity through HMAC. (3) Based on the security of quantum key distribution information, the negotiation and generation of quantum symmetric keys are realized, which is still safe even when quantum computing has infinite computing resources; quantum symmetric keys are used as authentication keys for identity authentication data encryption, and symmetric algorithms are combined to replace the current public key cryptographic algorithms that are vulnerable to quantum computing attacks, preventing the threat of quantum computing to the security of classical cryptography. (4) The user-side terminal uses the pre-set key of the security chip as the user master key, and applies for the authentication key from the quantum key distribution network based on the user master key to encrypt the login information. After receiving the encrypted login information, the identity authentication service system decrypts and verifies the legitimacy, which solves the problem that the traditional identity authentication credential data is not encrypted or the encryption relies on the public key algorithm. (5) This solution makes relatively little change to the system as a whole. The user side uses a mature security chip integration solution to provide key storage and cryptographic algorithm functions. The authentication server directly connects to the quantum key distribution network through the key interface to apply for keys, which is easy to implement and there is no need to worry about the large key consumption on the server side. Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS FIG1 is a schematic diagram of a process of a cross-domain identity authentication method based on a quantum key distribution network proposed in Embodiment 1 of the present invention; FIG2 is a flow chart of a cross-domain identity authentication method based on a quantum key distribution network proposed in Embodiment 2 of the present invention; 3 is a schematic diagram of the structure of the identity authentication service system proposed in Embodiment 3 of the present invention; FIG4 is a schematic diagram of the structure of a user-side terminal proposed in Embodiment 4 of the present invention; FIG5 is a schematic diagram of the structure of a cross-domain identity authentication system based on a quantum key distribution network proposed in Embodiment 5 of the present invention; FIG6 is a schematic diagram of the structure of a cross-domain identity authentication system based on a quantum key distribution network proposed in Embodiment 6 of the present invention; Figure 7 is a structural diagram of a cross-domain identity authentication system based on a quantum key distribution network proposed in Example 7 of the present invention. DETAILED DESCRIPTION In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in combination with the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Example 1 As shown in FIG1 , the first embodiment of the present invention proposes a cross-domain identity authentication method based on a quantum key distribution network, which is applied to an identity authentication service system. The method includes the following steps: S101, sending a key negotiation request to a corresponding quantum key management system, and the quantum key management system forwards it to a quantum key generation system, so that the quantum key generation system establishes a KM relay key negotiation link and generates a symmetric authentication key; S102, receiving an authentication request sent by a corresponding user-side terminal, and allocating an identifier of the authentication key to the user-side terminal based on the authentication request, so that when the user-side terminal accesses a cross-domain identity authentication service system, the user-side terminal applies for the authentication key from a quantum key management system corresponding to the cross-domain identity authentication service system based on the identifier of the authentication key; S103, receiving the login request information sent by the corresponding user side terminal, and sending a login request to the user side terminal based on the login request information. The constructed token ciphertext is responded to so that when the user-side terminal accesses the cross-domain identity authentication service system, the token ciphertext is forwarded to the cross-domain identity authentication service system. It should be noted that in this embodiment, the user-side terminal can send a login request to the identity authentication service system in this domain and the cross-domain identity authentication service system. Each identity authentication service system is connected to a quantum key management system, and each quantum key management system is connected to the quantum key generation system. The identity authentication service system uses a configurable key application mode to initiate a cross-domain key negotiation request to the quantum key management system, establish a relay key link between KMs in the quantum key generation system, and realize key negotiation between cross-domain quantum key management systems, solving the problem of key synchronization between cross-domain identity authentication service systems based on the quantum key distribution network; the identity authentication service system receives the authentication request sent by the user-side terminal, and responds to the constructed token ciphertext to the user-side terminal. There is no need to centrally maintain user identity tokens between multiple cross-domain identity authentication service systems. When the user needs to access other cross-domain identity authentication service systems, the user side directly forwards the identity token ciphertext generated in this domain to the corresponding cross-domain identity authentication service system to complete decryption and verification. After passing, the cross-domain authentication is completed, solving the problem that the traditional cross-domain identity authentication service system needs to centrally maintain the identity token, and avoiding the risk of theft and tampering during the distribution of identity authentication data. It should be noted that the quantum key distribution network in this embodiment has the ability to provide quantum keys end-to-end. Multiple quantum key management systems directly obtain quantum keys and cache symmetric key pools. There is no restriction on the relay implementation method of quantum keys. Multiple quantum key management systems are decoupled rather than cascaded. In addition, the user-side terminal implements cross-domain identity authentication based on a security chip, which solves the problem of decentralization of cross-domain identity authentication and confidentiality and integrity of authentication credential data distribution. In one embodiment, before the step S101: sending a key agreement request to the corresponding quantum key management system, the method further includes the following steps: Sending a network access authentication request to the corresponding quantum key management system, so that the quantum key management system generates a signature public-private key pair and returns the signature public-private key pair to the identity authentication service system; Sign authentication data using the private key in the signature public-private key pair, obtain signature data and send it to the quantum key management system, so that the quantum key management system verifies authentication information of the signature data based on the public key; After the quantum key management system passes the verification, an authentication token handle returned by the quantum key management system is received. It should be noted that the identity authentication service system A in the user-side terminal domain connects to the quantum key management system A to complete the initialization configuration. Then, the identity authentication service system A, as the key application server, sends a network authentication request to the quantum key management system A to which it is connected, so that the quantum key management system A generates a signature public and private key pair Kp and Ks, and imports it into the identity authentication service system A. The identity authentication service system A uses the private key Ks to sign the authentication data and sends it to the quantum key management system. A, quantum key management system A uses the preset public key Kp to verify the signed authentication information, and after the verification is successful, it returns the authentication success. Quantum key management system A returns the authentication token handle tokenHandle-A, and the identity authentication service system A caches the authentication token handle tokenHandle-A. It should be noted that the identity authentication service system B within the cross-domain of the user-side terminal follows the same steps to obtain the authentication token handle tokenHandle-B returned by the quantum key management system B. In one embodiment, the step S101: sending a key negotiation request to a corresponding quantum key management system, and forwarding the key negotiation request to a quantum key generation system by the quantum key management system, so that the quantum key generation system establishes a KM relay key negotiation link and generates a symmetric authentication key, includes the following steps: Send a key agreement request to the corresponding quantum key management system, where the information carried in the key agreement request is QMSID-A||KMID-A||QMSID-B||KMID-B, where QMSID-A is a virtual unique identifier of quantum key management system A, KMID-A is a virtual unique identifier of a quantum key terminal corresponding to quantum key management system A, QMSID-B is a virtual unique identifier of quantum key management system B, KMID-B is a virtual quasi-unique identifier of a quantum key terminal corresponding to quantum key management system B, and || represents a logical AND character; The quantum key management system sends the key agreement request to the quantum key generation system, so that the quantum key generation system triggers the inter-KM relay key agreement, generates the symmetric authentication key and stores it in the relay key pool corresponding to each relay. Specifically, the identity authentication service system A initiates a key negotiation request to the quantum key management system A. The quantum key management system A identifies the key negotiation request as a cross-domain key negotiation mode and sends the key negotiation request to the quantum key generation system. The quantum key generation system triggers the relay key negotiation process of the quantum key terminal KM-A and the quantum key terminal KM-B according to the key negotiation request information. After the negotiation process is completed, KM-A and KM-B generate symmetric keys respectively and store them in the corresponding relay key pool RelayAB and relay key pool RelayBA. In one embodiment, after the step S101: sending a key negotiation request to a corresponding quantum key management system, the method further includes the following steps: Sending a batch key request to the quantum key management system, wherein the batch key request carries information including the authentication token handle, QMSID-B, and KMID-B; Receive the identification ReadkeyID of the authentication key returned by the quantum key management system, wherein the cross-domain identity authentication service system, as a passive end, adopts push-type monitoring to wait for the quantum key management system corresponding to the local end to return the identification ReadkeyID of the authentication key. Specifically, the identity authentication service system A applies for batch keys from the quantum key management system A in advance, inputs the authentication Token handle tokenHandle-A, QMSID-B, KMID-B, returns the acquisition notification and authentication key identifier ReadkeyID. The cross-domain identity authentication service system B, as the passive end, adopts push-type monitoring to wait for the local quantum key management system B to return the key information. In one embodiment, the authentication request sent by the user side terminal carries information including a user master key, a user master key identifier, and a security chip ID. The user master key is stored in the security chip, the security chip is arranged in the user side terminal, and the user master key is preset in the security chip by the quantum key generation system. In one embodiment, in step S102, receiving an authentication request sent by a corresponding user-side terminal, and allocating an identifier of the authentication key to the user-side terminal based on the authentication request, so that when the user-side terminal accesses a cross-domain identity authentication service system, the authentication key is applied to a quantum key management system corresponding to the cross-domain identity authentication service system based on the identifier of the authentication key, specifically including: The identity authentication service system A receives the authentication request initiated by the user terminal, which carries the user master key UMK-1, key identifier NUMK-1, and chip ID obtained from the security chip; The user-side terminal establishes a session with the identity authentication service system A, and the identity authentication service system A allocates a key identifier ReadkeyID to the user-side terminal. In one embodiment, the step S103: receiving the login request information sent by the corresponding user-side terminal, and responding to the user-side terminal with a constructed token ciphertext based on the login request information, includes the following steps: S131, receiving login request information sent by the corresponding user-side terminal, the login request information including the identifier of the authentication key and the ciphertext of the login information encrypted by using the authentication key; It should be noted that the identity authentication service system A receives the login information ciphertext and ReadkeyID sent by the user-side terminal. The login information ciphertext is obtained by encrypting the login information by the user-side terminal using the authentication key WK-A. The authentication key WK-A comes from the relay key pool RelayAB of KM-A. S132, requesting the quantum key management system to obtain the authentication key based on the identifier of the authentication key; S133. Verify the login request information based on the authentication key, and generate the token ciphertext after the verification is passed. Specifically, the identity authentication service system A receives the login information ciphertext, and obtains the authentication key WK-A from the vector key management system A based on the authentication key identifier ReadkeyID, decrypts and verifies the login information, and after the verification is passed, the identity authentication service system A generates a token ciphertext. In one embodiment, the step S133: verifying the login request information based on the authentication key and generating the token ciphertext after the verification is successful, specifically includes the following steps: After the login information is verified, an identity token is generated; The authentication key is used in combination with an encryption algorithm to calculate the ciphertext data of the identity token Token; Calculate the MAC value of the ciphertext data of the identity token Token using a hash operation combined with the authentication key; The token ciphertext is generated based on the ciphertext data of the identity token Token and its MAC value. Specifically, the identity authentication service system A uses the authentication key WK-A combined with the national secret SM4 algorithm to calculate the ciphertext data of the Token, and uses the HMAC-SM3 algorithm combined with the authentication key to calculate the MAC value of the ciphertext data of the Token. The ciphertext data and MAC value of the Token are forwarded to the user-side terminal. The user-side terminal receives the ciphertext data and MAC value of the Token, uses the authentication key WK-A to complete the decryption, and the message code comparison is consistent, and the response authentication is completed. In one embodiment, when the identity authentication service system receives login request information sent by a cross-domain user-side terminal, the method further includes the following steps: Receiving login request information sent by a user-side terminal corresponding to the cross-domain identity authentication service system, wherein the login request information carries the token ciphertext; The token ciphertext is sent to a corresponding quantum key management system so that the quantum key management system searches for an authentication key; the authentication key is received and the token ciphertext is decrypted using the authentication key to obtain a cross-domain authentication result. It should be noted that when the identity authentication service system B is accessed by a cross-domain user-side terminal, it receives the ciphertext data, MAC value, and ReadkeyID, QMSID-A, and KMID-A of the Token sent by the user-side terminal; the identity authentication service system B transmits ReadkeyID, QMSID-A, KMID-A, and tokenHandle-B to the quantum key management system B, so that the quantum key management system B searches for the corresponding authentication key WK-A from the relay key pool RelayBA and returns it to the identity authentication service system B; the identity authentication service system B obtains the authentication key WK-A, decrypts the ciphertext data and MAC value of the Token, and responds that the cross-domain authentication is completed if the decryption succeeds, otherwise it responds that the authentication fails. In one embodiment, when receiving a login request message sent by a user-side terminal corresponding to a cross-domain identity authentication service system, if the login request message does not carry the token ciphertext, the method further includes: A connection failure message and an authentication redirection message are responded to the user-side terminal corresponding to the cross-domain identity authentication service system, wherein the authentication redirection message includes parameter information of the cross-domain identity authentication service system. It should be noted that, in the identity authentication process of this embodiment, the user-side terminal must first obtain the identity token Token from the identity authentication service system A in the local domain before completing the cross-domain identity authentication process, which has clear authentication prerequisites. Therefore, this embodiment adds a judgment mechanism to the cross-domain identity authentication process, so that when the user-side terminal first initiates a login request to the cross-domain identity authentication service system B, the identity authentication service system B identifies the user as a first-time cross-domain login user, and the identity authentication service system B returns a redirect message to the user side, and the user side re-initiates the identity authentication process to the identity authentication service system A within the domain. In one embodiment, the cross-domain identity authentication service system includes at least one authentication service system outside the cross-domain. It should be noted that, in this embodiment, the identity authentication service system A serves as the identity authentication service system within the domain of the user-side terminal, and the cross-domain identity authentication service system may include the identity authentication service system B and the identity authentication service system C, etc., where each identity authentication service system is connected to the corresponding quantum key management system. Example 2 As shown in FIG2 , the second embodiment of the present invention further proposes a cross-domain identity authentication method based on a quantum key distribution network, which is applied to a user-side terminal. The method includes the following steps: S201, sending an authentication request to a corresponding identity authentication service system to obtain an authentication key identifier assigned by the identity authentication service system; S202, sending an authentication key application request to a corresponding quantum key management system based on the authentication key identifier to obtain an authentication key returned by the quantum key management system; S203, sending a login request message to the identity authentication service system, so that the identity authentication service system generates a token ciphertext based on the login request message, wherein the login request message is encrypted using the authentication key; S204: Receive the token ciphertext, and when the user-side terminal accesses the cross-domain identity authentication service system, send a login request to the cross-domain identity authentication service system, wherein the login request carries the token ciphertext. In this embodiment, the user-side terminal applies for an authentication key from the quantum key generation system for encrypting the login request information and then sending it to the identity authentication service system. After receiving the login request information, the identity authentication service system decrypts and verifies the legitimacy and then generates a token ciphertext, which solves the problem that the traditional identity authentication credential data is not encrypted or the encryption relies on a public key algorithm. There is no need to centrally maintain user identity tokens between multiple cross-domain identity authentication service systems. When the user-side terminal needs to access other cross-domain identity authentication service systems, the user-side terminal directly forwards the identity token ciphertext generated in the domain to the corresponding cross-domain identity authentication service system for decryption and verification. After passing, the cross-domain authentication is completed, which solves the problem that the traditional cross-domain identity authentication service system needs to centrally maintain identity tokens. In one embodiment, the user-side terminal is provided with a security chip, and the security chip stores a quantum key preset by a quantum key distribution system as a user master key. The step S201: sending an authentication request to a corresponding identity authentication service system to obtain an authentication key identifier assigned by the identity authentication service system includes the following steps: S211, sending an authentication request to the identity authentication service system, wherein the authentication request carries information including a user master key, a user master key identifier, and a security chip ID; S212: Establish a session with the identity authentication service system, and receive an authentication key identifier ReadkeyID allocated by the identity authentication service system. It should be noted that the user-side terminal sends a key injection request to the quantum key management system A connected to the identity authentication service system A in this domain, so that the quantum key management system A pre-sets the quantum key to the security chip of the user-side terminal as the user master key, and the quantum key management system A stores the correspondence between the user master key and the security chip. The user-side terminal initiates an authentication request to the identity authentication service system A in this domain, and obtains the user master key UMK-1, key identifier NUMK-1, and chip ID from the security chip. Subsequently, the user-side terminal establishes a session with the identity authentication service system A, and the identity authentication service system A allocates the authentication key identifier ReadkeyID. This embodiment uses the pre-set key of the security chip as the user master key, and applies for an authentication key from the quantum key distribution network based on the user master key to encrypt login information, thereby improving security. In one embodiment, the step S202: sending an authentication key application request to a corresponding quantum key management system based on the authentication key identifier to obtain an authentication key returned by the quantum key management system includes the following steps: S221, constructing authentication key request information and sending it to the corresponding quantum key management system, the authentication key request information includes the user master key identifier and the request information encrypted by the user master key, the request information is: security chip ID||QMSID-A||KMID-A||ReadkeyID, QMSID-A is the virtual unique identifier of the quantum key management system A, KMID-A is the virtual unique identifier of the quantum key terminal corresponding to the quantum key management system A, and ReadkeyID is the authentication key identifier; S222, after the quantum key management system successfully decrypts the authentication key request information by searching for the corresponding user master key according to the user master key identifier, receiving an authentication key encrypted message returned by the quantum key management system, where the authentication key encrypted message is obtained by encrypting the authentication key by the quantum key management system using the user master key; S223: Search for a corresponding user master key according to the user master key identifier, decrypt the authentication key encrypted message, and obtain the authentication key. Specifically, when the user-side terminal accesses the identity authentication service system A in this domain, it initiates an authentication key application request to the quantum key management system A. The constructed authentication key request information is: user master key UMK-1 encrypted (chip ID||QMSID-A||KMID-A||ReadkeyID) + key identifier NUMK-1. The quantum key management system A searches for the corresponding key according to the key identifier NUMK-1 to complete the decryption of the authentication key request information, and at the same time applies for the authentication key WK-A according to the ReadkeyID. The authentication key comes from the relay key pool RelayAB of KM-A. The authentication key WK-A is encrypted by the user master key UMK-1 and distributed to the user-side terminal. The user-side terminal searches for the corresponding user master key UMK-1 according to the key identifier NUMK-1 to complete the decryption. The user-side terminal obtains the authentication key WK-A, and the user-side terminal maintains the relationship data of the authentication key WK-A, ReadkeyID, QMSID-A, and KMID-A. It should be noted that the user-side terminal obtains the authentication key from the quantum key management system based on the security chip. When the side terminal accesses the cross-domain identity authentication service system, the cross-domain quantum key management system obtains the symmetric authentication key based on the unique identifier of the authentication key maintained by the quantum key distribution network. In one embodiment, the step S203: sending the login request information to the identity authentication service system so that the identity authentication service system generates a token ciphertext based on the login request information, wherein the login request information is encrypted using the authentication key, specifically includes the following steps: The user-side terminal uses the authentication key WK-A to encrypt the login information, and sends the login information ciphertext and ReadkeyID to the identity authentication service system A, so that the identity authentication service system A receives the login information ciphertext, and obtains the authentication key WK-A from the quantum key management system A based on the ReadkeyID, decrypts and verifies the login information. After the verification is passed, the identity authentication service system A generates a token ciphertext. In one embodiment, the step S204: receiving the token ciphertext, when the user-side terminal accesses the cross-domain identity authentication service system, sending a login request to the cross-domain identity authentication service system, wherein the login request carries the token ciphertext, includes the following steps: S241, receiving the token ciphertext, and using the authentication key to decrypt and verify the token ciphertext, confirming that the response authentication is completed; It should be noted that the user-side terminal receives the ciphertext data and MAC value of the Token returned by the identity authentication service system A, uses the authentication key WK-A to complete the decryption, and the message code is consistent, and the response authentication is completed. S242. When the user-side terminal accesses the cross-domain identity authentication service system, forwarding the token ciphertext to the quantum key management system corresponding to the cross-domain identity authentication service system; It should be noted that when the user-side terminal needs to access the cross-domain identity authentication service system B, the user-side terminal sends the Token's ciphertext data, MAC value, and ReadkeyID, QMSID-A, and KMID-A to the identity authentication service system B. S243. Receive the cross-domain authentication result returned by the quantum key management system corresponding to the cross-domain identity authentication service system. It should be noted that when the identity authentication service system B receives the login request information sent by the user-side terminal, the identity authentication service system B transmits ReadkeyID, QMSID-A, KMID-A, and tokenHandle-B to the quantum key management system B. The quantum key management system B searches for the corresponding authentication key WK-A from the relay key pool RelayBA and returns it to the identity authentication service system B; the identity authentication service system B obtains the authentication key WK-A, decrypts the ciphertext data and MAC value of the Token, and the decryption is completed by responding to the cross-domain authentication, and the authentication fails if it fails to respond. In one embodiment, a user-side terminal accesses a cross-domain identity authentication service system and sends a login request to the cross-domain identity authentication service system. If the login request does not carry the token ciphertext, the method further includes: Receive the connection failure message and redirection message returned by the cross-domain identity authentication service system, the redirection message includes the domain Parameter information of the identity authentication service system within; Based on the parameter information of the identity authentication service system in the domain, an identity authentication process is initiated to the identity authentication service system in the domain. It should be noted that in the present embodiment, the identity authentication process is that the user-side terminal must first obtain the identity token Token from the identity authentication service system A in the local domain before completing the cross-domain identity authentication process, which has clear authentication prerequisites. Therefore, this embodiment adds a judgment mechanism to the cross-domain identity authentication process, so that when the user-side terminal first initiates a login request to the cross-domain identity authentication service system B, the identity authentication service system B identifies the user as a first-time cross-domain login user, and the identity authentication service system B returns a redirect message to the user side, and the user side re-initiates the identity authentication process to the identity authentication service system A within the domain. Example 3 As shown in FIG3 , the third embodiment of the present invention provides an identity authentication service system, the system comprising: A key negotiation request sending module 21 is used to send a key negotiation request to a corresponding quantum key management system, and the quantum key management system forwards the key negotiation request to a quantum key generation system, so that the quantum key generation system establishes a KM relay key negotiation link and generates a symmetric authentication key; A request receiving module 22 is used to receive an authentication request sent by a corresponding user-side terminal, and allocate an identifier of the authentication key to the user-side terminal based on the authentication request, so that when the user-side terminal accesses a cross-domain identity authentication service system, it applies for the authentication key from a quantum key management system corresponding to the cross-domain identity authentication service system based on the identifier of the authentication key; The identity authentication module 23 is used to receive the login request information sent by the corresponding user side terminal, and respond to the user side terminal with a constructed token ciphertext based on the login request information, so as to forward the token ciphertext to the cross-domain identity authentication service system when the user side terminal accesses the cross-domain identity authentication service system. In this embodiment, the identity authentication service system uses a configurable key application mode to initiate a cross-domain key negotiation request to the quantum key management system, establishes a relay key link between KMs in the quantum key generation system, realizes key negotiation between cross-domain quantum key management systems, and solves the problem of key synchronization between cross-domain identity authentication service systems based on the quantum key distribution network; the identity authentication service system receives the authentication request sent by the user-side terminal, and responds to the user-side terminal with a constructed token ciphertext. There is no need to centrally maintain user identity tokens between multiple cross-domain identity authentication service systems. When a user needs to access other cross-domain identity authentication service systems, the user side directly forwards the identity token ciphertext generated in the domain to the corresponding cross-domain identity authentication service system to complete decryption and verification. After passing, cross-domain authentication is completed, which solves the problem that traditional cross-domain identity authentication service systems need to be centralized. Issues with maintaining identity tokens. In one embodiment, the identity authentication service system further includes a network access request module, which is specifically used to perform the following steps: sending a network access authentication request to the corresponding quantum key management system, so that the quantum key management system generates a signature public-private key pair and returns the signature public-private key pair to the identity authentication service system; Sign authentication data using the private key in the signature public-private key pair, obtain signature data and send it to the quantum key management system, so that the quantum key management system verifies authentication information of the signature data based on the public key; After the quantum key management system passes the verification, an authentication token handle returned by the quantum key management system is received. In one embodiment, the key agreement request sending module 21 is specifically configured to perform the following steps: Send a key agreement request to the corresponding quantum key management system, where the information carried in the key agreement request is QMSID-A||KMID-A||QMSID-B||KMID-B, where QMSID-A is a virtual unique identifier of quantum key management system A, KMID-A is a virtual unique identifier of a quantum key terminal corresponding to quantum key management system A, QMSID-B is a virtual unique identifier of quantum key management system B, KMID-B is a virtual quasi-unique identifier of a quantum key terminal corresponding to quantum key management system B, and || represents a logical AND character; The quantum key management system sends the key agreement request to the quantum key generation system, so that the quantum key generation system triggers the inter-KM relay key agreement, generates the symmetric authentication key and stores it in the relay key pool corresponding to each relay. In one embodiment, the identity authentication service system further includes a batch key request module, which is specifically configured to perform the following steps: Sending a batch key request to the quantum key management system, wherein the batch key request carries information including the authentication token handle, QMSID-B, and KMID-B; Receive the identification ReadkeyID of the authentication key returned by the quantum key management system, wherein the cross-domain identity authentication service system, as a passive end, adopts push-type monitoring to wait for the quantum key management system corresponding to the local end to return the identification ReadkeyID of the authentication key. In one embodiment, the authentication request sent by the user side terminal carries information including a user master key, a user master key identifier, and a security chip ID. The user master key is stored in the security chip, the security chip is arranged in the user side terminal, and the user master key is preset in the security chip by the quantum key generation system. In one embodiment, the request receiving module 22 is specifically configured to perform the following steps: The identity authentication service system A receives the authentication request initiated by the user terminal, which carries the user master key UMK-1, key identifier NUMK-1, and chip ID obtained from the security chip; The user-side terminal establishes a session with the identity authentication service system A, and the identity authentication service system A allocates a key identifier ReadkeyID to the user-side terminal. In one embodiment, the identity authentication module 23 includes: A login request information receiving unit, configured to receive the login request information sent by the corresponding user-side terminal, wherein the login request information includes an identifier of the authentication key and a ciphertext of the login information encrypted by the authentication key; An authentication key requesting unit, configured to request the quantum key management system to obtain the authentication key based on the identifier of the authentication key; The token ciphertext generation unit is used to verify the login request information based on the authentication key and generate the token ciphertext after the verification is passed. In one embodiment, the token ciphertext generation unit is used to perform the following steps: After the login information is verified, an identity token is generated; The authentication key is used in combination with an encryption algorithm to calculate the ciphertext data of the identity token Token; Calculate the MAC value of the ciphertext data of the identity token Token using a hash operation combined with the authentication key; The token ciphertext is generated based on the ciphertext data of the identity token Token and its MAC value. In one embodiment, the identity authentication service system further includes a cross-domain login authentication module, which is used to perform the following steps: receiving login request information sent by a user-side terminal corresponding to the cross-domain identity authentication service system, wherein the login request information carries the token ciphertext; The token ciphertext is sent to a corresponding quantum key management system so that the quantum key management system searches for an authentication key; the authentication key is received and the token ciphertext is decrypted using the authentication key to obtain a cross-domain authentication result. In one embodiment, the identity authentication service system also includes an authentication redirection module for performing the following steps: responding to a user-side terminal corresponding to the cross-domain identity authentication service system with connection failure information and an authentication redirection message, wherein the authentication redirection message includes parameter information of the cross-domain identity authentication service system. It should be noted that other embodiments of the identity authentication service system of the present invention or implementation methods thereof may refer to the above-mentioned method embodiment 1, which will not be repeated here. Example 4 As shown in FIG4 , the fourth embodiment of the present invention provides a user side terminal, the terminal comprising: The authentication request module 11 is used to send an authentication request to the corresponding identity authentication service system to obtain an authentication key identifier assigned by the identity authentication service system; The authentication key application module 12 is used to send the authentication key to the corresponding quantum key management system based on the authentication key identifier. Apply for a request to obtain the authentication key returned by the quantum key management system; A login request module 13 sends a login request message to the identity authentication service system, so that the identity authentication service system generates a token ciphertext based on the login request message, wherein the login request message is encrypted using the authentication key; The cross-domain authentication module 14 is used to receive the token ciphertext, and when the user-side terminal accesses the cross-domain identity authentication service system, send a login request to the cross-domain identity authentication service system, wherein the login request carries the token ciphertext. In this embodiment, the user-side terminal applies for an authentication key from the quantum key generation system for encrypting the login request information and then sending it to the identity authentication service system. After receiving the login request information, the identity authentication service system decrypts and verifies the legitimacy and then generates a token ciphertext, which solves the problem that the traditional identity authentication credential data is not encrypted or the encryption relies on a public key algorithm. There is no need to centrally maintain user identity tokens between multiple cross-domain identity authentication service systems. When the user-side terminal needs to access other cross-domain identity authentication service systems, the user-side terminal directly forwards the identity token ciphertext generated in the domain to the corresponding cross-domain identity authentication service system for decryption and verification. After passing, the cross-domain authentication is completed, which solves the problem that the traditional cross-domain identity authentication service system needs to centrally maintain identity tokens. In one embodiment, the user-side terminal is provided with a security chip, and the security chip stores a quantum key preset by a quantum key distribution system as a user master key. The authentication request module 11 is specifically used to perform the following steps: Sending an authentication request to the identity authentication service system, wherein the authentication request carries information including a user master key, a user master key identifier, and a security chip ID; A session is established with the identity authentication service system, and an authentication key identifier ReadkeyID allocated by the identity authentication service system is received. In one embodiment, the authentication key application module 12 is specifically configured to perform the following steps: Construct authentication key request information and send it to the corresponding quantum key management system, the authentication key request information includes the user master key identifier and the request information encrypted by the user master key, the request information is: security chip ID||QMSID-A||KMID-A||ReadkeyID, QMSID-A is the virtual unique identifier of quantum key management system A, KMID-A is the virtual unique identifier of the quantum key terminal corresponding to the quantum key management system A, and ReadkeyID is the authentication key identifier; After the quantum key management system successfully decrypts the authentication key request information by searching for the corresponding user master key according to the user master key identifier, receiving an authentication key encrypted message returned by the quantum key management system, where the authentication key encrypted message is obtained by encrypting the authentication key by the quantum key management system using the user master key; The corresponding user master key is searched according to the user master key identifier, and the authentication key encrypted message is decrypted to obtain The authentication key. In one embodiment, the login request module 13 is specifically configured to perform the following steps: The user-side terminal uses the authentication key WK-A to encrypt the login information, and sends the login information ciphertext and ReadkeyID to the identity authentication service system A, so that the identity authentication service system A receives the login information ciphertext, and obtains the authentication key WK-A from the quantum key management system A based on the ReadkeyID, decrypts and verifies the login information. After the verification is passed, the identity authentication service system A generates a token ciphertext. In one embodiment, the cross-domain authentication module 14 is specifically configured to perform the following steps: Receive the token ciphertext, and use the authentication key to decrypt and verify the token ciphertext to confirm that the response authentication is completed; when the user-side terminal accesses the cross-domain identity authentication service system, forward the token ciphertext to the quantum key management system corresponding to the cross-domain identity authentication service system; Receive the cross-domain authentication result returned by the quantum key management system corresponding to the cross-domain identity authentication service system. In one embodiment, a user-side terminal accesses a cross-domain identity authentication service system and sends a login request to the cross-domain identity authentication service system. If the login request does not carry the token ciphertext, the user-side terminal further includes: A redirection message receiving module, used to receive a connection failure message and a redirection message returned by a cross-domain identity authentication service system, wherein the redirection message includes parameter information of the identity authentication service system in the local domain; The identity authentication module is used to initiate an identity authentication process to the identity authentication service system in the domain based on the parameter information of the identity authentication service system in the domain. It should be noted that other embodiments of the user side terminal of the present invention or implementation methods can refer to the above method. Embodiment 2 is not repeated here. Example 5 As shown in FIG5 , the fifth embodiment of the present invention proposes a cross-domain identity authentication system based on a quantum key distribution network, the system comprising a user-side terminal, a quantum key generation system, an identity authentication service system A in the domain of the user-side terminal, and an identity authentication service system B in the cross-domain of the user-side terminal, the identity authentication service system A is connected to the quantum key management system A, the identity authentication service system B is connected to the quantum key management system B, the quantum key management system A and the quantum key management system B are both connected to the quantum key generation system, wherein: The identity authentication service system A and the identity authentication service system B are used to send a key negotiation request to the quantum key generation system, establish a KM relay key negotiation link within the quantum key generation system, and generate a symmetric authentication key; the user-side terminal sends an authentication request to the identity authentication service system A, and receives an authentication key identifier returned by the identity authentication service system A; The user-side terminal sends a login request message to the identity authentication service system A, and receives a token ciphertext responded by the identity authentication service system A; The user-side terminal accesses the identity authentication service system B based on the token ciphertext. In this embodiment, the identity authentication service system uses a configurable key application mode to initiate a cross-domain key negotiation request to the quantum key management system, establishes a relay key link between KMs in the quantum key generation system, realizes key negotiation between cross-domain quantum key management systems, and solves the problem of key synchronization between cross-domain identity authentication service systems based on the quantum key distribution network; the identity authentication service system receives the authentication request sent by the user-side terminal, and responds to the user-side terminal with a constructed token ciphertext. There is no need to centrally maintain user identity tokens between multiple cross-domain identity authentication service systems. When the user needs to access other cross-domain identity authentication service systems, the user side directly forwards the identity token ciphertext generated in the domain to the corresponding cross-domain identity authentication service system to complete decryption and verification. After passing, the cross-domain authentication is completed, which solves the problem that traditional cross-domain identity authentication service systems need to centrally maintain identity tokens. Specifically, the quantum key distribution network includes a quantum key generation system and a quantum key management system (Quantum Key Management Service, QMS). The quantum key generation system is a network composed of two or more quantum key distribution nodes connected by a quantum key distribution system QKD and a quantum key terminal KM link. When two quantum key distribution nodes cannot be directly connected through QKD and KM, key distribution can be achieved through the key relay function of KM. The QKD is a software and hardware system for implementing quantum optical processes (including QKD protocol, synchronization, key distillation, etc.) and cryptographic functions required for quantum key distribution. QKD is an endpoint module that directly generates keys and can be interconnected through QKD links. Two typical QKDs are QKD transmitters (QKD-Tx) and QKD receivers (QKD-Rx). The KM is a software and hardware system used to implement the key management function of the key management layer in the quantum key distribution node, providing key storage, key output, key negotiation, key relay and other functions. The key relay refers to the key generation between non-directly connected quantum key distribution nodes, which can extend the QKD transmission distance. The quantum key management system provides functions including quantum key management, quantum key filling, quantum key distribution, and key synchronization through data interaction with multiple identity authentication service systems across the network. The security chip is a product that complies with the certificate issued by the National Commercial Cryptography Bureau. It can be in the form of a SIM card or a U shield, etc., and is built-in or externally connected to the user-side terminal. It is a secure medium with basic functions such as key storage and cryptographic operations, and can be connected to the quantum key management system to realize functions such as key filling and key application in the security chip. The user-side terminal can have different forms, including mobile phone terminals, PC mobile terminals, etc. Support Connect to the security chip to obtain the key and encrypt the identity token data. The identity authentication service system uses CAS technology to provide user identity authentication, token maintenance, and uses the preset key of the security chip to connect to the quantum key management system to implement key application and other functions. The identity authentication service system A corresponds to the system within the domain on the user side, and the identity authentication service system B corresponds to the system outside the cross-domain. The CAS refers to the Central Authentication Service. The CAS Server is responsible for authenticating users, and the CAS Client is responsible for providing resources. When resources are protected and users need to perform identity authentication, they are redirected to the CAS Server for authentication. Furthermore, the cross-domain identity authentication process based on the quantum key distribution network under the CAS technology includes the following steps: (1) Cross-domain key negotiation process: Identity authentication service system A, as the active end, adopts the "request-based" key transmission mode, and identity authentication service system B, as the passive end, adopts the "push-based" key transmission mode to initiate a cross-domain key negotiation request to the quantum key management system, establish a relay key link between the KMs in the quantum key generation system, and realize cross-domain key negotiation between quantum key management systems. 1-1) Identity authentication service system A calls the initialization interface to complete the initialization process of the quantum key management system A, and inputs QMSID-A, KMID-A, IP, and port parameters. 1-2) Identity authentication service system A, as the key application server, initiates a network authentication request to the quantum key management system. The quantum key management system generates a signature public and private key pair Kp and Ks and imports them into the identity authentication service system. 1-3) The identity authentication service system A uses the private key Ks to sign the authentication data, and the quantum key management system uses the preset public key Kp to verify the signed authentication information. After the verification is successful, it returns the authentication success. 1-4) Quantum key management system A returns tokenHandle-A, and identity authentication service system A caches the authentication token handle. The authentication token handle after authentication can be passed as an input parameter when calling the key application function. Identity authentication system B similarly completes the above S1-S4 process and obtains the authentication token handle tokenHandle-B. 1-5) Identity authentication service system A acts as the active end and initiates key negotiation to quantum key management system A in a request-based manner. Quantum key management system A recognizes that the key negotiation request is a cross-domain key negotiation mode, and the negotiation request information including (QMSID-A||KMID-A||QMSID-B||KMID-B) is sent to the quantum key generation network. 1-6) The quantum key generation network triggers the relay key negotiation process of KM-A and KM-B according to the negotiation request information. After the negotiation process is completed, KM-A and KM-B generate symmetric keys respectively and store them in the relay key pools RelayAB and RelayBA. 1-7) Identity authentication service system A applies for batch keys in advance from quantum key management system A, inputs authentication token handle tokenHandle-A, QMSID-B, KMID-B, and returns acquisition notification and key identifier ReadkeyID. 1-8) The identity authentication service system B, as the passive end, adopts push-based monitoring to wait for the quantum key management system B on the local end to return the key information. The identity authentication service systems on both ends do not need to establish a direct connection relationship. The passive end caches the obtained key information for subsequent key acquisition. (2) Cross-domain authentication key application process: When the user-side terminal accesses the identity authentication service system A in the domain, it will obtain the authentication key from the quantum key management system A based on the security chip. The authentication key comes from the relay key pool of KM-A. When the user-side terminal accesses the cross-domain identity authentication service system B, after the authentication key identifier is transmitted to the quantum key management system B, the corresponding authentication key is searched in the relay key pool of KM-B. 2-1) Quantum key management system A pre-sets quantum key to the security chip of the user-side terminal as the user master key; quantum key management system A stores the correspondence between the user master key and the security chip. 2-2) The user-side terminal initiates an authentication request to the identity authentication service system A, and obtains the user master key UMK-1, key identifier NUMK-1, and chip ID from the security chip. 2-3) The user terminal establishes a session with the identity authentication service system A, and the identity authentication service system A allocates the key identifier ReadkeyID. The user terminal initiates an authentication key application request to the quantum key management system A, and constructs the authentication key request information: user master key UMK-1 encrypted (time-varying parameter || chip ID || ReadkeyID) + key identifier NUMK-1. 2-4) Quantum key management system A searches for the corresponding key according to the key identifier NUMK-1 to complete the decryption of the authentication key request information, and obtains the authentication key WK-A according to ReadkeyID. The authentication key comes from the relay key pool RelayAB of KM-A. 2-5) The authentication key WK-A is encrypted by the user master key UMK-1 and distributed to the user side terminal. The user side terminal searches for the corresponding user master key UMK-1 according to the key identifier NUMK-1 to complete the decryption, and the user side terminal obtains the authentication key WK-A. The user side terminal maintains the relationship data of the authentication key WK-A, ReadkeyID, QMSID-A, and KMID-A. (3) Cross-domain identity authentication process: Identity authentication service system A obtains the authentication key, constructs the ciphertext data of the Token, and uses the HMAC-SM3 algorithm combined with the authentication key to calculate the MAC value of the ciphertext data of the Token, and forwards the ciphertext data and MAC value of the Token to the user-side terminal. When the user needs to access other cross-domain identity authentication service systems, the user side directly forwards the ciphertext data and MAC value of the Token to the corresponding cross-domain identity authentication service system for decryption and verification, and responds that the cross-domain authentication is completed after passing. 3-1) The user-side terminal uses the authentication key WK-A in combination with the SM4 and HAMC-SM3 algorithms to operate the login information, calculates the login information ciphertext (time-varying parameters + login authentication credentials), the login information MAC value, and sends the login information ciphertext, login information MAC value and ReadkeyID to the identity authentication service system A. 3-2) Identity authentication service system A receives the ciphertext of the login information and the MAC value of the login information, and obtains the authentication key WK-A from the subkey management system A based on the ReadkeyID, decrypts and verifies the login information, and after the login authentication credentials are verified, the identity authentication service system A generates an identity token Token based on the CAS technology. 3-3) Identity authentication service system A then uses the authentication key WK-A combined with the national secret SM4 algorithm to calculate the Token's ciphertext data (time-varying parameter + Token), and uses the HMAC-SM3 algorithm combined with the authentication key to calculate the MAC1 value of the Token's ciphertext data. The Token's ciphertext data and MAC-1 value are forwarded to the user-side terminal. 3-4) The user terminal receives the ciphertext data and MAC value of the token, and uses the authentication key WK-A to decrypt the ciphertext data of the token to obtain the token. The HMAC-SM3 algorithm is used to calculate the Mac-2 value, and the MAC-1 and Mac-2 are compared to see if they are consistent. If the decrypted information is consistent, continue.

[0018] If the decryption fails or the MAC value is inconsistent, a failure response is returned. 3-5) When the user needs to access the cross-domain identity authentication service system B, the user-side terminal sends the Token's ciphertext data, MAC-1 value, and ReadkeyID, QMSID-A, and KMID-A to the identity authentication service system B. 3-6) The identity authentication service system B transmits ReadkeyID, QMSID-A, KMID-A, and tokenHandle-B to the quantum key management system B. The quantum key management system B searches the relay key pool RelayBA for the corresponding authentication key WK-A based on the key identifier. 3-7) Identity authentication service system B obtains the authentication key WK-A, and uses the HMAC-SM3 algorithm to calculate the Mac-3 value, and compares whether MAC-3 is consistent with Mac-1. If the decrypted information is consistent, the authentication is successful. If the decryption information fails or the MAC value comparison is inconsistent, an authentication failure response is returned. It should be noted that in this embodiment, the user-side terminal uses the security chip pre-set key as the user master key, and applies for an authentication key from the quantum key distribution network based on the user master key to encrypt the login information. The identity authentication service system decrypts and verifies the legitimacy after receiving the encrypted login information, which solves the problem that the traditional identity authentication credential data is not encrypted or the encryption relies on the public key algorithm. After the identity authentication service system verifies that the user authentication credentials have passed, it responds to the user with a constructed token ciphertext. When the user needs to access other cross-domain identity authentication service systems, the user side directly forwards the token ciphertext to the corresponding cross-domain identity authentication service system, solving the problem that traditional cross-domain identity authentication service systems need to centrally maintain identity tokens. The identity authentication service system uses a configurable key application mode to initiate a cross-domain key negotiation request to the quantum key management system, establish a relay key link between KMs in the quantum key generation system, realize key negotiation between cross-domain quantum key management systems, and solve the problem of key synchronization between cross-domain identity authentication service systems based on the quantum key distribution network. Example 6 As shown in Figure 6, the sixth embodiment of the present invention proposes another cross-domain identity authentication system based on a quantum key distribution network in combination with CAS technology. The system is the same as the above-mentioned embodiment 5, both including: a quantum key distribution network, a security chip, a user-side terminal, an identity authentication service system A, and an identity authentication service system B. The cross-domain key negotiation process and the cross-domain authentication key application process refer to the process in Example 5 and will not be described again here. The difference between the cross-domain authentication process of Example 6 and Example 5 is that the authentication process of Example 5 is that the user side must first obtain the identity token Token from the identity authentication service system of the domain before completing the cross-domain authentication process, which has clear authentication prerequisites. The cross-domain identity authentication process of Example 6 adds a judgment mechanism to realize that when the user side first initiates a login request to the cross-domain identity authentication service system B, the identity authentication service system B identifies the user as a first-time cross-domain login user, and the identity authentication service system B returns a redirect message to the user side. The user side re-initiates the identity authentication process to the identity authentication service system A in the domain, which specifically includes the following steps: (1) The user-side terminal sends a connection request to the cross-domain identity authentication service system B. The request information includes (time-varying parameters||chip ID||QMSID-A). (2) Identity authentication service system B receives the connection request, identifies that the QMSID is a cross-domain user, and that the cache does not contain the user information, and determines that the user is a cross-domain user logging in for the first time. (3) Identity authentication service system B responds to the user terminal with a connection failure message and returns an authentication redirection message, which includes the IP or domain name and port parameters of identity authentication service system A. (4) The user-side terminal receives the authentication redirection message and initiates the identity authentication process to the identity authentication service system A. (5) The subsequent process is the same as that in Example 5 and will not be described again here. Example 7 As shown in Figure 7, the seventh embodiment of the present invention proposes a network-structured cross-domain identity authentication system based on a quantum key distribution network, the system comprising: a quantum key distribution network, a security chip, a user-side terminal, an identity authentication service system A, an identity authentication service system B, and an identity authentication service system C; the identity authentication service system A corresponds to the system within the domain on the user side, and the identity authentication service system B and the identity authentication service system C correspond to systems outside the cross-domain. The workflow of the cross-domain identity authentication system based on the quantum key distribution network of the network structure of this embodiment includes the following steps: (1) Cross-domain key negotiation process: Identity authentication service system A, as the active end, adopts the "request mode", and identity authentication service system B and identity authentication service system C, as the passive ends, both adopt the "push mode" key transmission mode to initiate a cross-domain key negotiation request to the quantum key management system. KM-A and KM-B are direct links, and KM-B and KM-C are direct links. KM-A and KM-C are relay links. 1-1) Identity authentication service system A calls the initialization interface to complete the initialization process of the quantum key management system A, and inputs QMSID-A, KMID-A, IP, and port parameters. 1-2) Identity authentication service system A, as the key application server, initiates a network authentication request to the quantum key management system. The quantum key management system generates a signature public and private key pair Kp and Ks and imports them into the identity authentication service system. 1-3) The identity authentication service system A uses the private key Ks to sign the authentication data, and the quantum key management system uses the preset public key Kp to verify the signed authentication information. After the verification is successful, it returns the authentication success. 1-4) Quantum key management system A returns tokenHandle-A, and identity authentication service system A caches the authentication token handle. The authentication token handle after authentication can be passed as an input parameter when calling the key application function. Identity authentication system B and identity authentication system C obtain the authentication token handle tokenHandle-B in the same way. 1-5) Identity authentication service system A acts as the active end and initiates key negotiation to quantum key management system A in a request-based manner. Quantum key management system A recognizes that the key negotiation request is a cross-domain key negotiation mode, and the negotiation request information includes (QMSID-A||KMID-A||QMSID-B||KMID-B) and (QMSID-A||KMID-A||QMSID-C||KMID-C) and is sent to the quantum key generation network. 1-6) The quantum key generation network triggers the direct key negotiation process between KM-A and KM-B according to the negotiation request information. After the negotiation process is completed, KM-A and KM-B generate symmetric keys respectively and store them in the direct key pools QuantumAB and QuantumBA. 1-7) The relay key negotiation process of KM-A and KM-C is triggered at the same time. After the negotiation process is completed, KM-A and KM-C generate symmetric keys respectively and store them in the relay key pools RelayAB and RelayBA. 1-8) Identity authentication service system A applies for batch keys in advance from quantum key management system A, inputs authentication token handle tokenHandle-A, QMSID-B, KMID-B, QMSID-C, KMID-C, and returns acquisition notification and key identifiers ReadkeyID-AB and ReadkeyID-AC. 1-9) Identity authentication service system B and identity authentication service system C, as passive terminals, use push-based monitoring to wait for the local quantum key management system B and quantum key management system C to return key information. The passive terminals cache the obtained key information for subsequent key acquisition. (2) Cross-domain authentication key application process: When the user-side terminal accesses the identity authentication service system A in the domain, it obtains the authentication key from the quantum key management system A based on the security chip. When the user-side terminal accesses the cross-domain identity authentication service system B and the identity authentication service system C respectively, the authentication key is obtained according to the assigned key identifier in accordance with the process of Example 1. 2-1) Quantum key management system A pre-sets quantum key to the security chip of the user-side terminal as the user master key; quantum key management system A stores the correspondence between the user master key and the security chip. 2-2) The user-side terminal initiates an authentication request to the identity authentication service system A, and obtains the user master key UMK-1, key identifier NUMK-1, and chip ID from the security chip. 2-3) The user-side terminal establishes sessions with the identity authentication service system A, the identity authentication service system B, and the identity authentication service system C respectively, and returns SessionID-AB and SessionID-AC respectively. 2-4) When the user terminal accesses the identity authentication service system B, the identity authentication service system A allocates the key identifier ReadkeyID-AB through the incoming session SessionID-AB. Authentication key application request information: User master key UMK-1 encrypted (chip ID||QMSID-A||KMID-A||ReadkeyID-AB) + key identifier NUMK-1. 2-5) Quantum key management system A searches for the corresponding key according to the key identifier NUMK-1 to complete the decryption of the authentication key request information, and applies for the authentication key WK-AB according to ReadkeyID-AB. The authentication key comes from KM-A's direct key pool QuantumAB. 2-6) The authentication key WK-AB is encrypted by the user master key UMK-1 and distributed to the user side terminal. The user side terminal searches for the corresponding user master key UMK-1 according to the key identifier NUMK-1 to complete the decryption, and the user side terminal obtains the authentication key WK-AB. The user side terminal maintains the relationship data of the authentication key WK-AB, ReadkeyID-AB, QMSID-A, and KMID-A. 2-7) When the user-side terminal accesses the identity authentication service system C, the processes 2-4) to 2-6) are repeated. (3) Cross-domain identity authentication process: The identity authentication service system obtains the authentication key to construct the ciphertext data of the Token, and uses the HMAC-SM3 algorithm combined with the authentication key to calculate the MAC value of the ciphertext data of the Token, and forwards the ciphertext data and MAC value of the Token to the user-side terminal. When the user needs to access the cross-domain identity authentication service system B and the identity authentication service system C respectively, the user side directly forwards the ciphertext data and MAC value of the Token constructed based on the cross-domain authentication key to the corresponding cross-domain identity authentication service system for decryption and verification, and responds that the cross-domain authentication is completed after passing. 3-1) When the user terminal accesses the identity authentication service system A in the domain, the login information is encrypted by the authentication key, and the login information ciphertext and the key identifier ReadkeyID are sent to the identity authentication service system A. ReadkeyID is selected according to the process

[0212] -

[0215] , and the cross-domain identity authentication service system that the user needs to access is selected. 3-2) When the user-side terminal accesses the cross-domain identity authentication service system B, the identity authentication service system A receives the ciphertext of the login information, and obtains the authentication key WK-AB from the quantum key management system A based on ReadkeyID-AB, decrypts and verifies the login information, and after the verification is passed, the identity authentication service system A generates a Token. 3-3) Identity authentication service system A uses authentication key WK-AB combined with the national secret SM4 algorithm to calculate the Token The ciphertext data is encrypted and the MAC value of the Token ciphertext data is calculated using the HMAC-SM3 algorithm combined with the authentication key. The ciphertext data and MAC value of the Token are forwarded to the user-side terminal. 3-4) The user-side terminal receives the ciphertext data and MAC value of the Token, uses the authentication key WK-AB to complete the decryption, and the message code is consistent, and the response authentication is completed. 3-5) When the user needs to access the cross-domain identity authentication service system B, the user-side terminal sends the ciphertext data of the Token generated in step 3-1), the MAC value and ReadkeyID-AB, QMSID-A, KMID-A to the identity authentication service system B. 3-6) The identity authentication service system B transmits ReadkeyID-AB, QMSID-A, KMID-A, and tokenHandle-B to the quantum key management system B. The quantum key management system B searches for the corresponding authentication key WK-BA based on the direct key pool QuantumBA generated in step 1-6). 3-7) Identity authentication service system B obtains the authentication key WK-BA, decrypts the ciphertext data and MAC value of the Token, and the decryption is completed by responding to the cross-domain authentication. If the response fails, the authentication fails. 3-8) When the user terminal accesses the identity authentication service system C, the process of steps 3-2) to 3-7) is repeated. The cross-domain identity authentication system based on the quantum key distribution network proposed in this embodiment has the following beneficial effects: (1) Improved security To solve the problem that authentication data is not encrypted or relies on public key algorithms during the distribution process, the authentication key is safely distributed based on the quantum key distribution network, the authentication data is encrypted based on the authentication key, and the data integrity is guaranteed through HMAC. (2) Preventing the threat of quantum computing to the security of classical cryptography Based on the information-theoretic security of quantum key distribution, the negotiation and generation of quantum symmetric keys are realized, which is safe even when quantum computing has infinite computing resources. Quantum symmetric keys are used as authentication keys for identity authentication data encryption, combined with symmetric algorithms to replace existing public key cryptographic algorithms that are vulnerable to quantum computing attacks. (3) Decentralized cross-domain identity authentication There is no need to centrally maintain user identity tokens between multiple cross-domain identity authentication service systems. When a user needs to access other cross-domain identity authentication service systems, the user side directly forwards the identity token ciphertext generated in this domain to the corresponding cross-domain identity authentication service system for decryption and verification. After passing, the cross-domain authentication is completed. (4) The technology is mature and easy to implement Quantum key distribution technology is currently recognized as the most representative and practical quantum security technology. It is a mature solution to generate and negotiate authentication keys based on quantum key distribution networks and use them for encryption and integrity of data such as identity tokens. The overall system changes are relatively small, and the user side uses a mature security chip integration solution to provide key storage and cryptographic algorithm functions; The authentication server directly connects to the quantum key distribution network through the key interface to apply for keys, which is easy to implement and there is no need to worry about the large key consumption on the server. In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined. Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A cross-domain identity authentication method based on a quantum key distribution network, characterized in that: Applied to an identity authentication service system, the method comprises: Sending a key negotiation request to a corresponding quantum key management system, which is forwarded by the quantum key management system to a quantum key generation system, so that the quantum key generation system establishes a relay key negotiation link between quantum key terminals and generates a symmetric authentication key; Receiving an authentication request sent by a corresponding user-side terminal, and allocating an identifier of the authentication key to the user-side terminal based on the authentication request, so that when the user-side terminal accesses a cross-domain identity authentication service system, the user-side terminal applies for the authentication key from a quantum key management system corresponding to the cross-domain identity authentication service system based on the identifier of the authentication key; Receive the login request information sent by the corresponding user side terminal, and respond to the user side terminal with a constructed token ciphertext based on the login request information, so as to forward the token ciphertext to the cross-domain identity authentication service system when the user side terminal accesses the cross-domain identity authentication service system.

2. The cross-domain identity authentication method based on quantum key distribution network according to claim 1, characterized in that: Before sending the key negotiation request to the corresponding quantum key management system, the method further includes: Sending a network access authentication request to the corresponding quantum key management system, so that the quantum key management system generates a signature public-private key pair and returns the signature public-private key pair to the identity authentication service system; Sign authentication data using the private key in the signature public-private key pair, obtain signature data and send it to the quantum key management system, so that the quantum key management system verifies authentication information of the signature data based on the public key; After the quantum key management system passes the verification, an authentication token handle returned by the quantum key management system is received.

3. The cross-domain identity authentication method based on quantum key distribution network according to claim 1 is characterized in that: The step of sending a key negotiation request to a corresponding quantum key management system, and forwarding the request to a quantum key generation system by the quantum key management system, so that the quantum key generation system establishes a quantum key terminal relay key negotiation link and generates a symmetric authentication key, comprises: Send a key agreement request to the corresponding quantum key management system, where the information carried in the key agreement request is QMSID-A||KMID-A||QMSID-B||KMID-B, where QMSID-A is a virtual unique identifier of quantum key management system A, KMID-A is a virtual unique identifier of a quantum key terminal corresponding to quantum key management system A, QMSID-B is a virtual unique identifier of quantum key management system B, KMID-B is a virtual quasi-unique identifier of a quantum key terminal corresponding to quantum key management system B, and || represents a logical AND character; The quantum key management system sends the key negotiation request to the quantum key generation system, so that the quantum key generation system triggers the relay key negotiation between quantum key virtual terminals, generates the symmetric authentication key and stores it in In the relay key pool corresponding to each relay.

4. The cross-domain identity authentication method based on quantum key distribution network as claimed in claim 3 is characterized in that: After sending the key negotiation request to the corresponding quantum key management system, the method further includes: Sending a batch key request to the quantum key management system, wherein the batch key request carries information including an authentication token handle, QMSID-B, and KMID-B; Receive the identification ReadkeyID of the authentication key returned by the quantum key management system, wherein the cross-domain identity authentication service system, as a passive end, adopts push-type monitoring to wait for the quantum key management system corresponding to the local end to return the identification ReadkeyID of the authentication key.

5. The cross-domain identity authentication method based on quantum key distribution network according to claim 1, characterized in that: The authentication request sent by the user side terminal carries information including a user master key, a user master key identifier and a security chip ID. The user master key is stored in the security chip, and the security chip is set in the user side terminal.

6. The cross-domain identity authentication method based on quantum key distribution network as claimed in claim 1, characterized in that: The receiving of the login request information sent by the corresponding user side terminal, and responding to the user side terminal with a constructed token ciphertext based on the login request information, includes: Receiving login request information sent by the corresponding user-side terminal, the login request information including the identifier of the authentication key and the ciphertext of the login information encrypted by using the authentication key; Requesting the quantum key management system to obtain the authentication key based on the identifier of the authentication key; The login request information is verified based on the authentication key, and the token ciphertext is generated after the verification is passed.

7. The cross-domain identity authentication method based on quantum key distribution network as claimed in claim 6 is characterized in that: Verifying the login request information based on the authentication key and generating the token ciphertext after the verification is passed, including: After the login information is verified, an identity token is generated; The authentication key is used in combination with an encryption algorithm to calculate the ciphertext data of the identity token Token; Calculate the MAC value of the ciphertext data of the identity token Token using a hash operation combined with the authentication key; The token ciphertext is generated based on the ciphertext data of the identity token Token and its MAC value.

8. The cross-domain identity authentication method based on quantum key distribution network as claimed in claim 1, characterized in that: The method further comprises: Receiving login request information sent by a user-side terminal corresponding to the cross-domain identity authentication service system, wherein the login request information carries the token ciphertext; Sending the token ciphertext to a corresponding quantum key management system so that the quantum key management system searches for an authentication key; The authentication key is received and the token ciphertext is decrypted using the authentication key to obtain a cross-domain authentication result.

9. The cross-domain identity authentication method based on quantum key distribution network as claimed in claim 8, characterized in that: When receiving the login request information sent by the user-side terminal corresponding to the cross-domain identity authentication service system, if the login request information does not carry the token ciphertext, the method further includes: A connection failure message and an authentication redirection message are responded to the user-side terminal corresponding to the cross-domain identity authentication service system, wherein the authentication redirection message includes parameter information of the cross-domain identity authentication service system.

10. The cross-domain identity authentication method based on a quantum key distribution network according to any one of claims 1 to 9, characterized in that: The cross-domain identity authentication service system includes at least one authentication service system outside the cross-domain.

11. A cross-domain identity authentication method based on a quantum key distribution network, characterized in that: Applied to a user-side terminal, the method includes: Sending an authentication request to the corresponding identity authentication service system to obtain an authentication key identifier assigned by the identity authentication service system; Sending an authentication key application request to a corresponding quantum key management system based on the authentication key identifier to obtain an authentication key returned by the quantum key management system; Sending a login request message to the identity authentication service system, so that the identity authentication service system generates a token ciphertext based on the login request message, wherein the login request message is encrypted using the authentication key; The token ciphertext is received, and when the user-side terminal accesses the cross-domain identity authentication service system, a login request is sent to the cross-domain identity authentication service system, wherein the login request carries the token ciphertext.

12. The cross-domain identity authentication method based on quantum key distribution network according to claim 11, characterized in that: The user-side terminal is provided with a security chip, in which a quantum key preset by a quantum key distribution system is stored as a user master key, and the sending of an authentication request to a corresponding identity authentication service system to obtain an authentication key identifier assigned by the identity authentication service system includes: Sending an authentication request to the identity authentication service system, wherein the authentication request carries information including a user master key, a user master key identifier, and a security chip ID; A session is established with the identity authentication service system, and an authentication key identifier ReadkeyID allocated by the identity authentication service system is received.

13. The cross-domain identity authentication method based on quantum key distribution network according to claim 12, characterized in that: The step of sending an authentication key application request to a corresponding quantum key management system based on the authentication key identifier to obtain an authentication key returned by the quantum key management system includes: Construct authentication key request information and send it to the corresponding quantum key management system, the authentication key request information includes the user master key identifier and the request information encrypted by the user master key, the request information is: security chip ID||QMSID-A||KMID-A||ReadkeyID, QMSID-A is the virtual unique identifier of quantum key management system A, KMID-A is the virtual unique identifier of the quantum key terminal corresponding to the quantum key management system A, and ReadkeyID is the authentication key identifier; After the quantum key management system successfully decrypts the authentication key request information by searching for the corresponding user master key according to the user master key identifier, receiving an authentication key encrypted message returned by the quantum key management system, where the authentication key encrypted message is obtained by encrypting the authentication key by the quantum key management system using the user master key; The corresponding user master key is searched according to the user master key identifier, and the authentication key encrypted message is decrypted to obtain the authentication key.

14. The cross-domain identity authentication method based on quantum key distribution network according to claim 13, characterized in that: The receiving of the token ciphertext and sending a login request to the cross-domain identity authentication service system when the user-side terminal accesses the cross-domain identity authentication service system, wherein the login request carries the token ciphertext, includes: Receive the token ciphertext, and use the authentication key to decrypt and verify the token ciphertext to confirm that the response authentication is completed; when the user-side terminal accesses the cross-domain identity authentication service system, forward the token ciphertext to the quantum key management system corresponding to the cross-domain identity authentication service system; Receive the cross-domain authentication result returned by the quantum key management system corresponding to the cross-domain identity authentication service system.

15. The cross-domain identity authentication method based on quantum key distribution network according to claim 13, characterized in that: Accessing the cross-domain identity authentication service system at the user-side terminal, sending a login request to the cross-domain identity authentication service system, if the login request does not carry the token ciphertext, the method further includes: Receiving a connection failure message and a redirection message returned by the cross-domain identity authentication service system, wherein the redirection message includes parameter information of the identity authentication service system in the local domain; Based on the parameter information of the identity authentication service system in the domain, an identity authentication process is initiated to the identity authentication service system in the domain.

16. An identity authentication service system, characterized in that: The system comprises: A key negotiation request sending module, used to send a key negotiation request to a corresponding quantum key management system, and the quantum key management system forwards the key negotiation request to a quantum key generation system, so that the quantum key generation system establishes a relay key negotiation link between quantum key terminals and generates a symmetric authentication key; A request receiving module is used to receive an authentication request sent by a corresponding user side terminal, and to send an authentication request to the user side terminal based on the authentication request. The user-side terminal allocates the identification of the authentication key, so that when the user-side terminal accesses the cross-domain identity authentication service system, it applies for the authentication key from the quantum key management system corresponding to the cross-domain identity authentication service system based on the identification of the authentication key; The identity authentication module is used to receive the login request information sent by the corresponding user side terminal, and respond to the user side terminal with a constructed token ciphertext based on the login request information, so as to forward the token ciphertext to the cross-domain identity authentication service system when the user side terminal accesses the cross-domain identity authentication service system.

17. A user-side terminal, characterized in that: The terminal comprises: An authentication request module, used to send an authentication request to a corresponding identity authentication service system to obtain an authentication key identifier assigned by the identity authentication service system; An authentication key application module, configured to send an authentication key application request to a corresponding quantum key management system based on the authentication key identifier, so as to obtain an authentication key returned by the quantum key management system; A login request module sends login request information to the identity authentication service system so that the identity authentication service system generates a token ciphertext based on the login request information, wherein the login request information is encrypted using the authentication key; a cross-domain authentication module is used to receive the token ciphertext and send a login request to the cross-domain identity authentication service system when a user-side terminal accesses the cross-domain identity authentication service system, wherein the login request carries the token ciphertext.

18. A cross-domain identity authentication system based on a quantum key distribution network, characterized in that: The system includes a user-side terminal, a quantum key generation system, an identity authentication service system A in the local domain of the user-side terminal, and an identity authentication service system B in the cross-domain of the user-side terminal, wherein the identity authentication service system A is connected to a quantum key management system A, the identity authentication service system B is connected to a quantum key management system B, and both the quantum key management system A and the quantum key management system B are connected to the quantum key generation system, wherein: The identity authentication service system A and the identity authentication service system B are used to send a key negotiation request to the quantum key generation system, establish a relay key negotiation link between quantum key terminals in the quantum key generation system, and generate a symmetric authentication key; The user-side terminal sends an authentication request to the identity authentication service system A, and receives an authentication key identifier returned by the identity authentication service system A; The user-side terminal sends a login request message to the identity authentication service system A, and receives a token ciphertext responded by the identity authentication service system A; The user-side terminal accesses the identity authentication service system B based on the token ciphertext.

Images